Unified Tenant Configuration Management (UTCM) Monitor
Configuration file for the Unified Tenant Configuration Management (UTCM) Monitor
| Type | object |
|---|---|
| File match |
*.utcm-monitor.json
|
| Schema URL | https://catalog.lintel.tools/schemas/schemastore/unified-tenant-configuration-management-utcm-monitor/latest.json |
| Source | https://www.schemastore.org/utcm-monitor.json |
Validate with Lintel
npx @lintel/lintel check
Schema for entity configurationMonitor
Properties
Schema for entity openComplexDictionaryType
Schema for entity configurationBaseline
5 nested properties
Definitions
This resource configures the Accepted Email Domains in Exchange Online.
Specify the Fully Qualified Domain Name for the AcceptedDomain.
Specify if the AcceptedDomain should exist or not.
The type of AcceptedDomain. Currently the EXOAcceptedDomain DSC Resource accepts a value of 'Authoritative' and 'InternalRelay'.
The MatchSubDomains parameter must be false on Authoritative domains. The default value is false.
OutboundOnly can only be enabled if the DomainType parameter is set to Authoritative or InternalRelay. The default value is false.
This resource configures Active Sync Device Access Rules in Exchange Online.
The Identity parameter specifies the identity of the device access rule.
The AccessLevel parameter specifies whether the devices are allowed, blocked or quarantined.
The Characteristic parameter specifies the device characteristic or category that's used by the rule.
The QueryString parameter specifies the device identifier that's used by the rule. This parameter uses a text value that's used with Characteristic parameter value to define the device.
Specify if the Active Sync Device Access Rule should exist or not.
This resource configures Address Book Policies in Exchange Online.
The Name parameter specifies the name that you want this address book policy to be called.
The AddressLists parameter specifies the address lists that will be used by mailbox users who are assigned this address book policy. This parameter accepts multiple values.
The GlobalAddressList parameter specifies the identity of the global address list (GAL) that will be used by mailbox users who are assigned this address book policy. You can specify only one GAL for each address book policy.
The OfflineAddressBook parameter specifies the identity of the offline address book (OAB) that will be used by mailbox users who are assigned this address book policy. You can specify only one OAB for each address book policy.
The RoomList parameter specifies the name of the room address list.
Specify if the Address Book Policy should exist or not.
This resource configures Exchange Online address lists.
The Name parameter specifies a unique name for the address list.
The ConditionalCompany parameter specifies a precanned filter that's based on the value of the recipient's Company property.
The ConditionalCustomAttribute1 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute1 property.
The ConditionalCustomAttribute10 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute10 property.
The ConditionalCustomAttribute11 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute11 property.
The ConditionalCustomAttribute12 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute12 property.
The ConditionalCustomAttribute13 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute13 property.
The ConditionalCustomAttribute14 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute14 property.
The ConditionalCustomAttribute15 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute15 property.
The ConditionalCustomAttribute2 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute2 property.
The ConditionalCustomAttribute3 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute3 property.
The ConditionalCustomAttribute4 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute4 property.
The ConditionalCustomAttribute5 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute5 property.
The ConditionalCustomAttribute6 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute6 property.
The ConditionalCustomAttribute7 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute7 property.
The ConditionalCustomAttribute8 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute8 property.
The ConditionalCustomAttribute9 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute9 property.
The ConditionalDepartment parameter specifies a precanned filter that's based on the value of the recipient's Department property.
The ConditionalStateOrProvince parameter specifies a precanned filter that's based on the value of the recipient's StateOrProvince property.
The DisplayName parameter specifies the display name of the address list.
The IncludedRecipients parameter specifies a precanned filter that's based on the recipient type.
The RecipientFilter parameter specifies a custom OPath filter that's based on the value of any available recipient property.
Specifies if this AddressList should exist.
This resource configures an Anti-Phish Policy in Exchange Online. Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-antiphishpolicy?view=exchange-ps
The Identity parameter specifies the name of the antiphishing policy that you want to modify.
Specify if this policy should exist or not.
The AdminDisplayName parameter specifies a description for the policy.
The PhishThresholdLevel parameter specifies the tolerance level that's used by machine learning in the handling of phishing messages.
The AuthenticationFailAction parameter specifies the action to take when the message fails composite authentication.
The TargetedUserProtectionAction parameter specifies the action to take on detected user impersonation messages for the users specified by the TargetedUsersToProtect parameter.
Specify if this policy should be enabled. Default is $true.
The EnableFirstContactSafetyTips parameter specifies whether to enable or disable the safety tip that's shown when recipients first receive an email from a sender or do not often receive email from a sender.
The EnableMailboxIntelligence parameter specifies whether to enable or disable mailbox intelligence (the first contact graph) in domain and user impersonation protection.
The EnableMailboxIntelligenceProtection specifies whether to enable or disable enhanced impersonation results based on each user's individual sender map. This intelligence allows Microsoft 365 to customize user impersonation detection and better handle false positives.
The EnableOrganizationDomainsProtection parameter specifies whether to enable domain impersonation protection for all registered domains in the Office 365 organization.
The EnableSimilarDomainsSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for domain impersonation detections.
The EnableSimilarUsersSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for user impersonation detections.
The EnableSpoofIntelligence parameter specifies whether to enable or disable antispoofing protection for the policy.
The EnableTargetedDomainsProtection parameter specifies whether to enable domain impersonation protection for a list of specified domains.
The EnableTargetedUserProtection parameter specifies whether to enable user impersonation protection for the users specified by the TargetedUsersToProtect parameter
The EnableUnauthenticatedSender parameter enables or disables unauthenticated sender identification in Outlook.
The EnableUnusualCharactersSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for unusual characters in domain and user impersonation detections.
This setting is part of spoof protection. The EnableViaTag parameter enables or disables adding the via tag to the From address in Outlook.
Make this the default antiphishing policy
The ExcludedDomains parameter specifies trusted domains that are excluded from scanning by antiphishing protection. You can specify multiple domains separated by commas.
The ExcludedSenders parameter specifies a list of trusted sender email addresses that are excluded from scanning by antiphishing protection. You can specify multiple email addresses separated by commas.
The HonorDmarcPolicy enables or disables using the sender's DMARC policy to determine what to do to messages that fail DMARC checks.
The ImpersonationProtectionState parameter specifies the configuration of impersonation protection.
The MailboxIntelligenceProtectionAction parameter specifies what to do with messages that fail mailbox intelligence protection.
The MailboxIntelligenceProtectionActionRecipients parameter specifies the recipients to add to detected messages when the MailboxIntelligenceProtectionAction parameter is set to the value Redirect or BccMessage.
The MailboxIntelligenceQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by mailbox intelligence.
The SpoofQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by spoof intelligence.
The TargetedDomainActionRecipients parameter specifies the recipients to add to detected domain impersonation messages when the TargetedDomainProtectionAction parameter is set to the value Redirect or BccMessage. A valid value for this parameter is an email address. You can specify multiple email addresses separated by commas.
The TargetedDomainProtectionAction parameter specifies the action to take on detected domain impersonation messages.
The TargetedDomainsToProtect parameter specifies the domains that are included in domain impersonation protection when the EnableTargetedDomainsProtection parameter is set to $true.
The TargetedDomainQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by domain impersonation protection.
The TargetedUserActionRecipients parameter specifies the replacement or additional recipients for detected user impersonation messages when the TargetedUserProtectionAction parameter is set to the value Redirect or BccMessage. A valid value for this parameter is an email address. You can specify multiple email addresses separated by commas.
The TargetedUsersToProtect parameter specifies the users that are included in user impersonation protection when the EnableTargetedUserProtection parameter is set to $true.
The TargetedUserQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by user impersonation protection.
This resource configures an Anti-Phish Rule in Exchange Online. Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-antiphishRule?view=exchange-ps
The Identity parameter specifies the name of the antiphishing rule that you want to modify.
The AntiPhishPolicy parameter specifies the name of the antiphishing policy that's associated with the antiphishing rule.
Specify if this rule should exist or not.
Specify if this rule should be enabled. Default is $true.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
This resource configures Applications Access Policies in Exchange Online.
The Identity parameter specifies the application access policy that you want to modify.
The AccessRight parameter specifies the permission that you want to assign in the application access policy.
The AppID parameter specifies the GUID of the apps to include in the policy.
The PolicyScopeGroupID parameter specifies the recipient to define in the policy. You can use any value that uniquely identifies the recipient.
The Description parameter specifies a description for the policy.
Specify if the Application Access Policy should exist or not.
This resource configures the Advanced Threat Protection (ATP) policy in Office 365. Tenant must be subscribed to ATP.
Specifies the resource is a single instance, the value must be 'Yes'
The Identity parameter specifies the ATP policy that you want to modify. There's only one policy named Default.
Since there is only one policy, the default policy, this must be set to 'Present'
The AllowSafeDocsOpen parameter specifies whether users can click through and bypass the Protected View container even when Safe Documents identifies a file as malicious.
The EnableATPForSPOTeamsODB parameter specifies whether ATP is enabled for SharePoint Online, OneDrive for Business and Microsoft Teams. Default is $false.
The EnableSafeDocs parameter specifies whether to enable the Safe Documents feature in the organization. Default is $false.
This resource configures Authentication Policies in Exchange Online.
The Identity parameter specifies the authentication policy you want to view or modify.
The AllowBasicAuthActiveSync switch specifies whether to allow Basic authentication with Exchange Active Sync.
The AllowBasicAuthAutodiscover switch specifies whether to allow Basic authentication with Autodiscover.
The AllowBasicAuthImap switch specifies whether to allow Basic authentication with IMAP.
The AllowBasicAuthMapi switch specifies whether to allow Basic authentication with MAPI.
The AllowBasicAuthOfflineAddressBook switch specifies whether to allow Basic authentication with Offline Address Books.
The AllowBasicAuthOutlookService switch specifies whether to allow Basic authentication with the Outlook service.
The AllowBasicAuthPop switch specifies whether to allow Basic authentication with POP.
The AllowBasicAuthPowerShell switch specifies whether to allow Basic authentication with PowerShell.
The AllowBasicAuthReporting Web Services switch specifies whether to allow Basic authentication with reporting web services.
The AllowBasicAuthRpc switch specifies whether to allow Basic authentication with RPC.
The AllowBasicAuthSmtp switch specifies whether to allow Basic authentication with SMTP.
The AllowBasicAuthWebServices switch specifies whether to allow Basic authentication with Exchange Web Services (EWS).
Specify if the authentication Policy should exist or not.
This resource assigns Exchange Online Authentication Policies to users.
Name of the user assigned to the authentication policy.
Name of the authentication policy.
Specify if the authentication Policy should exist or not.
Create a new AvailabilityAddressSpace in your cloud-based organization.
The Identity parameter specifies the AvailabilityAddressSpace you want to modify.
The AccessMethod parameter specifies how the free/busy data is accessed. Valid values are:PerUserFB, OrgWideFB, OrgWideFBToken, OrgWideFBBasic,InternalProxy
The Credentials parameter specifies the username and password that's used to access the Availability services in the target forest.
The ForestName parameter specifies the SMTP domain name of the target forest for users whose free/busy data must be retrieved. If your users are distributed among multiple SMTP domains in the target forest, run the Add-AvailabilityAddressSpace command once for each SMTP domain.
The TargetAutodiscoverEpr parameter specifies the Autodiscover URL of Exchange Web Services for the external organization. Exchange uses Autodiscover to automatically detect the correct server endpoint for external requests.
The TargetServiceEpr parameter specifies the Exchange Online Calendar Service URL of the external Microsoft 365 organization that you're trying to read free/busy information from.
The TargetTenantID parameter specifies the tenant ID of the external Microsoft 365 organization that you're trying to read free/busy information from.
Specifies if this AvailabilityAddressSpace should exist.
This resource configures the Availability Config in Exchange Online.
Specify the OrgWideAccount for the AvailabilityConfig.
Specify if the AvailabilityConfig should exist or not.
This resource configures the Calendar Processing settings Exchange Online.
The Identity parameter specifies the resource mailbox that you want to view. You can use any value that uniquely identifies the mailbox.
The AddAdditionalResponse parameter specifies whether additional information (the value of the AdditionalResponse parameter) is added to meeting request responses
The AdditionalResponse parameter specifies the additional information to be included in responses to meeting requests when the value of the AddAdditionalResponse parameter is $true. If the value contains spaces, enclose the value in quotation marks.
The AddNewRequestsTentatively parameter specifies whether new meeting requests are added to the calendar as tentative
The AddOrganizerToSubject parameter specifies whether the meeting organizer's name is used as the subject of the meeting request.
The AllBookInPolicy parameter specifies whether to automatically approve in-policy requests from all users to the resource mailbox.
The AllowConflicts parameter specifies whether to allow conflicting meeting requests.
The AllowRecurringMeetings parameter specifies whether to allow recurring meetings in meeting requests.
The AllRequestInPolicy parameter specifies whether to allow all users to submit in-policy requests to the resource mailbox.
The AllRequestOutOfPolicy parameter specifies whether to allow all users to submit out-of-policy requests to the resource mailbox.
The AutomateProcessing parameter enables or disables calendar processing on the mailbox.
The BookingType parameter specifies how reservations work on the resource mailbox.
The BookingWindowInDays parameter specifies the maximum number of days in advance that the resource can be reserved. A valid value is an integer from 0 through 1080. The default value is 180 days. The value 0 means today.
The BookInPolicy parameter specifies users or groups who are allowed to submit in-policy meeting requests to the resource mailbox that are automatically approved. You can use any value that uniquely identifies the user or group.
The ConflictPercentageAllowed parameter specifies the maximum percentage of meeting conflicts for new recurring meeting requests. A valid value is an integer from 0 through 100. The default value is 0.
The DeleteAttachments parameter specifies whether to remove attachments from all incoming messages.
The DeleteComments parameter specifies whether to remove or keep any text in the message body of incoming meeting requests.
The DeleteNonCalendarItems parameter specifies whether to remove or keep all non-calendar-related messages that are received by the resource mailbox.
The DeleteSubject parameter specifies whether to remove or keep the subject of incoming meeting requests.
N/A
The EnableResponseDetails parameter specifies whether to include the reasons for accepting or declining a meeting in the response email message.
The EnforceCapacity parameter specifies whether to restrict the number of attendees to the capacity of the workspace. For example, if capacity is set to 10, then only 10 people can book the workspace.
The EnforceSchedulingHorizon parameter controls the behavior of recurring meetings that extend beyond the date specified by the BookingWindowInDays parameter.
The ForwardRequestsToDelegates parameter specifies whether to forward incoming meeting requests to the delegates that are configured for the resource mailbox.
The MaximumConflictInstances parameter specifies the maximum number of conflicts for new recurring meeting requests when the AllowRecurringMeetings parameter is set to $true. A valid value is an integer from 0 through INT32 (2147483647). The default value is 0.
The MaximumDurationInMinutes parameter specifies the maximum duration in minutes for meeting requests. A valid value is an integer from 0 through INT32 (2147483647). The default value is 1440 (24 hours).
The MinimumDurationInMinutes parameter specifies the minimum duration in minutes for meeting requests in workspace mailboxes. A valid value is an integer from 0 through INT32 (2147483647). The default value is 0, which means there is no minimum duration.
The OrganizerInfo parameter specifies whether the resource mailbox sends organizer information when a meeting request is declined because of conflicts.
N/A
The ProcessExternalMeetingMessages parameter specifies whether to process meeting requests that originate outside the Exchange organization.
The RemoveCanceledMeetings parameter specifies whether to automatically delete meetings that were cancelled by the organizer from the resource mailbox's calendar.
The RemoveForwardedMeetingNotifications parameter specifies whether forwarded meeting notifications are moved to the Deleted Items folder after they're processed by the Calendar Attendant.
The RemoveOldMeetingMessages parameter specifies whether the Calendar Attendant removes old and redundant updates and responses.
The RemovePrivateProperty parameter specifies whether to clear the private flag for incoming meetings that were sent by the organizer in the original requests.
The RemovePrivateProperty parameter specifies whether to clear the private flag for incoming meetings that were sent by the organizer in the original requests.
The RequestOutOfPolicy parameter specifies users who are allowed to submit out-of-policy requests that require approval by a resource mailbox delegate. You can use any value that uniquely identifies the user.
The ResourceDelegates parameter specifies users can approve or reject requests that are sent to the resource mailbox. You can use any value that uniquely identifies the user.
The ScheduleOnlyDuringWorkHours parameter specifies whether to allow meetings to be scheduled outside of the working hours that are defined for the resource mailbox.
The TentativePendingApproval parameter specifies whether to mark pending requests as tentative on the calendar.
Determines whether or not the instance exist.
This resource configures Client Access services (CAS) mailbox plans in cloud-based organizations.
The Identity parameter specifies the CAS Mailbox Plan that you want to modify.
The display name of the CAS Mailbox Plan.
CASMailboxPlans cannot be created/removed in O365. This must be set to 'Present'
The ActiveSyncEnabled parameter enables or disables access to the mailbox by using Exchange Active Sync. Default is $true.
The ImapEnabled parameter enables or disables access to the mailbox by using IMAP4 clients. The default value is $true for all CAS mailbox plans except ExchangeOnlineDeskless which is $false by default.
The OwaMailboxPolicy parameter specifies the Outlook on the web (formerly known as Outlook Web App) mailbox policy for the mailbox plan. The default value is OwaMailboxPolicy-Default. You can use the Get-OwaMailboxPolicy cmdlet to view the available Outlook on the web mailbox policies.
The PopEnabled parameter enables or disables access to the mailbox by using POP3 clients. Default is $true.
This resource configures CAS mailbox settings.
The Identity parameter specifies the mailbox that you want to configure.
TheActiveSyncAllowedDeviceIDs parameter specifies one or more Exchange ActiveSync device IDs that are allowed to synchronize with the mailbox.
The ActiveSyncBlockedDeviceIDs parameter specifies one or more Exchange ActiveSync device IDs that aren't allowed to synchronize with the mailbox.
The ActiveSyncDebugLogging parameter enables or disables Exchange ActiveSync debug logging for the mailbox.
The ActiveSyncEnabled parameter enables or disables access to the mailbox using Exchange ActiveSync.
The ActiveSyncMailboxPolicy parameter specifies the Exchange ActiveSync mailbox policy for the mailbox.
The ActiveSyncSuppressReadReceipt parameter controls the behavior of read receipts for Exchange ActiveSync clients that access the mailbox.
The EwsAllowEntourage parameter enables or disables access to the mailbox by Microsoft Entourage clients that use Exchange Web Services.
The EwsAllowList parameter specifies the Exchange Web Services applications (user agent strings) that are allowed to access the mailbox.
The EwsAllowMacOutlook parameter enables or disables access to the mailbox by Outlook for Mac clients that use Exchange Web Services.
The EwsAllowOutlook parameter enables or disables access to the mailbox by Outlook clients that use Exchange Web Services.
The EwsApplicationAccessPolicy parameter controls access to the mailbox using Exchange Web Services applications.
The EwsBlockList parameter specifies the Exchange Web Services applications (user agent strings) that aren't allowed to access the mailbox using Exchange Web Services.
The EwsEnabled parameter enables or disables access to the mailbox using Exchange Web Services clients.
The ImapEnabled parameter enables or disables access to the mailbox using IMAP4 clients.
The ImapMessagesRetrievalMimeFormat parameter specifies the message format for IMAP4 clients that access the mailbox.
The ImapForceICalForCalendarRetrievalOption parameter specifies how meeting requests are presented to IMAP4 clients that access the mailbox.
The ImapSuppressReadReceipt parameter controls the behavior of read receipts for IMAP4 clients that access the mailbox.
The ImapUseProtocolDefaults parameter specifies whether to use the IMAP4 protocol defaults for the mailbox.
The MacOutlookEnabled parameter enables or disables access to the mailbox using Outlook for Mac clients that use Microsoft Sync technology.
The MAPIEnabled parameter enables or disables access to the mailbox using MAPI clients (for example, Outlook).
The OneWinNativeOutlookEnabled parameter enables or disables access to the mailbox using the new Outlook for Windows.
The OutlookMobileEnabled parameter enables or disables access to the mailbox using Outlook for iOS and Android.
The OWAEnabled parameter enables or disables access to the mailbox using Outlook on the web (formerly known as Outlook Web App or OWA).
The OWAforDevicesEnabled parameter enables or disables access to the mailbox using the older Outlook Web App (OWA) app on iOS and Android devices.
The OwaMailboxPolicy parameter specifies the Outlook on the web mailbox policy for the mailbox.
The PopEnabled parameter enables or disables access to the mailbox using POP3 clients.
The PopForceICalForCalendarRetrievalOption parameter specifies how meeting requests are presented to POP3 clients that access the mailbox.
The PopMessagesRetrievalMimeFormat parameter specifies the message format for POP3 clients that access the mailbox.
The PopSuppressReadReceipt parameter controls the behavior of read receipts for POP3 clients that access the mailbox.
The PopUseProtocolDefaults parameter specifies whether to use the POP3 protocol defaults for the mailbox.
The PublicFolderClientAccess parameter enables or disables access to public folders in Microsoft Outlook.
The ShowGalAsDefaultView parameter specifies whether the global address list (GAL) is the default recipient picker for messages.
The SmtpClientAuthenticationDisabled parameter specifies whether to disable authenticated SMTP (SMTP AUTH) for the mailbox.
The UniversalOutlookEnabled parameter enables or disables access to the mailbox using Windows 10 Mail and Calendar.
Present ensures the Mailbox CAS settings are applied.
This resource configures Client Access sRules. Client Access Rules help you control access to your organization based on the properties of the connection.
Note: Not all authentication types are supported for all protocols.
The supported authentication types per protocol can be found here: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/client-access-rules/client-access-rules
The Identity parameter specifies the client access rule that you want to modify.
The Action parameter specifies the action for the client access rule. Valid values for this parameter are AllowAccess and DenyAccess.
The AnyOfAuthenticationTypes parameter specifies a condition for the client access rule that is based on the client's authentication type. Valid values for this parameter are AdfsAuthentication, BasicAuthentication, CertificateBasedAuthentication, NonBasicAuthentication, OAuthAuthentication.
The AnyOfClientIPAddressesOrRanges parameter specifies a condition for the client access rule that is based on the client's IP address. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.
The AnyOfProtocols parameter specifies a condition for the client access rule that is based on the client's protocol. Valid values for this parameter are ExchangeActiveSync,ExchangeAdminCenter,ExchangeWebServices,IMAP4,OfflineAddressBook,OutlookAnywhere,OutlookWebApp,POP3,PowerShellWebServices,RemotePowerShell,REST,UniversalOutlook.
The Enabled parameter specifies whether the client access rule is enabled or disabled. Default is $true.
The ExceptAnyOfAuthenticationTypes parameter specifies an exception for the client access rule that is based on the client's authentication type. Valid values for this parameter are AdfsAuthentication, BasicAuthentication, CertificateBasedAuthentication, NonBasicAuthentication, OAuthAuthentication.
The ExceptAnyOfClientIPAddressesOrRanges parameter specifies an exception for the client access rule that is based on the client's IP address. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.
The ExceptAnyOfProtocols parameter specifies an exception for the client access rule that is based on the client's protocol. Valid values for this parameter are ExchangeActiveSync,ExchangeAdminCenter,ExchangeWebServices,IMAP4,OfflineAddressBook,OutlookAnywhere,OutlookWebApp,POP3,PowerShellWebServices,RemotePowerShell,REST,UniversalOutlook.
The ExceptUsernameMatchesAnyOfPatterns parameter specifies an exception for the client access rule that is based on the user's account name.
The Priority parameter specifies a priority value for the client access rule. A lower integer value indicates a higher priority, and a higher priority rule is evaluated before a lower priority rule. The default value is 1.
The RuleScope parameter specifies the scope of the client access rule. Valid values are All and Users
The UserRecipientFilter parameter specifies a condition for the client access rule that uses OPath filter syntax to identify the user.
The UsernameMatchesAnyOfPatterns parameter specifies a condition for the client access rule that is based on the user's account name.
Specifies if this Client Access Rule should exist.
Create a new data classification policy in your cloud-based organization.
The Identity parameter specifies the data classification rule that you want to modify.
The Description parameter specifies a description for the data classification rule. You use the Description parameter with the Locale and Name parameters to specify descriptions for the data classification rule in different languages.
The Fingerprints parameter specifies the byte-encoded document files that are used as fingerprints by the data classification rule.
IsDefault is used with the Locale parameter to specify the default language for the data classification rule.
The Locale parameter adds or removes languages that are associated with the data classification rule.
The Name parameter specifies a name for the data classification rule. The value must be less than 256 characters.
Specifies if this policy should exist.
Create a new Data Encryption policy in your cloud-based organization.
The Identity parameter specifies the data encryption policy that you want to modify.
The AzureKeyIDs parameter specifies the URI values of the Azure Key Vault keys to associate with the data encryption policy.
The Description parameter specifies an optional description for the data encryption policy
The Enabled parameter enables or disable the data encryption policy.
The Name parameter specifies the unique name for the data encryption policy.
The PermanentDataPurgeContact parameter specifies a contact for the purge of all data that's encrypted by the data encryption policy.
The PermanentDataPurgeReason parameter specifies a descriptive reason for the purge of all data that's encrypted by the data encryption policy
Specifies if this policy should exist.
This resource configures Exchange Online distribution groups.
The Identity parameter specifies the distribution group or mail-enabled security group that you want to modify. You can use any value that uniquely identifies the group.
The Name parameter specifies a unique name for the address list.
Exchange alias (also known as the mail nickname) for the recipient
Is Bcc blocked for the distribution group.
The ByPassNestedModerationEnabled parameter specifies how to handle message approval when a moderated group contains other moderated groups as members.
Description of the distribution group.
The DisplayName parameter specifies the display name of the group. The display name is visible in the Exchange admin center and in address lists. The maximum length is 256 characters.
The HiddenGroupMembershipEnabled switch specifies whether to hide the members of the distribution group from members of the group and users who aren't members of the group.
The ManagedBy parameter specifies an owner for the group. A group must have at least one owner.
The MemberDepartRestriction parameter specifies the restrictions that you put on requests to leave the group. Valid values are: Open & Closed
The MemberJoinRestriction parameter specifies the restrictions that you put on requests to join the group. Valid values are: Open, Closed & ApprovalRequired
The Members parameter specifies the recipients (mail-enabled objects) that are members of the group. You can use any value that uniquely identifies the recipient.
The ModeratedBy parameter specifies one or more moderators for this group. A moderator approves messages sent to the group before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization. You can use any value that uniquely identifies the moderator.
The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.
The Notes parameters specifies additional information about the object.
The OrganizationalUnit parameter specifies the location in Active Directory where the group is created.
The PrimarySmtpAddress parameter specifies the primary return email address that's used for the recipient.
The RequireSenderAuthenticationEnabled parameter specifies whether to accept messages only from authenticated (internal) senders.
The RoomList switch specifies that all members of this distribution group are room mailboxes. You don't need to specify a value with this switch.
The AcceptMessagesOnlyFrom parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.
The AcceptMessagesOnlyFromDLMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.
The AcceptMessagesOnlyFromSendersOrMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.
This parameter specifies a value for the CustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute6 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute7 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute8 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute9 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute10 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute11 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute12 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute13 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute14 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
This parameter specifies a value for the CustomAttribute15 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.
The EmailAddresses parameter specifies all email addresses (proxy addresses) for the recipient, including the primary SMTP address. In on-premises Exchange organizations, the primary SMTP address and other proxy addresses are typically set by email address policies. However, you can use this parameter to configure other proxy addresses for the recipient.
The GrantSendOnBehalfTo parameter specifies who can send on behalf of this group. Although messages send on behalf of the group clearly show the sender in the From field (
The HiddenFromAddressListsEnabled parameter specifies whether this recipient is visible in address lists.
The SendOofMessageToOriginatorEnabled parameter specifies how to handle out of office (OOF) messages for members of the group.
The SendModerationNotifications parameter specifies when moderation notification messages are sent. Valid values are: Always, Internal, Never.
The Type parameter specifies the type of group that you want to create. Valid values are: Distribution, Security
Specifies if this AddressList should exist.
This resource configures the DomainKeys Identified Mail (DKIM) signing policy settings for domains in a cloud-based organization.
The Identity parameter specifies the DKIM signing policy that you want to modify. This should be the FQDN.
The AdminDisplayName parameter specifies a description for the policy.
The BodyCanonicalization parameter specifies the canonicalization algorithm that's used to create and verify the message body part of the DKIM signature. This value effectively controls the sensitivity of DKIM to changes to the message body in transit. Valid values are 'Simple' or 'Relaxed'. 'Relaxed' is the default.
The HeaderCanonicalization parameter specifies the canonicalization algorithm that's used to create and verify the message header part of the DKIM signature. This value effectively controls the sensitivity of DKIM to changes to the message headers in transit. Valid values are 'Simple' or 'Relaxed'. 'Relaxed' is the default.
The KeySize parameter specifies the size in bits of the public key that's used in the DKIM signing policy. Valid values are 1024 and 2048
The Enabled parameter specifies whether the DKIM Signing Configuration is enabled or disabled. Default is $true.
Specifies if this Client Access Rule should exist.
This resource configures Email address policies in Exchange Online.
The Name parameter specifies the unique name of the email address policy. The maximum length is 64 characters.
The Priority parameter specifies the order that the email address policies are evaluated. By default, every time that you add a new email address policy, the policy is assigned a priority of N+1, where N is the number of email address policies that you've created.
The EnabledEmailAddressTemplates parameter specifies the rules in the email address policy that are used to generate email addresses for recipients.
The EnabledPrimarySMTPAddressTemplate parameter specifies the specifies the rule in the email address policy that's used to generate the primary SMTP email addresses for recipients. You can use this parameter instead of the EnabledEmailAddressTemplates if the policy only applies the primary email address and no additional proxy addresses.
The ManagedByFilter parameter specifies the email address policies to apply to Office 365 groups based on the properties of the users who create the Office 365 groups.
Specify if the Email Address Policy should exist or not.
This resource configures EOP Protection Policy Rules.
The Identity parameter specifies the rule that you want to view. You can use any value that uniquely identifies the rule.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
This parameter define if the rule is enabled or disabled
The Name parameter specifies a unique name for the rule. The maximum length is 64 characters.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
The RecipientDomainIs parameter specifies a condition that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.
The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group.
Present ensures the instance exists, absent ensures it is removed.
This resource will use Set-ExternalInOutlook cmdlet to modify the configuration of external sender identification that's available in Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.
OrganisationIDParameter, not needed for cmdlet Functionality, use 'ExternalinOutlook' to use the same configuration for multiple Tenants
The Enabled parameter enables or disables external sender identification in supported versions of Outlook. Valid values are:$true: External sender identification in Outlook is enabled. An External icon is added in the area of the subject line of messages from external senders. To exempt specific senders or sender domains from this identification, use the AllowList parameter.$false: External sender identification in Outlook is disabled.
The AllowList parameter specifies exceptions to external sender identification in supported versions of Outlook. Messages received from the specified senders or senders in the specified domains don't receive native External sender identification. The allow list uses the 5322.From address (also known as the From address or P2 sender). Valid values are an individual domain (contoso.com), a domain and all subdomains (*.contoso.com) or email addresses ([email protected]).
Present ensures the instance exists, absent ensures it is removed.
This resource configures Global Address Lists in Exchange Online.
The Name parameter specifies the unique name of the GAL. The maximum length is 64 characters.
The ConditionalCompany parameter specifies a precanned filter that's based on the value of the recipient's Company property.
The ConditionalCustomAttribute1 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute1 property.
The ConditionalCustomAttribute10 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute10 property.
The ConditionalCustomAttribute11 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute11 property.
The ConditionalCustomAttribute12 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute12 property.
The ConditionalCustomAttribute13 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute13 property.
The ConditionalCustomAttribute14 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute14 property.
The ConditionalCustomAttribute15 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute15 property.
The ConditionalCustomAttribute2 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute2 property.
The ConditionalCustomAttribute3 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute3 property.
The ConditionalCustomAttribute4 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute4 property.
The ConditionalCustomAttribute5 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute5 property.
The ConditionalCustomAttribute6 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute6 property.
The ConditionalCustomAttribute7 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute7 property.
The ConditionalCustomAttribute8 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute8 property.
The ConditionalCustomAttribute9 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute9 property.
The ConditionalDepartment parameter specifies a precanned filter that's based on the value of the recipient's Department property.
The ConditionalStateOrProvince parameter specifies a precanned filter that's based on the value of the recipient's StateOrProvince property.
The IncludedRecipients parameter specifies a precanned filter that's based on the recipient type.
The RecipientFilter parameter specifies an OPath filter that's based on the value of any available recipient property.
Specify if the Global Address List should exist or not.
This resource configures settings on groups such as the custom attributes and language.
The DisplayName parameter specifies the name of the Microsoft 365 Group. The display name is visible in the Exchange admin center, address lists, and Outlook. The maximum length is 64 characters.
The unique Id of the group
The AcceptMessagesOnlyFromSendersOrMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.
Private
The AlwaysSubscribeMembersToCalendarEvents switch controls the default subscription settings of new members that are added to the Microsoft 365 Group. Changing this setting doesn't affect existing group members.
The AlwaysSubscribeMembersToCalendarEvents switch controls the default subscription settings of new members that are added to the Microsoft 365 Group. Changing this setting doesn't affect existing group members.
The AutoSubscribeNewMembers switch specifies whether to automatically subscribe new members that are added to the Microsoft 365 Group to conversations and calendar events. Only users that are added to the group after you enable this setting are automatically subscribed to the group.
The CalendarMemberReadOnly parameter specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.
The CalendarMemberReadOnly switch specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.
The CalendarMemberReadOnly switch specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.
This parameter specifies a value for the CustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute6 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute7 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute8 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute9 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute10 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute11 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute12 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute13 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute14 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
This parameter specifies a value for the CustomAttribute15 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.
The DataEncryptionPolicy parameter specifies the data encryption policy that's applied to the Microsoft 365 Group.
The EmailAddresses parameter specifies all the email addresses (proxy addresses) for the recipient, including the primary SMTP address.
This parameter specifies a value for the ExtensionCustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.
This parameter specifies a value for the ExtensionCustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.
This parameter specifies a value for the ExtensionCustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.
This parameter specifies a value for the ExtensionCustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.
This parameter specifies a value for the ExtensionCustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.
The GrantSendOnBehalfTo parameter specifies who can send on behalf of this Microsoft 365 Group.
The GrantSendOnBehalfTo parameter specifies who can send on behalf of this Microsoft 365 Group.
The HiddenFromExchangeClientsEnabled switch specifies whether the Microsoft 365 Group is hidden from Outlook clients connected to Microsoft 365.
The InformationBarrierMode parameter specifies the information barrier mode for the Microsoft 365 Group.
This parameter specifies whether or not members are allow to edit content.
The Language parameter specifies language preference for the Microsoft 365 Group.
The MailboxRegion parameter specifies the preferred data location (PDL) for the Microsoft 365 Group in multi-geo environments.
The MailTip parameter specifies the custom MailTip text for this recipient. The MailTip is shown to senders when they start drafting an email message to this recipient.
The MailTipTranslations parameter specifies additional languages for the custom MailTip text that's defined by the MailTip parameter.
The MaxReceiveSize parameter specifies the maximum size of an email message that can be sent to this group. Messages that exceed the maximum size are rejected by the group.
The MaxSendSize parameter specifies the maximum size of an email message that can be sent by this group.
The ModeratedBy parameter specifies one or more moderators for this recipient. A moderator approves messages sent to the recipient before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization. You can use any value that uniquely identifies the moderator.
The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.
The Notes parameter specifies the description of the Microsoft 365 Group. If the value contains spaces, enclose the value in quotation marks.
The PrimarySmtpAddress parameter specifies the primary return email address that's used for the recipient. You can't use the EmailAddresses and PrimarySmtpAddress parameters in the same command.
The RejectMessagesFromSendersOrMembers parameter specifies who isn't allowed to send messages to this recipient. Messages from these senders are rejected.
The RequireSenderAuthenticationEnabled parameter specifies whether to accept messages only from authenticated (internal) senders.
The SensitivityLabelId parameter specifies the GUID value of the sensitivity label that's assigned to the Microsoft 365 Group.
The SubscriptionEnabled switch specifies whether the group owners can enable subscription to conversations and calendar events on the groups they own.
The UnifiedGroupWelcomeMessageEnabled switch specifies whether to enable or disable sending system-generated welcome messages to users who are added as members to the Microsoft 365 Group.
This resource configures the settings of connection filter policies in your cloud-based organization.
The Identity parameter specifies the Hosted Connection Filter Policy that you want to modify.
The AdminDisplayName parameter specifies a description for the policy.
The EnableSafeList parameter enables or disables use of the safe list. The safe list is a dynamic allow list in the Microsoft datacenter that requires no customer configuration. Valid input for this parameter is $true or $false. The default value is $false.
The IPAllowList parameter specifies IP addresses from which messages are always allowed. Messages from the IP addresses you specify won't be identified as spam, despite any other spam characteristics of the messages. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.
The IPBlockList parameter specifies IP addresses from which messages are never allowed. Messages from the IP addresses you specify are blocked without any further spam scanning. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.
The MakeDefault parameter makes the specified policy the default connection filter policy. Default is $false.
Specifies if this Hosted Connection Filter Policy should exist.
This resource configures the settings of connection filter policies in your cloud-based organization.
The Identity parameter specifies the name of the Hosted Content Filter Policy that you want to modify.
The AddXHeaderValue parameter specifies the X-header value to add to spam messages when an action parameter is set to the value AddXHeader.
The AdminDisplayName parameter specifies a description for the policy.
The AllowedSenderDomains parameter specifies trusted domains that aren't processed by the spam filter.
The AllowedSenders parameter specifies a list of trusted senders that aren't processed by the spam filter.
The BlockedSenderDomains parameter specifies domains that are always marked as spam sources.
The BlockedSenders parameter specifies senders that are always marked as spam sources.
The BulkQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as bulk email.
The BulkSpamAction parameter specifies the action to take on messages that are classified as bulk email.
The BulkThreshold parameter specifies the Bulk Complaint Level (BCL) threshold setting. Valid values are from 1 - 9, where 1 marks most bulk email as spam, and 9 allows the most bulk email to be delivered. The default value is 7.
The DownloadLink parameter shows or hides a link in end-user spam notification messages to download the Junk Email Reporting Tool plugin for Outlook. Valid input for this parameter is $true or $false. The default value is $false.
The EnableEndUserSpamNotification parameter enables for disables sending end-user spam quarantine notification messages. Valid input for this parameter is $true or $false. The default value is $false.
The EnableLanguageBlockList parameter enables or disables blocking email messages that are written in specific languages, regardless of the message contents. Valid input for this parameter is $true or $false. The default value is $false.
The EnableRegionBlockList parameter enables or disables blocking email messages that are sent from specific countries or regions, regardless of the message contents. Valid input for this parameter is $true or $false. The default value is $false.
The EndUserSpamNotificationCustomSubject parameter specifies a custom subject for end-user spam notification messages.
The EndUserSpamNotificationFrequency parameter specifies the repeat interval in days that end-user spam notification messages are sent. Valid input for this parameter is an integer between 1 and 15. The default value is 3.
The EndUserSpamNotificationLanguage parameter specifies the language of end-user spam notification messages. The default value is Default. This means the default language of end-user spam notification messages is the default language of the cloud-based organization.
The HighConfidencePhishAction parameter specifies the action to take on messages that are marked as high confidence phishing
The HighConfidencePhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence phishing.
The HighConfidenceSpamAction parameter specifies the action to take on messages that are classified as high confidence spam.
The HighConfidenceSpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence spam.
The IncreaseScoreWithBizOrInfoUrls parameter increases the spam score of messages that contain links to .biz or .info domains. Valid values for this parameter are Off, On or Test. The default value is Off.
The IncreaseScoreWithImageLinks parameter increases the spam score of messages that contain image links to remote websites. Valid values for this parameter are Off, On or Test. The default value is Off.
The IncreaseScoreWithNumericIps parameter increases the spam score of messages that contain links to IP addresses. Valid values for this parameter are Off, On or Test. The default value is Off.
The IncreaseScoreWithRedirectToOtherPort parameter increases the spam score of messages that contain links that redirect to other TCP ports. Valid values for this parameter are Off, On or Test. The default value is Off.
The InlineSafetyTipsEnabled parameter specifies whether to enable or disable safety tips that are shown to recipients in messages. The default is $true
The IntraOrgFilterState parameter specifies whether to enable anti-spam filtering for messages sent between internal users (users in the same organization).
The LanguageBlockList parameter specifies the languages to block when messages are blocked based on their language. Valid input for this parameter is a supported ISO 639-1 lowercase two-letter language code. You can specify multiple values separated by commas. This parameter is only use when the EnableRegionBlockList parameter is set to $true.
The MakeDefault parameter makes the specified content filter policy the default content filter policy. The default value is $false
The MarkAsSpamBulkMail parameter classifies the message as spam when the message is identified as a bulk email message. Valid values for this parameter are Off, On or Test. The default value is On.
The MarkAsSpamEmbedTagsInHtml parameter classifies the message as spam when the message contains HTML
The MarkAsSpamEmptyMessages parameter classifies the message as spam when the message is empty. Valid values for this parameter are Off, On or Test. The default value is Off.
The MarkAsSpamFormTagsInHtml parameter classifies the message as spam when the message contains HTML
The MarkAsSpamFramesInHtml parameter classifies the message as spam when the message contains HTML or
The MarkAsSpamFromAddressAuthFail parameter classifies the message as spam when Sender ID filtering encounters a hard fail. Valid values for this parameter are Off or On. The default value is Off.
The MarkAsSpamJavaScriptInHtml parameter classifies the message as spam when the message contains JavaScript or VBScript. Valid values for this parameter are Off, On or Test. The default value is Off.
The MarkAsSpamNdrBackscatter parameter classifies the message as spam when the message is a non-delivery report (NDR) to a forged sender. Valid values for this parameter are Off or On. The default value is Off.
The MarkAsSpamObjectTagsInHtml parameter classifies the message as spam when the message contains HTML
The MarkAsSpamSensitiveWordList parameter classifies the message as spam when the message contains words from the sensitive words list. Valid values for this parameter are Off, On or Test. The default value is Off.
The MarkAsSpamSpfRecordHardFail parameter classifies the message as spam when Sender Policy Framework (SPF) record checking encounters a hard fail. Valid values for this parameter are Off or On. The default value is Off.
The MarkAsSpamWebBugsInHtml parameter classifies the message as spam when the message contains web bugs. Valid values for this parameter are Off, On or Test. The default value is Off.
The ModifySubjectValue parameter specifies the text to prepend to the existing subject of spam messages when an action parameter is set to the value ModifySubject.
The PhishSpamAction parameter specifies the action to take on messages that are classified as phishing
The PhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as phishing.
The SpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as spam.
The QuarantineRetentionPeriod parameter specifies the length of time in days that spam messages remain in the quarantine. Valid input for this parameter is an integer between 1 and 30. The default value is 15.
The RedirectToRecipients parameter specifies the replacement recipients in spam messages when an action parameter is set to the value Redirect. The action parameters that use the value of RedirectToRecipients are BulkSpamAction, HighConfidencePhishAction, HighConfidenceSpamAction, PhishSpamAction and SpamAction.
The RegionBlockList parameter specifies the region to block when messages are blocked based on their source region. Valid input for this parameter is a supported ISO 3166-1 uppercase two-letter country code. You can specify multiple values separated by commas. This parameter is only used when the EnableRegionBlockList parameter is set to $true.
The SpamAction parameter specifies the action to take on messages that are classified as spam (not high confidence spam, bulk email, or phishing).
The TestModeAction parameter specifies the additional action to take on messages that match any of the IncreaseScoreWith or MarkAsSpam parameters that are set to the value Test.
The TestModeBccToRecipients parameter specifies the blind carbon copy recipients to add to spam messages when the TestModeAction action parameter is set to the value BccMessage.
The PhishZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect phishing messages in delivered messages in Exchange Online mailboxes.
The SpamZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect spam in delivered messages in Exchange Online mailboxes.
Specify if this policy should exist or not.
This resource configures an Hosted Content Filter Rule in Exchange Online. Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-HostedContentFilterRule?view=exchange-ps
The Identity parameter specifies the name of the HostedContentFilter rule that you want to modify.
The HostedContentFilterPolicy parameter specifies the name of the HostedContentFilter policy that's associated with the HostedContentFilter rule.
Specify if this rule should be enabled. Default is $true.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
Specify if this rule should exist or not.
This resource configures the settings of the outbound spam filter policy in your cloud-based organization.
The Identity parameter specifies the name of the policy that you want to modify. There is only one policy named 'Default'
The AdminDisplayName parameter specifies a description for the policy.
The BccSuspiciousOutboundAdditionalRecipients parameter specifies the recipients to add to the Bcc field of outgoing spam messages. Valid input for this parameter is an email address. Separate multiple email addresses with commas.
The BccSuspiciousOutboundMail parameter enables or disables adding recipients to the Bcc field of outgoing spam messages. Valid input for this parameter is $true or $false. The default value is $false. You specify the additional recipients using the BccSuspiciousOutboundAdditionalRecipients parameter.
The NotifyOutboundSpam parameter enables or disables sending notification messages to administrators when an outgoing message is determined to be spam. Valid input for this parameter is $true or $false. The default value is $false. You specify the administrators to notify by using the NotifyOutboundSpamRecipients parameter.
The NotifyOutboundSpamRecipients parameter specifies the administrators to notify when an outgoing message is determined to be spam. Valid input for this parameter is an email address. Separate multiple email addresses with commas.
The RecipientLimitInternalPerHour parameter specifies the maximum number of internal recipients that a user can send to within an hour. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.
The RecipientLimitPerDay parameter specifies the maximum number of recipients that a user can send to within a day. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.
The RecipientLimitExternalPerHour parameter specifies the maximum number of external recipients that a user can send to within an hour. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.
The ActionWhenThresholdReached parameter specifies the action to take when any of the limits specified in the policy are reached. Valid values are: Alert, BlockUser, BlockUserForToday. BlockUserForToday is the default value.
The AutoForwardingMode specifies how the policy controls automatic email forwarding to outbound recipients. Valid values are: Automatic, On, Off.
Specify if this policy should exist or not.
This resource configures an Hosted Content Filter Rule in Exchange Online. Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/new-hostedoutboundspamfilterrule?view=exchange-ps
The Identity parameter specifies the name of the HostedOutboundSpamFilter rule that you want to modify.
The HostedOutboundSpamFilterPolicy parameter specifies the name of the HostedOutboundSpamFilter policy that's associated with the HostedOutboundSpamFilter rule.
Specify if this rule should be enabled. Default is $true.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
The ExceptIfSenderDomainIs parameter specifies an exception that looks for senders with email address in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfFrom parameter specifies an exception that looks for messages from specific senders. You can use any value that uniquely identifies the sender.
The ExceptIfFromMemberOf parameter specifies an exception that looks for messages sent by group members. You can use any value that uniquely identifies the group.
The SenderDomainIs parameter specifies a condition that looks for senders with email address in the specified domains. You can specify multiple domains separated by commas.
The From parameter specifies a condition that looks for messages from specific senders. You can use any value that uniquely identifies the sender.
The FromMemberOf parameter specifies a condition that looks for messages sent by group members. You can use any value that uniquely identifies the group.
Specify if this rule should exist or not.
This resource configures an Inbound connector in your cloud-based organization.
The Identity parameter specifies the outbound connector that you want to modify.
The AssociatedAcceptedDomains parameter specifies the accepted domains that the connector applies to, thereby limiting its scope. For example, you can apply the connector to a specific accepted domain in your organization, such as contoso.com.
The CloudServicesMailEnabled parameter specifies whether the connector is used for hybrid mail flow between an on-premises Exchange environment and Microsoft Office 365. Specifically, this parameter controls how certain internal X-MS-Exchange-Organization-* message headers are handled in messages that are sent between accepted domains in the on-premises and cloud organizations. These headers are collectively known as cross-premises headers. DO NOT USE MANUALLY!
The Comment parameter specifies an optional comment.
The ConnectorSource parameter specifies how the connector is created. DO NOT CHANGE THIS!
The ConnectorType parameter specifies a category for the domains that are serviced by the connector. Valid values are Partner and OnPremises
The EFSkipIPs parameter specifies the source IP addresses to skip in Enhanced Filtering for Connectors when the EFSkipLastIP parameter value is $false.
The EFSkipLastIP parameter specifies the behavior of Enhanced Filtering for Connectors.
The EFUsers parameter specifies the recipients that Enhanced Filtering for Connectors applies to.
Specifies whether connector is enabled.
The RequireTLS parameter specifies that all messages received by this connector require TLS transmission. Valid values for this parameter are $true or $false. The default value is $false. When the RequireTLS parameter is set to $true, all messages received by this connector require TLS transmission.
The RestrictDomainsToCertificate parameter specifies that Office 365 should identify incoming messages that are eligible for this connector by verifying that the remote server authenticates using a TLS certificate that has the TlsSenderCertificateName in the Subject.
The RestrictDomainsToIPAddresses parameter, when set to $true, automatically rejects mail from the domains specified by the SenderDomains parameter if the mail originates from an IP address that isn't specified by the SenderIPAddresses parameter.
The SenderDomains parameter specifies the remote domains from which this connector accepts messages, thereby limiting its scope. You can use a wildcard character to specify all subdomains of a specified domain, as shown in the following example: .contoso.com. However, you can't embed a wildcard character, as shown in the following example: domain..contoso.com.
The SenderIPAddresses parameter specifies the remote IP addresses from which this connector accepts messages.
The TlsSenderCertificateName parameter specifies the certificate used by the sender's domain when the RequireTls parameter is set to $true. Valid input for the TlsSenderCertificateName parameter is an SMTP domain.
The TreatMessagesAsInternal parameter specifies an alternative method to identify messages sent from an on-premises organization as internal messages. You should only consider using this parameter when your on-premises organization doesn't use Exchange.
Specifies if this Outbound connector should exist.
Create a new EXOIntraOrganizationConnector in your cloud-based organization.
The Identity parameter specifies the intraorg connector that you want to modify.
The DiscoveryEndpoint parameter specifies the externally-accessible URL that's used for the Autodiscover service for the domain that's configured in the Intra-Organization connector.
Specifies whether connector is enabled.
The TargetAddressDomains parameter specifies the domain namespaces that will be used in the Intra-organization connector. These domains must have valid Autodiscover endpoints defined in their organizations. The domains and their associated Autodiscover endpoints are used by the Intra-Organization connector for feature and service connectivity. You can specify multiple domains separated by commas.
The TargetSharingEpr parameter specifies the URL of the target Exchange Web Services that will be used in the Intra-Organization connector.
Specifies if this Intra-Organization connector should exist.
Modify the resource Configuration policy in your cloud-based organization.
Only valid value is 'Yes'.
The AutomaticServiceUpdateEnabled parameter specifies whether to allow the automatic addition of new features within Azure Information Protection for your cloud-based organization.
The AzureRMSLicensingEnabled parameter specifies whether the Exchange Online organization can to connect directly to Azure Rights Management.
The DecryptAttachmentForEncryptOnly parameter specifies whether mail recipients have unrestricted rights on the attachment or not for Encrypt-only mails sent using Microsoft Purview Message Encryption.
The EDiscoverySuperUserEnabled parameter specifies whether members of the Discovery Management role group can access IRM-protected messages in a discovery mailbox that were returned by a discovery search.
The EnablePdfEncryption parameter specifies whether to enable the encryption of PDF attachments using Microsoft Purview Message Encryption.
The InternalLicensingEnabled parameter specifies whether to enable IRM features for messages that are sent to internal and external recipients.
The JournalReportDecryptionEnabled parameter specifies whether to enable journal report decryption.
The LicensingLocation parameter specifies the RMS licensing URLs. You can specify multiple URL values separated by commas.
This parameter is available only in the cloud-based service.
The RMSOnlineKeySharingLocation parameter specifies the Azure Rights Management URL that's used to get the trusted publishing domain (TPD) for the Exchange Online organization.
The SearchEnabled parameter specifies whether to enable searching of IRM-encrypted messages in Outlook on the web (formerly known as Outlook Web App).
The SimplifiedClientAccessDoNotForwardDisabled parameter specifies whether to disable Do not forward in Outlook on the web.
The SimplifiedClientAccessEnabled parameter specifies whether to enable the Protect button in Outlook on the web.
The SimplifiedClientAccessEncryptOnlyDisabled parameter specifies whether to disable Encrypt only in Outlook on the web.
The TransportDecryptionSetting parameter specifies the transport decryption configuration.
Specifies if this Outbound connector should exist.
This resource allows to configure Journal Rules in Exchange Online.
Name of the Journal Rule
The JournalEmailAddress parameter specifies a recipient object to which journal reports are sent. You can use any value that uniquely identifies the recipient.
The Recipient parameter specifies the SMTP address of a mailbox, contact, or distribution group to journal. If you specify a distribution group, all recipients in that distribution group are journaled. All messages sent to or from a recipient are journaled.
Specifies whether the Journal Rule is enabled or not.
The Scope parameter specifies the scope of email messages to which the journal rule is applied
Present ensures the rule exists, Absent that it does not.
This resource configures the Auto Reply settings of mailboxes.
The Identity parameter specifies the mailbox that you want to modify. You can use any value that uniquely identifies the mailbox.
User Principal Name of the mailbox owner
The AutoDeclineFutureRequestsWhenOOF parameter specifies whether to automatically decline new meeting requests that are sent to the mailbox during the scheduled time period when Automatic Replies are being sent.
The AutoReplyState parameter specifies whether the mailbox is enabled for Automatic Replies. Valid values are: Enabled, Disabled, Scheduled
The CreateOOFEvent parameter specifies whether to create a calendar event that corresponds to the scheduled time period when Automatic Replies are being sent for the mailbox.
The DeclineAllEventsForScheduledOOF parameter specifies whether to decline all existing calendar events in the mailbox during the scheduled time period when Automatic Replies are being sent.
The DeclineEventsForScheduledOOF parameter specifies whether it's possible to decline existing calendar events in the mailbox during the scheduled time period when Automatic Replies are being sent.
The DeclineMeetingMessage parameter specifies the text in the message when meetings requests that are sent to the mailbox are automatically declined.
The EndTime parameter specifies the end date and time that Automatic Replies are sent for the mailbox. You use this parameter only when the AutoReplyState parameter is set to Scheduled, and the value of this parameter is meaningful only when AutoReplyState is Scheduled.
The EventsToDeleteIDs parameter specifies the calendar events to delete from the mailbox when the DeclineEventsForScheduledOOF parameter is set to $true.
The ExternalAudience parameter specifies whether Automatic Replies are sent to external senders. Valid values are: None, Known, All
The ExternalMessage parameter specifies the Automatic Replies message that's sent to external senders or senders outside the organization. If the value contains spaces, enclose the value in quotation marks.
The InternalMessage parameter specifies the Automatic Replies message that's sent to internal senders or senders within the organization. If the value contains spaces, enclose the value in quotation marks.
The OOFEventSubject parameter specifies the subject for the calendar event that's automatically created when the CreateOOFEvent parameter is set to $true.
The StartTime parameter specifies the start date and time that Automatic Replies are sent for the specified mailbox. You use this parameter only when the AutoReplyState parameter is set to Scheduled, and the value of this parameter is meaningful only when AutoReplyState is Scheduled.
Represents the existence of the instance. This must be set to 'Present'
This resource configures calendar publishing or sharing settings on a mailbox for the visibility of calendar information to external users.
The Identity parameter specifies the calendar folder that you want to modify.
The DetailLevel parameter specifies the level of calendar detail that's published and available to anonymous users.
The PublishDateRangeFrom parameter specifies the start date of calendar information to publish (past information).
The PublishDateRangeTo parameter specifies the end date of calendar information to publish (future information).
The PublishEnabled parameter specifies whether to publish the specified calendar information.
The SearchableUrlEnabled parameter specifies whether the published calendar URL is discoverable on the web.
The SharedCalendarSyncStartDate parameter specifies the limit for past events in the shared calendar that are visible to delegates. A copy of the shared calendar within the specified date range is stored in the delegate's mailbox.
Determines whether or not the instance exist.
Use this resource to modify the permissions of mailbox.
The Identity parameter specifies the mailbox where you want to assign permissions to the user. You can use any value that uniquely identifies the mailbox.
The AccessRights parameter specifies the permission that you want to add for the user on the mailbox. Valid values are: ChangeOwner, ChangePermission, DeleteItem, ExternalAccount, FullAccess and ReadPermission.
The User parameter specifies who gets the permissions on the mailbox.
The InheritanceType parameter specifies how permissions are inherited by folders in the mailbox. Valid values are: None, All, Children, Descendents, SelfAndChildren.
The Owner parameter specifies the owner of the mailbox object.
The Deny switch specifies that the permissions you're adding are Deny permissions.
Determines whether or not the permission should exist on the mailbox.
Use this resource to modify the settings of mailbox plans in the cloud-based service.
The Identity parameter specifies the Mailbox Plan that you want to modify.
The display name of the mailbox plan.
MailboxPlans cannot be created/removed in O365. This must be set to 'Present'
The IssueWarningQuota parameter specifies the warning threshold for the size of the mailboxes that are created or enabled using the mailbox plan.
The MaxReceiveSize parameter specifies the maximum size of a message that can be sent to the mailbox.
The MaxSendSize parameter specifies the maximum size of a message that can be sent by the mailbox.
The ProhibitSendQuota parameter specifies a size limit for the mailbox.
The ProhibitSendReceiveQuota parameter specifies a size limit for the mailbox.
The RetainDeletedItemsFor parameter specifies the length of time to keep soft-deleted items for the mailbox.
The RetentionPolicy parameter specifies the retention policy that's applied to the mailbox.
The RoleAssignmentPolicy parameter specifies the role assignment policy that's applied to the mailbox.
This resource configures settings on Mailboxes such as the Regional settings and its timezone.
The display name of the Shared Mailbox
The name of the Time Zone to assign to the mailbox
The code of the Locale to assign to the mailbox
Present ensures the Mailbox Settings are applied
This resource configures Exchange Online address lists.
The Name parameter specifies a unique name for the mail contact.
The ExternalEmailAddress parameter specifies the target email address of the mail contact or mail user. By default, this value is used as the primary email address of the mail contact or mail user.
The Alias parameter specifies the Exchange alias (also known as the mail nickname) for the recipient. This value identifies the recipient as a mail-enabled object, and shouldn't be confused with multiple email addresses for the same recipient (also known as proxy addresses). A recipient can have only one Alias value. The maximum length is 64 characters.
The DisplayName parameter specifies the display name of the mail contact. The display name is visible in the Exchange admin center and in address lists.
The FirstName parameter specifies the user's first name.
The Initials parameter specifies the user's middle initials.
The LastName parameter specifies the user's last name.
The MacAttachmentFormat parameter specifies the Apple Macintosh operating system attachment format to use for messages sent to the mail contact or mail user. Valid values are: BinHex, UuEncode, AppleSingle, AppleDouble
The MessageBodyFormat parameter specifies the message body format for messages sent to the mail contact or mail user. Valid values are: Text, Html, TextAndHtml
The MessageFormat parameter specifies the message format for messages sent to the mail contact or mail user. Valid values are: Mime, Text
The ModeratedBy parameter specifies one or more moderators for this mail contact. A moderator approves messages sent to the mail contact before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization.
The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.
The OrganizationalUnit parameter specifies the location in Active Directory where the new contact is created.
The SendModerationNotifications parameter specifies when moderation notification messages are sent. Valid values are: ALways, Internal, Never
The UsePreferMessageFormat specifies whether the message format settings configured for the mail user or mail contact override the global settings configured for the remote domain or configured by the message sender
The CustomAttribute1 parameter specifies the value of the CustomAttribute1
The CustomAttribute2 parameter specifies the value of the CustomAttribute2
The CustomAttribute3 parameter specifies the value of the CustomAttribute3
The CustomAttribute4 parameter specifies the value of the CustomAttribute4
The CustomAttribute5 parameter specifies the value of the CustomAttribute5
The CustomAttribute6 parameter specifies the value of the CustomAttribute6
The CustomAttribute7 parameter specifies the value of the CustomAttribute7
The CustomAttribute8 parameter specifies the value of the CustomAttribute8
The CustomAttribute9 parameter specifies the value of the CustomAttribute9
The CustomAttribute10 parameter specifies the value of the CustomAttribute10
The CustomAttribute11 parameter specifies the value of the CustomAttribute11
The CustomAttribute12 parameter specifies the value of the CustomAttribute12
The CustomAttribute13 parameter specifies the value of the CustomAttribute13
The CustomAttribute14 parameter specifies the value of the CustomAttribute14
The CustomAttribute15 parameter specifies the value of the CustomAttribute15
The ExtensionCustomAttribute1 parameter specifies the value of the ExtensionCustomAttribute1
The ExtensionCustomAttribute2 parameter specifies the value of the ExtensionCustomAttribute2
The ExtensionCustomAttribute3 parameter specifies the value of the ExtensionCustomAttribute3
The ExtensionCustomAttribute4 parameter specifies the value of the ExtensionCustomAttribute4
The ExtensionCustomAttribute5 parameter specifies the value of the ExtensionCustomAttribute5
Specifies if this Contact should exist.
This resource allows to configure Mailtips behaviors in Exchange Online.
Only valid value is 'Yes'.
Specifies whether MailTips are enabled.
Specifies whether MailTips that rely on group metrics data are enabled.
Specifies what a large audience is.
Specifies whether MailTips that rely on mailbox data (out-of-office or full mailbox) are enabled.
Specifies whether MailTips for external recipients are enabled.
Specifies if this MailTip should exist.
Create or modify a EXOMalwareFilterPolicy in your cloud-based organization.
The Identity parameter specifies the MalwareFilterPolicy you want to modify.
The AdminDisplayName parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks.
The CustomExternalBody parameter specifies the body of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks.
The CustomExternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks.
The CustomFromAddress parameter specifies the From address of the custom notification message for malware detections in messages from internal or external senders.
The CustomFromName parameter specifies the From name of the custom notification message for malware detections in messages from internal or external senders. If the value contains spaces, enclose the value in quotation marks.
The CustomInternalBody parameter specifies the body of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks.
The CustomInternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks.
The CustomNotifications parameter enables or disables custom notification messages for malware detections in messages from internal or external senders. Valid values are: $true, $false.
The EnableExternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from external senders. Valid values are: $true, $false.
The EnableFileFilter parameter enables or disables common attachment blocking - also known as the Common Attachment Types Filter.Valid values are: $true, $false.
The EnableInternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from internal senders. Valid values are: $true, $false.
The ExternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notification messages for malware detections in messages from external senders.
The FileTypeAction parameter specifies what's done to messages that contain one or more attachments where the file extension is included in the FileTypes parameter (common attachment blocking). Valid values are Quarantine and Reject. The default value is Reject.
The FileTypes parameter specifies the file types that are automatically blocked by common attachment blocking (also known as the Common Attachment Types Filter), regardless of content.
The InternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notification messages for malware detections in messages from internal senders.
MakeDefault makes this malware filter policy the default policy. Valid values are: $true, $false.
The QuarantineTag specifies the quarantine policy that's used on messages that are quarantined as malware.
The ZapEnabled parameter enables or disables zero-hour auto purge (ZAP) for malware. ZAP detects malware in unread messages that have already been delivered to the user's Inbox. Valid values are: $true, $false.
Specifies if this MalwareFilterPolicy should exist.
Create or modify a new EXOMalwareFilterRule in your cloud-based organization.
The Identity parameter specifies the EXO resource you want to modify.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
The Enabled parameter enables or disables the malware filter rule. Valid input for this parameter is $true or $false. The default value is $true.
The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
The MalwareFilterPolicy parameter specifies the malware filter policy to apply to messages that match the conditions defined by this malware filter rule.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group.
Specifies if the Malware Filter Rule should exist.
This resource configures RBAC Management Roles in Exchange Online.
The Name parameter specifies the name of the role. The maximum length of the name is 64 characters.
The Parent parameter specifies the identity of the role to copy. Mandatory for management role creation/update or when Ensure=Present. Non-mandatory for Ensure=Absent
The Description parameter specifies the description that's displayed when the management role is viewed using the Get-ManagementRole cmdlet.
Specify if the Management Role should exist or not.
This resource configures RBAC Management Roles Assignments in Exchange Online.
The Name parameter specifies a name for the new management role assignment. The maximum length of the name is 64 characters.
The Role parameter specifies the existing role to assign. You can use any value that uniquely identifies the role.
The App parameter specifies the service principal to assign the management role to. Specifically, the ServiceId GUID value from the output of the Get-ServicePrincipal cmdlet (for example, 6233fba6-0198-4277-892f-9275bf728bcc).
The Policy parameter specifies the name of the management role assignment policy to assign the management role to.
The SecurityGroup parameter specifies the name of the management role group or mail-enabled universal security group to assign the management role to.
The User parameter specifies the name or alias of the user to assign the management role to.
The CustomRecipientWriteScope parameter specifies the existing recipient-based management scope to associate with this management role assignment.
The CustomResourceScope parameter specifies the custom management scope to associate with this management role assignment. You can use any value that uniquely identifies the management scope.
The ExclusiveConfigWriteScope parameter specifies the exclusive configuration-based management scope to associate with the new role assignment.
The RecipientAdministrativeUnitScope parameter specifies the administrative unit to scope the new role assignment to.
The RecipientOrganizationalUnitScope parameter specifies the OU to scope the new role assignment to. If you use the RecipientOrganizationalUnitScope parameter, you can't use the CustomRecipientWriteScope or ExclusiveRecipientWriteScope parameters.
The RecipientRelativeWriteScope parameter specifies the type of restriction to apply to a recipient scope. The available types are None, Organization, MyGAL, Self, and MyDistributionGroups. The RecipientRelativeWriteScope parameter is automatically set when the CustomRecipientWriteScope or RecipientOrganizationalUnitScope parameters are used.
Specify if the Management Role Assignment should exist or not.
This resource configures RBAC Management Roles Entries in Exchange Online.
The Identity parameter specifies the role entry that you want to modify.
The Parameters parameter specifies the parameters to be added to or removed from the role entry.
The Type parameter specifies the type of role entry to return.
Create a new Message Classification policy in your cloud-based organization.
The Identity parameter specifies the OME Configuration policy that you want to modify.
The ClassificationID parameter specifies the classification ID (GUID) of an existing message classification that you want to import and use in your Exchange organization.
The DisplayName parameter specifies the title of the message classification that's displayed in Outlook and selected by users.
The DisplayPrecedence parameter specifies the relative precedence of the message classification to other message classifications that may be applied to a specified message.
The Name parameter specifies the unique name for the message classification.
The PermissionMenuVisible parameter specifies whether the values that you entered for the DisplayName and RecipientDescription parameters are displayed in Outlook as the user composes a message.
The RecipientDescription parameter specifies the detailed text that's shown to Outlook recipient when they receive a message that has the message classification applied.
The RetainClassificationEnabled parameter specifies whether the message classification should persist with the message if the message is forwarded or replied to.
The SenderDescription parameter specifies the detailed text that's shown to Outlook senders when they select a message classification to apply to a message before they send the message.
Specifies if this Outbound connector should exist.
This resource configures Mobile Device Mailbox Policies in Exchange Online.
The Name parameter specifies the friendly name of the mobile device mailbox policy.
The AllowApplePushNotifications parameter specifies whether push notifications are allowed to Apple mobile devices.
The AllowBluetooth parameter specifies whether the Bluetooth capabilities are allowed on the mobile phone. The available options are Disable, HandsfreeOnly, and Allow. The default value is Allow.
The AllowBrowser parameter indicates whether Microsoft Pocket Internet Explorer is allowed on the mobile phone. This parameter doesn't affect third-party browsers.
The AllowCamera parameter specifies whether the mobile phone's camera is allowed.
The AllowConsumerEmail parameter specifies whether the mobile phone user can configure a personal email account on the mobile phone.
The AllowDesktopSync parameter specifies whether the mobile phone can synchronize with a desktop computer through a cable.
The AllowExternalDeviceManagement parameter specifies whether an external device management program is allowed to manage the mobile phone.
The AllowGooglePushNotifications parameter controls whether the user can receive push notifications from Google for Outlook on the web for devices.
The AllowHTMLEmail parameter specifies whether HTML email is enabled on the mobile phone.
The AllowInternetSharing parameter specifies whether the mobile phone can be used as a modem to connect a computer to the Internet.
The AllowIrDA parameter specifies whether infrared connections are allowed to the mobile phone.
The AllowMobileOTAUpdate parameter specifies whether the Exchange ActiveSync mailbox policy can be sent to the mobile phone over a cellular data connection.
The AllowMicrosoftPushNotifications parameter specifies whether push notifications are enabled on the mobile device.
The AllowNonProvisionableDevices parameter specifies whether all mobile phones can synchronize with the server running Exchange.
The AllowPOPIMAPEmail parameter specifies whether the user can configure a POP3 or IMAP4 email account on the mobile phone.
The AllowRemoteDesktop parameter specifies whether the mobile phone can initiate a remote desktop connection.
The AllowSimplePassword parameter specifies whether a simple device password is allowed. A simple device password is a password that has a specific pattern, such as 1111 or 1234.
The AllowSMIMEEncryptionAlgorithmNegotiation parameter specifies whether the messaging application on the mobile device can negotiate the encryption algorithm if a recipient's certificate doesn't support the specified encryption algorithm.
The AllowSMIMESoftCerts parameter specifies whether S/MIME software certificates are allowed.
The AllowStorageCard parameter specifies whether the mobile phone can access information stored on a storage card.
The AllowTextMessaging parameter specifies whether text messaging is allowed from the mobile phone.
The AllowUnsignedApplications parameter specifies whether unsigned applications can be installed on the mobile phone.
The AllowUnsignedInstallationPackages parameter specifies whether unsigned installation packages can be executed on the mobile phone.
The AllowWiFi parameter specifies whether wireless Internet access is allowed on the mobile phone.
The AlphanumericPasswordRequired parameter specifies whether the password for the mobile phone must be alphanumeric.
The ApprovedApplicationList parameter specifies a list of approved applications for the mobile phone.
The AttachmentsEnabled parameter specifies whether attachments can be downloaded.
The DeviceEncryptionEnabled parameter specifies whether encryption is enabled.
The DevicePolicyRefreshInterval parameter specifies how often the policy is sent from the server to the mobile phone.
The IrmEnabled parameter specifies whether Information Rights Management (IRM) is enabled for the mailbox policy.
The IsDefault parameter specifies whether this policy is the default Mobile Device mailbox policy.
The MaxAttachmentSize parameter specifies the maximum size of attachments that can be downloaded to the mobile phone.
The MaxCalendarAgeFilter parameter specifies the maximum range of calendar days that can be synchronized to the device.
The MaxEmailAgeFilter parameter specifies the maximum number of days of email items to synchronize to the mobile phone.
The MaxEmailBodyTruncationSize parameter specifies the maximum size at which email messages are truncated when synchronized to the mobile phone. The value is specified in kilobytes (KB).
The MaxEmailHTMLBodyTruncationSize parameter specifies the maximum size at which HTML-formatted email messages are synchronized to the mobile phone. The value is specified in KB.
The MaxInactivityTimeDeviceLock parameter specifies the length of time that the mobile phone can be inactive before the password is required to reactivate it.
The MaxPasswordFailedAttempts parameter specifies the number of attempts a user can make to enter the correct password for the mobile phone. You can enter any number from 4 through 16 or the value Unlimited.
The MinPasswordComplexCharacters parameter specifies the character sets that are required in the password of the mobile device.
The MinPasswordLength parameter specifies the minimum number of characters in the mobile device password.
The PasswordEnabled parameter specifies whether a password is required on the mobile device.
The PasswordExpiration parameter specifies how long a password can be used on a mobile device before the user is forced to change the password.
The PasswordHistory parameter specifies the number of unique new passwords that need to be created on the mobile device before an old password can be reused.
The PasswordRecoveryEnabled parameter specifies whether the recovery password for the mobile device is stored in Exchange.
The RequireDeviceEncryption parameter specifies whether encryption is required on the mobile device.
The RequireEncryptedSMIMEMessages parameter specifies whether the mobile device must send encrypted S/MIME messages.
The RequireEncryptionSMIMEAlgorithm parameter specifies the algorithm that's required to encrypt S/MIME messages on a mobile device.
The RequireSignedSMIMEAlgorithm parameter specifies the algorithm that's used to sign S/MIME messages on the mobile device.
The RequireSignedSMIMEAlgorithm parameter specifies the algorithm that's used to sign S/MIME messages on the mobile device.
The RequireSignedSMIMEMessages parameter specifies whether the mobile device must send signed S/MIME messages.
The RequireStorageCardEncryption parameter specifies whether storage card encryption is required on the mobile device.
The UnapprovedInROMApplicationList parameter specifies a list of applications that can't be run in ROM on the mobile device.
The UNCAccessEnabled parameter specifies whether access to Microsoft Windows file shares is enabled from the mobile device.
The WSSAccessEnabled parameter specifies whether access to Microsoft Windows SharePoint Services is enabled from the mobile device.
Specify if the Mobile Device Mailbox Policy should exist or not.
This resource configures Offline Address Books in Exchange Online.
The Name parameter specifies the unique name of the Offline Address Book. The maximum length is 64 characters.
The AddressLists parameter specifies the address lists or global address lists that are included in the OAB. You can use any value that uniquely identifies the address list.
The ConfiguredAttributes parameter specifies the recipient MAPI properties that are available in the OAB.
The DiffRetentionPeriod parameter specifies the number of days that the OAB difference files are stored on the server.
The IsDefault parameter specifies whether the OAB is used by all mailboxes and mailbox databases that don't have an OAB specified.
Specify if the Offline Address Book should exist or not.
Create a new OME Configuration policy in your cloud-based organization.
The Identity parameter specifies the OME Configuration policy that you want to modify.
The BackgroundColor parameter specifies the background color
The DisclaimerText parameter specifies the disclaimer text in the email that contains the encrypted message
The EmailText parameter specifies the default text that accompanies encrypted email messages.
The ExternalMailExpiryInDays parameter specifies the number of days that the encrypted message is available to external recipients in the Microsoft 365 portal. A valid value is an integer from 0 to 730.
The IntroductionText parameter specifies the default text that accompanies encrypted email messages.
The OTPEnabled parameter specifies whether to allow recipients to use a one-time passcode to view encrypted messages.
The PortalText parameter specifies the text that appears at the top of the encrypted email viewing portal.
The PrivacyStatementUrl parameter specifies the Privacy Statement link in the encrypted email notification message.
The ReadButtonText parameter specifies the text that appears on the 'Read the message' button.
The SocialIdSignIn parameter specifies whether a user is allowed to view an encrypted message in the Microsoft 365 admin center using their own social network id (Google, Yahoo, and Microsoft account).
Specifies if this Outbound connector should exist.
This resource configures On-Premises Organization in Exchange Online.
The Identity parameter specifies the identity of the on-premises organization object.
The HybridDomains parameter specifies the domains that are configured in the hybrid deployment between an Office 365 tenant and an on-premises Exchange organization. The domains specified in this parameter must match the domains listed in the HybridConfiguration Active Directory object for the on-premises Exchange organization configured by the Hybrid Configuration wizard.
The InboundConnector parameter specifies the name of the inbound connector configured on the Microsoft Exchange Online Protection (EOP) service for a hybrid deployment configured with an on-premises Exchange organization.
The OutboundConnector parameter specifies the name of the outbound connector configured on the EOP service for a hybrid deployment configured with an on-premises Exchange organization.
The OrganizationName parameter specifies the Active Directory object name of the on-premises Exchange organization.
The OrganizationGuid parameter specifies the globally unique identifier (GUID) of the on-premises Exchange organization object in the Office 365 tenant.
The OrganizationRelationship parameter specifies the organization relationship configured by the Hybrid Configuration wizard on the Office 365 tenant as part of a hybrid deployment with an on-premises Exchange organization. This organization relationship defines the federated sharing features enabled on the Office 365 tenant.
The Comment parameter specifies an optional comment.
Specify if the On-Premises Organization should exist or not.
This resource configures the Exchange Online organization-wide settings.
Only valid value is 'Yes'.
The ActivityBasedAuthenticationTimeoutEnabled parameter specifies whether the timed logoff feature is enabled. The default value is $true
The ActivityBasedAuthenticationTimeoutInterval parameter specifies the time span for logoff. You enter this value as a time span: hh:mm:ss where hh = hours, mm = minutes and ss = seconds. Valid values for this parameter are from 00:05:00 to 08:00:00 (5 minutes to 8 hours). The default value is 06:00:00 (6 hours).
The ActivityBasedAuthenticationTimeoutWithSingleSignOnEnabled parameter specifies whether to keep single sign-on enabled. The default value is $true.
The AppsForOfficeEnabled parameter specifies whether to enable apps for Outlook features. By default, the parameter is set to $true. If the flag is set to $false, no new apps can be activated for any user in the organization.
The AsyncSendEnabled parameter specifies whether to enable or disable async send in Outlook on the web.
The AuditDisabled parameter specifies whether to disable or enable mailbox auditing for the organization.
Setting this parameter to $true will cause unknown users to be redirected to the on-premises endpoint and will allow on-premises users to discover their mailbox automatically.
The AutoExpandingArchive switch enables the unlimited archiving feature (called auto-expanding archiving) in an Exchange Online organization. You don't need to specify a value with this switch.
No description available for BlockMoveMessagesForGroupFolders
The BookingsAddressEntryRestricted parameter specifies whether addresses can be collected from Bookings customers.
The BookingsAuthEnabled parameter specifies whether to enforce authentication to access all published Bookings pages.
No description available for BookingsBlockedWordsEnabled
The BookingsCreationOfCustomQuestionsRestricted parameter specifies whether Bookings admins can add custom questions.
The BookingsEnabled parameter specifies whether to enable Microsoft Bookings in an organization.
The BookingsExposureOfStaffDetailsRestricted parameter specifies whether the attributes of internal Bookings staff members are visible to external Bookings customers.
The BookingsMembershipApprovalRequired parameter enables a membership approval requirement when new staff members are added to Bookings calendars.
No description available for BookingsNamingPolicyEnabled
No description available for BookingsNamingPolicyPrefix
No description available for BookingsNamingPolicyPrefixEnabled
No description available for BookingsNamingPolicySuffix
No description available for BookingsNamingPolicySuffixEnabled
The BookingsNotesEntryRestricted parameter specifies whether appointment notes can be collected from Bookings customers.
The BookingsPaymentsEnabled parameter specifies whether to enable online payment node inside Bookings.
The BookingsPhoneNumberEntryRestricted parameter specifies whether phone numbers can be collected from Bookings customers.
No description available for BookingsSearchEngineIndexDisabled
No description available for BookingsSmsMicrosoftEnabled
The BookingsSocialSharingRestricted parameter allows you to control whether, or not, your users can see social sharing options inside Bookings.
The ByteEncoderTypeFor7BitCharsets parameter specifies the 7-bit transfer encoding method for MIME format for messages sent to this remote domain.
No description available for ComplianceMLBgdCrawlEnabled
The ConnectorsActionableMessagesEnabled parameter specifies whether to enable or disable actionable buttons in messages (connector cards) from connected apps on Outlook on the web.
The ConnectorsEnabled parameter specifies whether to enable or disable all connected apps in organization.
The ConnectorsEnabledForOutlook parameter specifies whether to enable or disable connected apps in Outlook on the web.
The ConnectorsEnabledForSharepoint parameter specifies whether to enable or disable connected apps on Sharepoint.
The ConnectorsEnabledForTeams parameter specifies whether to enable or disable connected apps on Teams.
The ConnectorsEnabledForYammer parameter specifies whether to enable or disable connected apps on Yammer.
Enable Customer Lockbox.
The DefaultAuthenticationPolicy parameter specifies the authentication policy that's used for the whole organization. You can use any value that uniquely identifies the policy.
The DefaultGroupAccessType parameter specifies the default access type for Office 365 groups.
The DefaultMinutesToReduceLongEventsBy parameter specifies the number of minutes to reduce calendar events by if the events are 60 minutes or longer.
The DefaultMinutesToReduceShortEventsBy parameter specifies the number of minutes to reduce calendar events by if the events are less than 60 minutes long.
The DefaultPublicFolderAgeLimit parameter specifies the default age limit for the contents of public folders across the entire organization. Content in a public folder is automatically deleted when this age limit is exceeded. This attribute applies to all public folders in the organization that don't have their own AgeLimit setting. To specify a value, enter it as a time span: dd.hh:mm:ss where d = days, h = hours, m = minutes, and s = seconds. Or, enter the value $null. The default value is blank ($null).
The DefaultPublicFolderDeletedItemRetention parameter specifies the default value of the length of time to retain deleted items for public folders across the entire organization. This attribute applies to all public folders in the organization that don't have their own RetainDeletedItemsFor attribute set.
The DefaultPublicFolderIssueWarningQuota parameter specifies the default value across the entire organization for the public folder size at which a warning message is sent to this folder's owners, warning that the public folder is almost full. This attribute applies to all public folders within the organization that don't have their own warning quota attribute set. The default value of this attribute is unlimited. The valid input range for this parameter is from 0 through 2199023254529 bytes(2 TB). If you enter a value of unlimited, no size limit is imposed on the public folder.
The DefaultPublicFolderMaxItemSize parameter specifies the default maximum size for posted items within public folders across the entire organization. Items larger than the value of the DefaultPublicFolderMaxItemSize parameter are rejected. This attribute applies to all public folders within the organization that don't have their own MaxItemSize attribute set. The default value of this attribute is unlimited.
The DefaultPublicFolderMovedItemRetention parameter specifies how long items that have been moved between mailboxes are kept in the source mailbox for recovery purposes before being removed by the Public Folder Assistant.
The DefaultPublicFolderProhibitPostQuota parameter specifies the size of a public folder at which users are notified that the public folder is full. Users can't post to a folder whose size is larger than the DefaultPublicFolderProhibitPostQuota parameter value. The default value of this attribute is unlimited.
The DirectReportsGroupAutoCreationEnabled parameter specifies whether to enable or disable the automatic creation of direct report Office 365 groups.
The DisablePlusAddressInRecipients parameter specifies whether to enable or disable plus addressing (also known as subaddressing) for Exchange Online mailboxes.
The DistributionGroupDefaultOU parameter specifies the container where distribution groups are created by default.
The DistributionGroupNameBlockedWordsList parameter specifies words that can't be included in the names of distribution groups. Separate multiple values with commas.
The DistributionGroupNamingPolicy parameter specifies the template applied to the name of distribution groups that are created in the organization. You can enforce that a prefix or suffix be applied to all distribution groups. Prefixes and suffixes can be either a string or an attribute, and you can combine strings and attributes.
The ElcProcessingDisabled parameter specifies whether to enable or disable the processing of mailboxes by the Managed Folder Assistant.
The EnableOutlookEvents parameter specifies whether Outlook or Outlook on the web automatically discovers events from email messages and adds them to user calendars.
The EndUserDLUpgradeFlowsDisabled parameter specifies whether to prevent users from upgrading their own distribution groups to Office 365 groups in an Exchange Online organization.
The EwsAllowEntourage parameter specifies whether to enable or disable Entourage 2008 to access Exchange Web Services (EWS) for the entire organization.
The EwsAllowList parameter specifies the applications that are allowed to access EWS or REST when the EwsApplicationAccessPolicy parameter is set to EwsAllowList. Other applications that aren't specified by this parameter aren't allowed to access EWS or REST. You identify the application by its user agent string value. Wildcard characters (*) are supported.
The EwsAllowMacOutlook parameter enables or disables access to mailboxes by Outlook for Mac clients that use Exchange Web Services (for example, Outlook for Mac 2011 or later).
The EwsAllowOutlook parameter enables or disables access to mailboxes by Outlook clients that use Exchange Web Services. Outlook uses Exchange Web Services for free/busy, out-of-office settings, and calendar sharing.
The EwsApplicationAccessPolicy parameter specifies the client applications that have access to EWS and REST.
The EwsBlockList parameter specifies the applications that aren't allowed to access EWS or REST when the EwsApplicationAccessPolicy parameter is set to EnforceBlockList. All other applications that aren't specified by this parameter are allowed to access EWS or REST. You identify the application by its user agent string value. Wildcard characters (*) are supported.
The EwsEnabled parameter specifies whether to globally enable or disable EWS access for the entire organization, regardless of what application is making the request.
The ExchangeNotificationEnabled parameter enables or disables Exchange notifications sent to administrators regarding their organizations. Valid input for this parameter is $true or $false.
The ExchangeNotificationRecipients parameter specifies the recipients for Exchange notifications sent to administrators regarding their organizations. If the ExchangeNotificationEnabled parameter is set to $false, no notification messages are sent. Be sure to enclose values that contain spaces in quotation marks and separate multiple values with commas. If this parameter isn't set, Exchange notifications are sent to all administrators.
The FindTimeAttendeeAuthenticationEnabled parameter controls whether attendees are required to verify their identity in meeting polls using the FindTime Outlook add-in.
The FindTimeAutoScheduleDisabled parameter controls automatically scheduling the meeting once a consensus is reached in meeting polls using the FindTime Outlook add-in.
The FindTimeLockPollForAttendeesEnabled controls whether the Lock poll for attendees setting is managed by the organization.
The FindTimeOnlineMeetingOptionDisabled parameter controls the availability of the Online meeting checkbox for Teams in meeting polls using the FindTime Outlook add-in.
The FocusedInboxOn parameter enables or disables Focused Inbox for the organization.
The HierarchicalAddressBookRoot parameter specifies the user, contact, or group to be used as the root organization for a hierarchical address book in the Exchange organization. You can use any value that uniquely identifies the recipient.
The IPListBlocked parameter specifies the blocked IP addresses that aren't allowed to connect to Exchange Online organization. These settings affect client connections that use Basic authentication where on-premises Active Directory Federation Services (ADFS) servers federate authentication with Azure Active Directory. Note that the new settings might take up to 4 hours to fully propagate across the service.
No description available for IsGroupFoldersAndRulesEnabled
No description available for IsGroupMemberAllowedToEditContent
The LeanPopoutEnabled parameter specifies whether to enable faster loading of pop-out messages in Outlook on the web for Internet Explorer and Microsoft Edge.
The LinkPreviewEnabled parameter specifies whether link preview of URLs in email messages is allowed for the organization.
The MailTipsAllTipsEnabled parameter specifies whether MailTips are enabled. The default value is $true.
The MailTipsExternalRecipientsTipsEnabled parameter specifies whether MailTips for external recipients are enabled. The default value is $false.
The MailTipsGroupMetricsEnabled parameter specifies whether MailTips that rely on group metrics data are enabled. The default value is $true.
The MailTipsLargeAudienceThreshold parameter specifies what a large audience is. The default value is 25.
The MailTipsMailboxSourcedTipsEnabled parameter specifies whether MailTips that rely on mailbox data (out-of-office or full mailbox) are enabled.
No description available for MaskClientIpInReceivedHeadersEnabled.
No description available for MatchSenderOrganizerProperties.
No description available for MessageHighlightsEnabled.
The MessageRecallEnabled parameter enables or disables the message recall feature in the organization.
The MessageRemindersEnabled parameter enables or disables the message reminders feature in the organization.
The MobileAppEducationEnabled specifies whether to show or hide the Outlook for iOS and Android education reminder in Outlook on the web.
The OAuth2ClientProfileEnabled parameter enables or disables modern authentication in the Exchange organization.
The OnlineMeetingsByDefaultEnabled parameter specifies whether to set all meetings as Teams by default during meeting creation.
The OutlookGifPickerDisabled parameter disables the GIF Search (powered by Bing) feature that's built into the Compose page in Outlook on the web.
The OutlookMobileGCCRestrictionsEnabled parameter specifies whether to enable or disable features within Outlook for iOS and Android that are not FedRAMP compliant for Office 365 US Government Community Cloud (GCC) customers.
The OutlookPayEnabled parameter enables or disables Payments in Outlook in the Office 365 organization.
No description available for OutlookTextPredictionDisabled.
The PublicComputersDetectionEnabled parameter specifies whether Outlook on the web will detect when a user signs from a public or private computer or network, and then enforces the attachment handling settings from public networks. The default is $false. However, if you set this parameter to $true, Outlook on the web will determine if the user is signing in from a public computer, and all public attachment handling rules will be applied and enforced.
The PublicFoldersEnabled parameter specifies how public folders are deployed in your organization.
The PublicFolderShowClientControl parameter enables or disables access to public folders in Microsoft Outlook.
The ReadTrackingEnabled parameter specifies whether the tracking for read status for messages in an organization is enabled. The default value is $false.
No description available for RecallReadMessagesEnabled.
The RemotePublicFolderMailboxes parameter specifies the identities of the public folder objects (represented as mail user objects locally) corresponding to the public folder mailboxes created in the remote forest. The public folder values set here are used only if the public folder deployment is a remote deployment.
The SendFromAliasEnabled parameter allows mailbox users to send messages using aliases (proxy addresses). It does this by disabling the rewriting of aliases to their primary SMTP address. This change is implemented in the Exchange Online service
No description available for SharedDomainEmailAddressFlowEnabled.
The ShortenEventScopeDefault parameter specifies whether calendar events start late or end early in the organization.
The SiteMailboxCreationURL parameter specifies the URL that's used to create site mailboxes. Site mailboxes improve collaboration and user productivity by allowing access to both SharePoint documents and Exchange email in Outlook 2013 or later.
The SmtpActionableMessagesEnabled parameter specifies whether to enable or disable action buttons in email messages in Outlook on the web.
The VisibleMeetingUpdateProperties parameter specifies whether meeting message updates will be auto-processed on behalf of attendees. Auto-processed updates are applied to the attendee's calendar item, and then the meeting message is moved to the deleted items. The attendee never sees the update in their inbox, but their calendar is updated.
The WebPushNotificationsDisabled parameter specifies whether to enable or disable Web Push Notifications in Outlook on the Web. This feature provides web push notifications which appear on a user's desktop while the user is not using Outlook on the Web. This brings awareness of incoming messages while they are working elsewhere on their computer.
The WebSuggestedRepliesDisabled parameter specifies whether to enable or disable Suggested Replies in Outlook on the web. This feature provides suggested replies to emails so users can easily and quickly respond to messages.
The WorkspaceTenantEnabled parameter enables or disables workspace booking in the organization.
This resource configures the Organization Relationship in Exchange Online.
The Name parameter specifies the unique name of the organization relationship. The maximum length is 64 characters.
The ArchiveAccessEnabled parameter specifies whether the organization relationship has been configured to provide remote archive access.
The DeliveryReportEnabled parameter specifies whether Delivery Reports should be shared over the organization relationship.
The DomainNames parameter specifies the SMTP domains of the external organization. You can specify multiple domains separated by commas.
The Enabled parameter specifies whether to enable the organization relationship.
The FreeBusyAccessEnabled parameter specifies whether the organization relationship should be used to retrieve free/busy information from the external organization.
The FreeBusyAccessLevel parameter specifies the maximum amount of detail returned to the requesting organization. Valid values are: None, AvailabilityOnly or LimitedDetails
The FreeBusyAccessScope parameter specifies a mail-enabled security group in the internal organization that contains users whose free/busy information is accessible by an external organization. You can use any value that uniquely identifies the group.
The MailboxMoveEnabled parameter specifies whether the organization relationship enables moving mailboxes to or from the external organization.
The MailboxMoveCapability parameter is used in cross-tenant mailbox migrations.
The MailboxMovePublishedScopes parameter is used in cross-tenant mailbox migrations to specify the mail-enabled security groups whose members are allowed to migrate.
The MailTipsAccessEnabled parameter specifies whether MailTips for users in this organization are returned over this organization relationship.
The MailTipsAccessLevel parameter specifies the level of MailTips data externally shared over this organization relationship. This parameter can have the following values: All, Limited, None
The MailTipsAccessScope parameter specifies a mail-enabled security group in the internal organization that contains users whose free/busy information is accessible by an external organization. You can use any value that uniquely identifies the group.
The OAuthApplicationId is used in cross-tenant mailbox migrations to specify the application ID of the mailbox migration app that you consented to.
The OrganizationContact parameter specifies the email address that can be used to contact the external organization (for example, administrator@fourthcoffee.com).
The PhotosEnabled parameter specifies whether photos for users in the internal organization are returned over the organization relationship.
The TargetApplicationUri parameter specifies the target Uniform Resource Identifier (URI) of the external organization. The TargetApplicationUri parameter is specified by Exchange when requesting a delegated token to retrieve free and busy information, for example, mail.contoso.com.
The TargetAutodiscoverEpr parameter specifies the Autodiscover URL of Exchange Web Services for the external organization. Exchange uses Autodiscover to automatically detect the correct Exchangeserver endpoint to use for external requests.
The TargetOwaURL parameter specifies the Outlook on the web (formerly Outlook Web App) URL of the external organization that's defined in the organization relationship. It is used for Outlook on the web redirection in a cross-premise Exchange scenario. Configuring this attribute enables users in the organization to use their current Outlook on the web URL to access Outlook on the web in the external organization.
The TargetSharingEpr parameter specifies the URL of the target Exchange Web Services for the external organization.
Specify if the OrganizationRelationship should exist or not.
Create a new Inbound connector in your cloud-based organization.
The Identity parameter specifies the outbound connector that you want to modify.
Specifies whether connector is enabled.
Specifies whether connector should use MXRecords for target resolution.
The Comment parameter specifies an optional comment.
The ConnectorSource parameter specifies how the connector is created. DO NOT CHANGE THIS!
The ConnectorType parameter specifies a category for the domains that are serviced by the connector.
The RecipientDomains parameter specifies the domain that the Outbound connector routes mail to. You can specify multiple domains separated by commas.
The SmartHosts parameter specifies the smart hosts the Outbound connector uses to route mail. This parameter is required if you set the UseMxRecord parameter to $false and must be specified on the same command line.
The TlsDomain parameter specifies the domain name that the Outbound connector uses to verify the FQDN of the target certificate when establishing a TLS secured connection. This parameter is only used if the TlsSettings parameter is set to DomainValidation. Valid input for the TlsDomain parameter is an SMTP domain. You can use a wildcard character to specify all subdomains of a specified domain, as shown in the following example: .contoso.com. However, you can't embed a wildcard character, as shown in the following example: domain..contoso.com
The TlsSettings parameter specifies the TLS authentication level that's used for outbound TLS connections established by this Outbound connector.
The IsTransportRuleScoped parameter specifies whether the Outbound connector is associated with a transport rule (also known as a mail flow rule).
The RouteAllMessagesViaOnPremises parameter specifies that all messages serviced by this connector are first routed through the on-premises messaging system (Centralized mailrouting).
The CloudServicesMailEnabled parameter specifies whether the connector is used for hybrid mail flow between an on-premises Exchange environment and Microsoft Office 365. Specifically, this parameter controls how certain internal X-MS-Exchange-Organization-* message headers are handled in messages that are sent between accepted domains in the on-premises and cloud organizations. These headers are collectively known as cross-premises headers. DO NOT USE MANUALLY!
The AllAcceptedDomains parameter specifies whether the Outbound connector is used in hybrid organizations where message recipients are in accepted domains of the cloud-based organization.
The SenderRewritingEnabled parameter specifies that all messages that normally qualify for SRS rewriting are rewritten for routing through the on-premises email system.
The TestMode parameter specifies whether you want to enabled or disable test mode for the Outbound connector.
The ValidationRecipients parameter specifies the email addresses of the validation recipients for the Outbound connector. You can specify multiple email addresses separated by commas.
Specifies if this Outbound connector should exist.
This resource configures OWA Mailbox Policies in Exchange Online.
The Name parameter specifies the unique name for the policy. The maximum length is 64 characters.
The AccountTransferEnabled parameter specifies whether to enable or disable QR code sign-in. By default, QR code sign-in is enabled.
The ActionForUnknownFileAndMIMETypes parameter specifies how to handle file types that aren't specified in the Allow, Block, and Force Save lists for file types and MIME types
The ActiveSyncIntegrationEnabled parameter specifies whether to enable or disable Exchange ActiveSync settings in Outlook on the web.
No description available.
The AdditionalStorageProvidersAvailable parameter specifies whether to allow additional storage providers (for example, Box, Dropbox, Facebook, Google Drive, Egnyte, personal OneDrive) attachments in Outlook on the web.
The AllAddressListsEnabled parameter specifies which address lists are available in Outlook on the web.
The AllowCopyContactsToDeviceAddressBook parameter specifies whether users can copy the contents of their Contacts folder to a mobile device's native address book when using Outlook on the web for devices.
The AllowedFileTypes parameter specifies the attachment file types (file extensions) that can be saved locally or viewed from Outlook on the web.
The AllowedMimeTypes parameter specifies the MIME extensions of attachments that allow the attachments to be saved locally or viewed from Outlook on the web.
The BlockedFileTypes parameter specifies a list of attachment file types (file extensions) that can't be saved locally or viewed from Outlook on the web.
The BlockedMimeTypes parameter specifies MIME extensions in attachments that prevent the attachments from being saved locally or viewed from Outlook on the web.
No description available.
No description available.
The ClassicAttachmentsEnabled parameter specifies whether users can attach local files as regular email attachments in Outlook on the web.
The ConditionalAccessPolicy parameter specifies the Outlook on the Web Policy for limited access. For this feature to work properly, you also need to configure a Conditional Access policy in the Azure Active Directory Portal.
The DefaultTheme parameter specifies the default theme that's used in Outlook on the web when the user hasn't selected a theme. The default value is blank ($null).
The DirectFileAccessOnPrivateComputersEnabled parameter specifies the left-click options for attachments in Outlook on the web for private computer sessions.
The DirectFileAccessOnPrivateComputersEnabled parameter specifies the left-click options for attachments in Outlook on the web for public computer sessions.
The DisableFacebook switch specifies whether users can synchronize their Facebook contacts to their Contacts folder in Outlook on the web. By default, Facebook integration is enabled.
The DisplayPhotosEnabled parameter specifies whether users see sender photos in Outlook on the web.
The ExplicitLogonEnabled parameter specifies whether to allow a user to open someone else's mailbox in Outlook on the web (provided that user has permissions to the mailbox).
The ExternalImageProxyEnabled parameter specifies whether to load all external images through the Outlook external image proxy.
The ExternalSPMySiteHostURL specifies the My Site Host URL for external users.
The FeedbackEnabled parameter specifies whether to enable or disable inline feedback surveys in Outlook on the web.
The ForceSaveAttachmentFilteringEnabled parameter specifies whether files are filtered before they can be saved from Outlook on the web.
The ForceSaveFileTypes parameter specifies the attachment file types (file extensions) that can only be saved from Outlook on the web (not opened).
The ForceSaveMimeTypes parameter specifies the MIME extensions in attachments that only allow the attachments to be saved locally (not opened).
The ForceWacViewingFirstOnPrivateComputers parameter specifies whether private computers must first preview an Office file as a web page in Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server) before opening the file in the local application.
The ForceWacViewingFirstOnPublicComputers parameter specifies whether public computers must first preview an Office file as a web page in Office Online Server before opening the file in the local application.
The FreCardsEnabled parameter specifies whether the theme, signature, and phone cards are available in Outlook on the web.
The GlobalAddressListEnabled parameter specifies whether the global address list is available in Outlook on the web.
The GroupCreationEnabled parameter specifies whether Office 365 group creation is available in Outlook on the web.
The InstantMessagingEnabled parameter specifies whether instant messaging is available in Outlook on the web.
The InstantMessagingType parameter specifies the type of instant messaging provider in Outlook on the web.
The InterestingCalendarsEnabled parameter specifies whether interesting calendars are available in Outlook on the web.
The InternalSPMySiteHostURL specifies the My Site Host URL for internal users.
The IRMEnabled parameter specifies whether Information Rights Management (IRM) features are available in Outlook on the web.
No description available.
The IsDefault switch specifies whether the Outlook on the web policy is the default policy that's used to configure the Outlook on the web settings for new mailboxes.
The JournalEnabled parameter specifies whether the Journal folder is available in Outlook on the web.
The LocalEventsEnabled parameter specifies whether local events calendars are available in Outlook on the web.
The LogonAndErrorLanguage parameter specifies the language that used in Outlook on the web for forms-based authentication and for error messages when a user's current language setting can't be read. A valid value is a supported Microsoft Windows Language Code Identifier (LCID). For example, 1033 is US English.
No description available.
The NotesEnabled parameter specifies whether the Notes folder is available in Outlook on the web.
The NpsSurveysEnabled parameter specifies whether to enable or disable the Net Promoter Score (NPS) survey in Outlook on the web. The survey allows uses to rate Outlook on the web on a scale of 1 to 5, and to provide feedback and suggested improvements in free text.
The OneWinNativeOutlookEnabled parameter controls the availability of the new Outlook for Windows App.
When the OrganizationEnabled parameter is set to $false, the Automatic Reply option doesn't include external and internal options, the address book doesn't show the organization hierarchy, and the Resources tab in Calendar forms is disabled.
The OnSendAddinsEnabled parameter specifies whether to enable or disable on send add-ins in Outlook on the web (add-ins that support events when a user clicks Send).
The OutboundCharset parameter specifies the character set that's used for outgoing messages in Outlook on the web.
The OutlookBetaToggleEnabled parameter specifies whether to enable or disable the Outlook on the web Preview toggle. The Preview toggle allows users to try the new Outlook on the web experience.
The OWALightEnabled parameter controls the availability of the light version of Outlook on the web.
No description available.
The PersonalAccountCalendarsEnabled parameter specifies whether to allow users to connect to their personal Outlook.com or Google Calendar in Outlook on the web.
The PhoneticSupportEnabled parameter specifies phonetically spelled entries in the address book. This parameter is available for use in Japan.
The PlacesEnabled parameter specifies whether to enable or disable Places in Outlook on the web. Places lets users search, share, and map location details by using Bing.
The PremiumClientEnabled parameter controls the availability of the full version of Outlook Web App.
The PrintWithoutDownloadEnabled specifies whether to allow printing of supported files without downloading the attachment in Outlook on the web.
The ProjectMocaEnabled parameter enables or disables access to Project Moca in Outlook on the web.
The PublicFoldersEnabled parameter specifies whether a user can browse or read items in public folders in Outlook Web App.
The RecoverDeletedItemsEnabled parameter specifies whether a user can use Outlook Web App to view, recover, or delete permanently items that have been deleted from the Deleted Items folder.
The ReferenceAttachmentsEnabled parameter specifies whether users can attach files from the cloud as linked attachments in Outlook on the web.
The RemindersAndNotificationsEnabled parameter specifies whether notifications and reminders are enabled in Outlook on the web.
The ReportJunkEmailEnabled parameter specifies whether users can report messages to Microsoft or unsubscribe from messages in Outlook on the web.
The RulesEnabled parameter specifies whether a user can view, create, or modify server-side rules in Outlook on the web.
The SatisfactionEnabled parameter specifies whether to enable or disable the satisfaction survey.
The SaveAttachmentsToCloudEnabled parameter specifies whether users can save regular email attachments to the cloud.
The SearchFoldersEnabled parameter specifies whether Search Folders are available in Outlook on the web.
The SetPhotoEnabled parameter specifies whether users can add, change, and remove their sender photo in Outlook on the web.
The SetPhotoURL parameter controls where users go to select their photo. Note that you can't specify a URL that contains one or more picture files, as there is no mechanism to copy a URL photo to the properties of the users' Exchange Online mailboxes.
No description available.
The SignaturesEnabled parameter specifies whether to enable or disable the use of signatures in Outlook on the web.
The SkipCreateUnifiedGroupCustomSharepointClassification parameter specifies whether to skip a custom SharePoint page during the creation of Office 365 Groups in Outlook web app.
The TeamSnapCalendarsEnabled parameter specifies whether to allow users to connect to their personal TeamSnap calendars in Outlook on the web.
The TextMessagingEnabled parameter specifies whether users can send and receive text messages in Outlook on the web.
The ThemeSelectionEnabled parameter specifies whether users can change the theme in Outlook on the web.
The UMIntegrationEnabled parameter specifies whether Unified Messaging (UM) integration is enabled in Outlook on the web.
The UseGB18030 parameter specifies whether to use the GB18030 character set instead of GB2312 in Outlook on the web.
The UseISO885915 parameter specifies whether to use the character set ISO8859-15 instead of ISO8859-1 in Outlook on the web.
The UserVoiceEnabled parameter specifies whether to enable or disable Outlook UserVoice in Outlook on the web. Outlook UserVoice is a customer feedback area that's available in Office 365.
The WacEditingEnabled parameter specifies whether to enable or disable editing documents in Outlook on the web by using Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server).
The WacExternalServicesEnabled parameter specifies whether to enable or disable external services when viewing documents in Outlook on the web (for example, machine translation) by using Office Online Server.
The WacOMEXEnabled parameter specifies whether to enable or disable apps for Outlook in Outlook on the web in Office Online Server.
The WacViewingOnPrivateComputersEnabled parameter specifies whether to enable or disable web viewing of supported Office documents private computer sessions in Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server). By default, all Outlook on the web sessions are considered to be on private computers.
The WacViewingOnPublicComputersEnabled parameter specifies whether to enable or disable web viewing of supported Office documents in public computer sessions in Office Online Server.
The WeatherEnabled parameter specifies whether to enable or disable weather information in the calendar in Outlook on the web.
The WebPartsFrameOptionsType parameter specifies what sources can access web parts in IFRAME or FRAME elements in Outlook on the web.
Specify if the OWA Mailbox Policy should exist or not.
This resource configures Partner Applications in Exchange Online.
The Name parameter specifies a new name for the partner application.
The ApplicationIdentifier parameter specifies a unique application identifier for the partner application that uses an authorization server.
The AcceptSecurityIdentifierInformation parameter specifies whether Exchange should accept security identifiers (SIDs) from another trusted Active Directory forest for the partner application.
The AccountType parameter specifies the type of Microsoft account that's required for the partner application.
The Enabled parameter specifies whether the partner application is enabled.
The LinkedAccount parameter specifies a linked Active Directory user account for the application.
Specify if the Partner Application should exist or not.
Modify the perimeter Configuration policy in your cloud-based organization.
Only valid value is 'Yes'.
Use the GatewayIPAddresses parameter to create or modify a list of gateway server IP addresses to add to IP safelists.
Specifies if this Outbound connector should exist.
This resource configures a place in Exchange Online (e.g., room).
The Identity parameter specifies the room mailbox that you want to modify. You can use any value that uniquely identifies the room.
The display name of the place.
The AudioDeviceName parameter specifies the name of the audio device in the room. If the value contains spaces, enclose the value in quotation marks.
The Building parameter specifies the building name or building number that the room is in. If the value contains spaces, enclose the value in quotation marks.
The Capacity parameter specifies the capacity of the room. A valid value is an integer.
The City parameter specifies the room's city. If the value contains spaces, enclose the value in quotation marks.
The CountryOrRegion parameter specifies the room's country or region. A valid value is a valid ISO 3166-1 two-letter country code (for example, AU for Australia) or the corresponding friendly name for the country (which might be different from the official ISO 3166 Maintenance Agency short name).
N/A
The DisplayDeviceName parameter specifies the name of the display device in the room. If the value contains spaces, enclose the value in quotation marks.
The Floor parameter specifies the floor number that the room is on.
The FloorLabel parameter specifies a descriptive label for the floor that the room is on. If the value contains spaces, enclose the value in quotation marks.
The GeoCoordinates parameter specifies the room's location in latitude, longitude and (optionally) altitude coordinates.
The IsWheelChairAccessible parameter specifies whether the room is wheelchair accessible.
The Label parameter specifies a descriptive label for the room (for example, a number or name). If the value contains spaces, enclose the value in quotation marks.
The MTREnabled parameter identifies the room as configured with a Microsoft Teams room system. You can add Teams room systems as audio sources in Teams meetings that involve the room.
The ParentId parameter specifies the ID of a Place in the parent location hierarchy in Microsoft Places.
The ParentType parameter specifies the parent type of the ParentId in Microsoft Places. Valid values are: Floor, Section
The Phone parameter specifies the room's telephone number.
The PostalCode parameter specifies the room's postal code.
The State parameter specifies the room's state or province.
The Street parameter specifies the room's physical address.
The Tags parameter specifies additional features of the room (for example, details like the type of view or furniture type).
The VideoDeviceName parameter specifies the name of the video device in the room. If the value contains spaces, enclose the value in quotation marks.
Specifies if this Outbound connector should exist.
This resource configures Policy Tips in Exchange Online.
The Name parameter specifies the custom Policy Tip you want to modify.
The Value parameter specifies the text that's displayed by the Policy Tip.
Specify if the Policy Tip Config should exist or not.
Create or modify a EXOQuarantinePolicy in your cloud-based organization.
The Identity parameter specifies the QuarantinePolicy you want to modify.
The EndUserQuarantinePermissionsValue parameter specifies the end-user permissions for the quarantine policy.
The ESNEnabled parameter specifies whether to enable quarantine notifications (formerly known as end-user spam notifications) for the policy.
The MultiLanguageCustomDisclaimer parameter specifies the custom disclaimer text to use near the bottom of quarantine notifications.
The MultiLanguageSenderName parameter specifies the email sender's display name to use in quarantine notifications.
The MultiLanguageSetting parameter specifies the language of quarantine notifications.
The OrganizationBrandingEnabled parameter enables or disables organization branding in the end-user quarantine notification messages.
Specifies if this QuarantinePolicy should exist.
The EndUserSpamNotificationFrequency parameter species how often quarantine notifications are sent to users. Valid values are: 04:00:00 (4 hours),1.00:00:00 (1 day),7.00:00:00 (7 days)
The QuarantinePolicyType parameter filters the results by the specified quarantine policy type. Valid values are: QuarantinePolicy, GlobalQuarantinePolicy
This parameter is reserved for internal Microsoft use.
This parameter is reserved for internal Microsoft use.
The EndUserSpamNotificationCustomFromAddress specifies the email address of an existing internal sender to use as the sender for quarantine notifications. To set this parameter back to the default email address quarantine@messaging.microsoft.com, use the value $null.
The EsnCustomSubject parameter specifies the text to use in the Subject field of quarantine notifications.This setting is available only in the built-in quarantine policy named DefaultGlobalTag that controls global quarantine policy settings.
This resource allows users to retrieve Office 365 Recipient Permissions.
The mailbox the permission should be given on.
The account to give the permission to.
The access rights granted to the account. Only 'SendAs' is supported.
Present ensures the group exists, absent ensures it is removed
This resource configures the Remote Email Domains in Exchange Online.
Specify the Identity for the RemoteDomain.
The DomainName parameter specifies the SMTP domain that you want to establish as a remote domain. A valid value is an SMTP domain (for example, contoso.com). The maximum length is 256 characters.
Specify if the RemoteDomain should exist or not.
The AllowedOOFType parameter specifies the type of automatic replies or out-of-office (also known as OOF) notifications than can be sent to recipients in the remote domain. Valid values are: External, ExternalLegacy, InternalLegacy or None
The AutoForwardEnabled parameter specifies whether to allow messages that are auto-forwarded by client email programs in your organization.
The AutoReplyEnabled parameter specifies whether to allow messages that are automatic replies from client email programs in your organization (for example, automatic reply messages that are generated by rules in Outlook).
The ByteEncoderTypeFor7BitCharsets parameter specifies the 7-bit transfer encoding method for MIME format for messages sent to this remote domain.
The CharacterSet parameter specifies a character set for MIME messages without defined character sets that are sent from your organization to recipients in the remote domain.
The ContentType parameter specifies the outbound message content type and formatting.
The DeliveryReportEnabled parameter specifies whether to allow delivery reports from client software in your organization to recipients in the remote domain.
The DisplaySenderName parameter specifies whether to show the sender's Display Name in the From email address for messages sent to recipients in the remote domain.
The IsInternal parameter specifies whether the recipients in the remote domain are considered to be internal recipients.
The LineWrapSize parameter specifies the line-wrap size for messages to recipients in the remote domain. Valid values are an integer from 0 through 132 or the value to unlimited. The default value is unlimited.
The MeetingForwardNotificationEnabled parameter specifies whether to enable meeting forward notifications for recipients in the remote domain.
The Name parameter specifies a unique name for the remote domain object. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.
The NDREnabled parameter specifies whether to allow non-delivery reports (also known NDRs or bounce messages) from your organization to recipients in the remote domain.
The NonMimeCharacterSet parameter specifies a character set for plain text messages without defined character sets that are sent from your organization to recipients in the remote domain.
The PreferredInternetCodePageForShiftJis parameter specifies the specific code page to use for Shift JIS character encoding in messages that are sent to recipients in the remote domain.
The RequiredCharsetCoverage parameter specifies a percentage threshold for characters in a message that must match to apply your organization's preferred character set before switching to automatic character set detection.
The TargetDeliveryDomain parameter specifies whether the remote domain is used in cross-forest deployments to generate target email addresses for new mail users that represent users in the other organization (for example, all mailboxes hosted on Exchange Online are represented as mail users in your on-premises organization).
The TNEFEnabled parameter specifies whether Transport Neutral Encapsulation Format (TNEF) message encoding is used on messages sent to the remote domain.
The TrustedMailInboundEnabled parameter specifies whether messages from senders in the remote domain are treated as trusted messages.
The TrustedMailOutboundEnabled parameter specifies whether messages sent to recipients in the remote domain are treated as trusted messages.
The UseSimpleDisplayName parameter specifies whether the sender's simple display name is used for the From email address in messages sent to recipients in the remote domain.
Create or modify an EXOReportSubmissionPolicy in your cloud-based organization.
Specifies the resource is a single instance, the value must be 'Yes'.
The DisableQuarantineReportingOption parameter allows or prevents users from reporting messages in quarantine.
The EnableCustomNotificationSender parameter specifies whether a custom sender email address is used for result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.
The EnableOrganizationBranding parameter specifies whether to show the company logo in the footer of result messages that users receive after an admin reviews and marks the reported messages as junk, not junk, or phishing.
The EnableReportToMicrosoft parameter specifies whether Microsoft integrated reporting experience is enabled or disabled.
The EnableThirdPartyAddress parameter specifies whether you're using third-party reporting tools in Outlook instead of Microsoft tools to send messages to the reporting mailbox in Exchange Online.
The EnableUserEmailNotification parameter species whether users receive result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.
The JunkReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as junk.
The NotJunkReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as not junk.
The NotificationFooterMessage parameter specifies the custom footer text to use in email notifications after an admin reviews and marks the reported messages as junk, not junk, or phishing.
The NotificationSenderAddress parameter specifies the sender email address to use in result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.
The PhishingReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as phishing.
The PostSubmitMessage parameter specifies the custom pop-up message text to use in Outlook notifications after users report messages.
The PostSubmitMessageEnabled parameter enables or disables the pop-up Outlook notifications that users see after they report messages using Microsoft reporting tools.
The PostSubmitMessage parameter parameter specifies the custom pop-up message title to use in Outlook notifications after users report messages.
The PreSubmitMessage parameter specifies the custom pop-up message text to use in Outlook notifications before users report messages.
The PreSubmitMessageEnabled parameter enables or disables the pop-up Outlook notifications that users see before they report messages using Microsoft reporting tools.
The PreSubmitMessage parameter parameter specifies the custom pop-up message title to use in Outlook notifications before users report messages.
The ReportJunkAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.
The ReportJunkToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.
The ReportNotJunkAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.
The ReportNotJunkToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.
The ReportPhishAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.
The ReportPhishToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.
Use the ThirdPartyReportAddresses parameter to specify the email address of the reporting mailbox when you're using a third-party product for user submissions instead of reporting in Outlook.
Specifies if this report submission policy should exist.
Create or modify an EXOReportSubmissionRule in your cloud-based organization.
Specifies the resource is a single instance, the value must be 'Yes'.
The Identity parameter specifies the report submission rule that you want to modify.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time.
The SentTo parameter specifies the email address of the reporting mailbox in Exchange Online where user reported messages are sent.
Specifies if this report submission rule should exist.
Modify the resource Configuration policy in your cloud-based organization.
Only valid value is 'Yes'.
The ResourcePropertySchema parameter specifies the custom resource property that you want to make available to room or equipment mailboxes. This parameter uses the syntax Room/
Specifies if this Outbound connector should exist.
This resource configures Role Assignment Policies in Exchange Online.
The Name parameter specifies the new name of the assignment policy. The maximum length is 64 characters.
The Description parameter specifies the description that's displayed when the role assignment policy is viewed using the Get-RoleAssignmentPolicy cmdlet.
The IsDefault switch makes the assignment policy the default assignment policy.
The Roles parameter specifies the management roles to assign to the role assignment policy when it's created.
Specify if the Role Assignment Policy should exist or not.
This resource configures Role Groups in Exchange Online.
The Name parameter specifies the name of the role. The maximum length of the name is 64 characters.
The Description parameter specifies the description that's displayed when the role group is viewed using the Get-RoleGroup cmdlet. Enclose the description in quotation marks
The Members parameter specifies the mailboxes or mail-enabled USGs to add as a member of the role group. You can identify the user or group by the name, DN, or primary SMTP address value. You can specify multiple members separated by commas (Value1,Value2,...ValueN). If the value contains spaces, enclose the value in quotation marks
The Roles parameter specifies the management roles to assign to the role group when it's created. If a role name contains spaces, enclose the name in quotation marks. If you want to assign more that one role, separate the role names with commas.
Specify if the Role Group should exist or not.
This resource configures the settings of the Safe Attachments policies in your cloud-based organization.
The Identity parameter specifies the name of the SafeAttachmentpolicy that you want to modify.
The Action parameter specifies the action for the Safe Attachments policy.
The ActionOnError parameter specifies the error handling option for Safe Attachments scanning (what to do if scanning times out or an error occurs). Valid values are: $true: The action specified by the Action parameter is applied to messages even when the attachments aren't successfully scanned. $false: The action specified by the Action parameter isn't applied to messages when the attachments aren't successfully scanned. This is the default value.
The AdminDisplayName parameter specifies a description for the policy.
Specify if this policy should be enabled. Default is $true.
The QuarantineTag specifies the quarantine policy that's used on messages that are quarantined as malware by Safe Attachments.
The Redirect parameter specifies whether to send detected malware attachments to another email address. Valid values are: $true: Malware attachments are sent to the email address specified by the RedirectAddress parameter. $false: Malware attachments aren't sent to another email address. This is the default value.
The RedirectAddress parameter specifies the email address where detected malware attachments are sent when the Redirect parameter is set to the value $true.
Specify if this policy should exist or not.
This resource configures an Safe Attachment Rule in Exchange Online.
The Identity parameter specifies the name of the SafeAttachment rule that you want to modify.
The SafeAttachmentPolicy parameter specifies the name of the SafeAttachment policy that's associated with the SafeAttachment rule.
Specify if this rule should be enabled. Default is $true.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
Specify if this rule should exist or not.
This resource configures the settings of the SafeLinks policies in your cloud-based organization.
The Identity parameter specifies the SafeLinks policy that you want to modify.
Specify if this policy should exist or not.
The AdminDisplayName parameter specifies a description for the policy.
The AllowClickThrough parameter specifies whether to allow users to click through to the original URL on warning pages.
The custom notification text specifies the customized notification text to show to users.
The DeliverMessageAfterScan parameter specifies whether to deliver email messages only after Safe Links scanning is complete. Valid values are: $true: Wait until Safe Links scanning is complete before delivering the message. $false: If Safe Links scanning can't complete, deliver the message anyway. This is the default value.
The DoNotRewriteUrls parameter specifies a URL that's skipped by Safe Links scanning. You can specify multiple values separated by commas.
The EnableForInternalSenders parameter specifies whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization.
The EnableOrganizationBranding parameter specifies whether your organization's logo is displayed on Safe Links warning and notification pages.
The EnableSafeLinksForOffice parameter specifies whether to enable Safe Links protection for supported Office desktop, mobile, or web apps.
The EnableSafeLinksForTeams parameter specifies whether Safe Links is enabled for Microsoft Teams. Valid values are: $true: Safe Links is enabled for Teams. If a protected user clicks a malicious link in a Teams conversation, group chat, or from channels, a warning page will appear in the default web browser. $false: Safe Links isn't enabled for Teams. This is the default value.
The EnableSafeLinksForEmail parameter specifies whether to enable Safe Links protection for email messages. Valid values are: $true: Safe Links is enabled for email. When a user clicks a link in an email, the link is checked by Safe Links. If the link is found to be malicious, a warning page appears in the default web browser. $false: Safe Links isn't enabled for email. This is the default value.
The DisableUrlRewrite parameter specifies whether to rewrite (wrap) URLs in email messages. Valid values are: $true: URLs in messages are not rewritten, but messages are still scanned by Safe Links prior to delivery. Time of click checks on links are done using the Safe Links API in supported Outlook clients (currently, Outlook for Windows and Outlook for Mac). Typically, we don't recommend using this value. $false: URLs in messages are rewritten. API checks still occur on unwrapped URLs in supported clients if the user is in a valid Safe Links policy. This is the default value.
The ScanUrls parameter specifies whether to enable or disable the scanning of links in email messages. Valid values are: $true: Scanning links in email messages is enabled. $false: Scanning links in email messages is disabled. This is the default value.
The TrackClicks parameter specifies whether to track user clicks related to Safe Links protection of links.
The UseTranslatedNotificationText specifies whether to use Microsoft Translator to automatically localize the custom notification text that you specified with the CustomNotificationText parameter.
This resource configures an SafeLinks Rule in Exchange Online.
The Identity parameter specifies the name of the SafeLink rule that you want to modify.
The SafeLinksPolicy parameter specifies the name of the SafeLink policy that's associated with the SafeLinksing rule.
Specify if this rule should exist or not.
Specify if this rule should be enabled. Default is $true.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
This resource configures Sharing Policies in Exchange Online.
The Name parameter specifies the unique name of the sharing policy. The maximum length is 64 characters.
The Default switch specifies that the sharing policy is the default sharing policy for all mailboxes.
The Enabled parameter specifies whether to enable the sharing policy. Valid values for this parameter are $true or $false.
The Domains parameter specifies domains to which this policy applies and the sharing policy action.
Specify if the Sharing Policy should exist or not.
Use this resource to create Sweep rules in mailboxes. Sweep rules run at regular intervals to help keep your Inbox clean.
The Name parameter specifies the name of the Sweep rule. If the value contains spaces, enclose the value in quotation marks.
The Provider parameter specifies the provider for the Sweep rule. If the value contains spaces, enclose the value in quotation marks. For Sweep rules that you create in Outlook on the web, the default value is Exchange16.
The DestinationFolder parameter specifies an action for the Sweep rule that moves messages to the specified folder.
The Enabled parameter specifies whether the Sweep rule is enabled or disabled.
The KeepForDays parameter specifies an action for the Sweep rule that specifies the number of days to keep messages that match the conditions of the rule. After the number of days have passed, the messages are moved to the location that's specified by the DestinationFolder parameter (by default, the Deleted Items folder). You can't use this parameter with the KeepLatest parameter and the Sweep rule must contain a KeepForDays or KeepLatest parameter value.
The KeepLatest parameter specifies an action for the Sweep rule that specifies the number of messages to keep that match the conditions of the rule. After the number of messages is exceeded, the oldest messages are moved to the location that's specified by the DestinationFolder parameter (by default, the Deleted Items folder). You can't use this parameter with the KeepForDays parameter and the Sweep rule must contain a KeepForDays or KeepLatest parameter value.
The Mailbox parameter specifies the mailbox where you want to create the Sweep rule. You can use any value that uniquely identifies the mailbox.
The SenderName parameter specifies a condition for the Sweep rule that looks for the specified sender in messages. For internal senders, you can use any value that uniquely identifies the sender.
The SourceFolder parameter specifies a condition for the Sweep rule that looks for messages in the specified folder.
The SystemCategory parameter specifies a condition for the sweep rule that looks for messages with the specified system category. System categories are available to all mailboxes in the organization.
Specify if this rule should exist or not.
This resource configures the Exchange Online transport settings.
Specifies the resource is a single instance, the value must be 'Yes'.
The AddressBookPolicyRoutingEnabled parameter controls how recipients are resolved in an organization that uses address book policies to create separate virtual organizations within the same Exchange organization.
Allow legacy TLS clients
The ClearCategories parameter keeps or removes Microsoft Outlook message categories during content conversion.
The ConvertDisclaimerWrapperToEml parameter specifies whether the original message will be added as a TNEF attachment or a regular EML attachment to a disclaimer.
The DSNConversionMode parameter controls how Exchange handles delivery status notifications that are generated by earlier versions of Exchange or other messaging systems.
The ExternalDelayDsnEnabled parameter specifies whether a delay delivery status notification (DSN) message should be created for external messages that couldn't be immediately delivered.
The ExternalDsnDefaultLanguage parameter specifies which Exchange server language should be used by default when you create external DSN messages.
The ExternalDsnLanguageDetectionEnabled parameter specifies whether the server should try to send an external DSN message in the same language as the original message that generated the notification.
The ExternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of external DSN messages.
The ExternalDsnSendHtml parameter specifies whether external DSN messages should be HTML or plain text.
The ExternalPostmasterAddress parameter specifies the email address in the From header field of an external DSN message.
The HeaderPromotionModeSetting parameter specifies whether named properties are created for custom X-headers on messages received.
The InternalDelayDsnEnabled parameter specifies whether a delay DSN message should be created for messages sent to or from recipients or senders in the same Exchange organization that couldn't be immediately delivered.
The InternalDsnDefaultLanguage parameter specifies which Exchange server language should be used by default when you create internal DSN messages.
The InternalDsnLanguageDetectionEnabled parameter specifies whether the server should try to send an internal DSN message in the same language as the original message that generated the notification.
The InternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of internal DSN messages.
The InternalDsnSendHtml parameter specifies whether internal DSN messages should be HTML or plain text.
The JournalMessageExpirationDays parameter extends the number of days that undeliverable journal reports are queued before they expire.
The JournalingReportNdrTo parameter specifies the email address to which journal reports are sent if the journaling mailbox is unavailable.
The MaxRecipientEnvelopeLimit parameter specifies the maximum number of recipients in a message.
Reply all storm block duration hours.
Reply all storm detection minimum recipients.
Reply all storm detection minimum replies.
Reply all storm protection enabled.
The Rfc2231EncodingEnabled parameter specifies whether the RFC 2231 encoding of MIME parameters for outbound messages is enabled in your organization.
The SmtpClientAuthenticationDisabled parameter specifies whether to disable authenticated SMTP (SMTP AUTH) for the whole organization.
This resource configures Transport Rules in Exchange Online.
The Name parameter specifies the display name of the transport rule to be created. The maximum length is 64 characters.
This parameter specifies a condition or part of a condition for the rule. The name of the corresponding exception parameter starts with ExceptIf.
This parameter specifies a condition or part of a condition for the rule. The name of the corresponding exception parameter starts with ExceptIf.
The ActivationDate parameter specifies when the rule starts processing messages. The rule won't take any action on messages until the specified date/time.
The AddManagerAsRecipientType parameter specifies an action that delivers or redirects messages to the user that's defined in the sender's Manager attribute.
The AddToRecipients parameter specifies an action that adds recipients to the To field of messages.
The AnyOfCcHeader parameter specifies a condition that looks for recipients in the Cc field of messages.
The AnyOfCcHeaderMemberOf parameter specifies a condition that looks for group members in the Cc field of messages.
The AnyOfRecipientAddressContainsWords parameter specifies a condition that looks for words in recipient email addresses.
The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition that looks for text patterns in recipient email addresses by using regular expressions.
The AnyOfToCcHeader parameter specifies a condition that looks for recipients in the To or Cc fields of messages.
The AnyOfToCcHeaderMemberOf parameter specifies a condition that looks for group members in the To and Cc fields of messages.
The AnyOfToHeader parameter specifies a condition that looks for recipients in the To field of messages.
The AnyOfToHeaderMemberOf parameter specifies a condition that looks for group members in the To field of messages.
The ApplyClassification parameter specifies an action that applies a message classification to messages.
The ApplyHtmlDisclaimerFallbackAction parameter specifies what to do if the HTML disclaimer can't be added to a message.
The ApplyHtmlDisclaimerLocation parameter specifies where to insert the HTML disclaimer text in the body of messages.
The ApplyHtmlDisclaimerText parameter specifies an action that adds the disclaimer text to messages.
The ApplyOME parameter specifies an action that encrypts messages and their attachments by using Office 365 Message Encryption.
The ApplyRightsProtectionCustomizationTemplate parameter specifies an action that applies a custom branding template for OME encrypted messages.
The ApplyRightsProtectionTemplate parameter specifies an action that applies rights management service (RMS) templates to messages.
The AttachmentContainsWords parameter specifies a condition that looks for words in message attachments.
The AttachmentExtensionMatchesWords parameter specifies a condition that looks for words in the file name extensions of message attachments.
The AttachmentHasExecutableContent parameter specifies a condition that looks for executable content in message attachments.
The AttachmentIsPasswordProtected parameter specifies a condition that looks for password protected files in messages (because the contents of the file can't be inspected).
The AttachmentIsUnsupported parameter specifies a condition that looks for unsupported file types in messages.
The AttachmentMatchesPatterns parameter specifies a condition that looks for text patterns in the content of message attachments by using regular expressions.
The AttachmentNameMatchesPatterns parameter specifies a condition that looks for text patterns in the file name of message attachments by using regular expressions.
The AttachmentProcessingLimitExceeded parameter specifies a condition that looks for messages where attachment scanning didn't complete.
The AttachmentPropertyContainsWords parameter specifies a condition that looks for words in the properties of attached Office documents.
The AttachmentSizeOver parameter specifies a condition that looks for messages where any attachment is greater than the specified size.
The BetweenMemberOf1 parameter specifies a condition that looks for messages that are sent between group members.
The BetweenMemberOf2 parameter specifies a condition that looks for messages that are sent between group members.
The BlindCopyTo parameter specifies an action that adds recipients to the Bcc field of messages.
The Comments parameter specifies optional descriptive text for the rule. The length of the comment can't exceed 1024 characters.
The ContentCharacterSetContainsWords parameter specifies a condition that looks for character set names in messages.
The CopyTo parameter specifies an action that adds recipients to the Cc field of messages.
The DeleteMessage parameter specifies an action that silently drops messages without an NDR.
The DlpPolicy parameter specifies the data loss prevention (DLP) policy that's associated with the rule.
The Enabled parameter specifies whether the new rule is created as enabled or disabled.
The ExceptIfADComparisonAttribute parameter specifies an exception that compares an Active Directory attribute between the sender and all recipients of the message.
The ExceptIfADComparisonOperator parameter specifies the comparison operator for the ExceptIfADComparisonAttribute parameter.
The ExceptIfAnyOfCcHeader parameter specifies an exception that looks for recipients in the Cc field of messages.
The ExceptIfAnyOfCcHeaderMemberOf parameter specifies an exception that looks for group members in the Cc field of messages. You can use any value that uniquely identifies the group.
The ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception that looks for words in recipient email addresses.
The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception that looks for text patterns in recipient email addresses by using regular expressions.
The ExceptIfAnyOfToCcHeader parameter specifies an exception that looks for recipients in the To or Cc fields of messages.
The ExceptIfAnyOfToCcHeaderMemberOf parameter specifies an exception that looks for group members in the To and Cc fields of messages.
The ExceptIfAnyOfToHeader parameter specifies an exception that looks for recipients in the To field of messages.
The ExceptIfAnyOfToHeaderMemberOf parameter specifies an exception that looks for group members in the To field of messages.
The ExceptIfAttachmentContainsWords parameter specifies an exception that looks for words in message attachments.
The ExceptIfAttachmentExtensionMatchesWords parameter specifies an exception that looks for words in the file name extensions of message attachments.
The ExceptIfAttachmentHasExecutableContent parameter specifies an exception that looks for executable content in message attachments.
The ExceptIfAttachmentIsPasswordProtected parameter specifies an exception that looks for password protected files in messages (because the contents of the file can't be inspected).
The ExceptIfAttachmentIsUnsupported parameter specifies an exception that looks for unsupported file types in messages.
The ExceptIfAttachmentMatchesPatterns parameter specifies an exception that looks for text patterns in the content of message attachments by using regular expressions.
The ExceptIfAttachmentNameMatchesPatterns parameter specifies an exception that looks for text patterns in the file name of message attachments by using regular expressions.
The ExceptIfAttachmentPropertyContainsWords parameter specifies an exception that looks for words in the properties of attached Office documents.
The ExceptIfAttachmentProcessingLimitExceeded parameter specifies an exception that looks for messages where attachment scanning didn't complete.
The ExceptIfAttachmentSizeOver parameter specifies an exception that looks for messages where any attachment is greater than the specified size.
The ExceptIfBetweenMemberOf1 parameter specifies an exception that looks for messages that are sent between group members.
The ExceptIfBetweenMemberOf2 parameter specifies an exception that looks for messages that are sent between group members.
The ExceptIfContentCharacterSetContainsWords parameter specifies an exception that looks for character set names in messages.
The ExceptIfFrom parameter specifies an exception that looks for messages from specific senders.
The ExceptIfFromAddressContainsWords parameter specifies an exception that looks for words in the sender's email address.
The ExceptIfFromAddressMatchesPatterns parameter specifies an exception that looks for text patterns in the sender's email address by using regular expressions.
The ExceptIfFromMemberOf parameter specifies an exception that looks for messages sent by group members.
The ExceptIfFromScope parameter specifies an exception that looks for the location of message senders.
The ExceptIfHasClassification parameter specifies an exception that looks for messages with the specified message classification.
The ExceptIfHasNoClassification parameter specifies an exception that looks for messages with or without any message classifications.
DEPRECATED
The ExceptIfHeaderContainsMessageHeader parameter specifies the name of header field in the message header when searching for the words specified by the ExceptIfHeaderContainsWords parameter.
The ExceptIfHeaderContainsWords parameter specifies an exception that looks for words in a header field.
The ExceptIfHeaderMatchesMessageHeader parameter specifies the name of header field in the message header when searching for the text patterns specified by the ExceptIfHeaderMatchesPatterns parameter.
The ExceptIfHeaderMatchesPatterns parameter specifies an exception that looks for text patterns in a header field by using regular expressions.
The ExceptIfManagerAddresses parameter specifies the users (managers) for the ExceptIfManagerForEvaluatedUser parameter.
The ExceptIfManagerForEvaluatedUser parameter specifies an exception that looks for users in the Manager attribute of senders or recipients.
The ExceptIfMessageTypeMatches parameter specifies an exception that looks for messages of the specified type.
DEPRECATED
The ExceptIfMessageSizeOver parameter specifies an exception that looks for messages larger than the specified size.
The ExceptIfRecipientADAttributeContainsWords parameter specifies an exception that looks for words in the Active Directory attributes of recipients.
The ExceptIfRecipientADAttributeMatchesPatterns parameter specifies an exception that looks for text patterns in the Active Directory attributes of recipients by using regular expressions.
The ExceptIfRecipientAddressContainsWords parameter specifies an exception that looks for words in recipient email addresses.
The ExceptIfRecipientAddressMatchesPatterns parameter specifies an exception that looks for text patterns in recipient email addresses by using regular expressions.
The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains.
This parameter is reserved for internal Microsoft use.
The ExceptIfSCLOver parameter specifies an exception that looks for the SCL value of messages
The ExceptIfSenderADAttributeContainsWords parameter specifies an exception that looks for words in Active Directory attributes of message senders.
The ExceptIfSenderADAttributeMatchesPatterns parameter specifies an exception that looks for text patterns in Active Directory attributes of message senders by using regular expressions.
The ExceptIfSenderDomainIs parameter specifies an exception that looks for senders with email address in the specified domains.
This parameter is reserved for internal Microsoft use.
The ExceptIfSenderIpRanges parameter specifies an exception that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.
The ExceptIfSenderManagementRelationship parameter specifies an exception that looks for the relationship between the sender and recipients in messages.
The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.
The ExceptIfSentToScope parameter specifies an exception that looks for the location of a recipient.
The ExceptIfSubjectContainsWords parameter specifies an exception that looks for words in the Subject field of messages.
The ExceptIfSubjectMatchesPatterns parameter specifies an exception that looks for text patterns in the Subject field of messages by using regular expressions.
The ExceptIfSubjectOrBodyContainsWords parameter specifies an exception that looks for words in the Subject field or body of messages.
The ExceptIfSubjectOrBodyMatchesPatterns parameter specifies an exception that looks for text patterns in the Subject field or body of messages.
The ExceptIfWithImportance parameter specifies an exception that looks for messages with the specified importance level.
The ExpiryDate parameter specifies when this rule will stop processing messages. The rule won't take any action on messages after the specified date/time.
The From parameter specifies a condition that looks for messages from specific senders. You can use any value that uniquely identifies the sender.
The FromAddressContainsWords parameter specifies a condition that looks for words in the sender's email address.
The FromAddressMatchesPatterns parameter specifies a condition that looks for text patterns in the sender's email address by using regular expressions.
The FromMemberOf parameter specifies a condition that looks for messages sent by group members.
The FromScope parameter specifies a condition that looks for the location of message senders.
The GenerateIncidentReport parameter specifies where to send the incident report that's defined by the IncidentReportContent parameter.
The GenerateNotification parameter specifies an action that sends a notification message to recipients.
The HasClassification parameter specifies a condition that looks for messages with the specified message classification.
The HasNoClassification parameter specifies a condition that looks for messages with or without any message classifications.
DEPRECATED
The HeaderContainsMessageHeader parameter specifies the name of header field in the message header when searching for the words specified by the HeaderContainsWords parameter.
The HeaderContainsWords parameter specifies a condition that looks for words in a header field.
The HeaderMatchesMessageHeader parameter specifies the name of header field in the message header when searching for the text patterns specified by the HeaderMatchesPatterns parameter.
The HeaderMatchesPatterns parameter specifies a condition that looks for text patterns in a header field by using regular expressions.
The IncidentReportContent parameter specifies the message properties that are included in the incident report that's generated when a message violates a DLP policy.
The ManagerAddresses parameter specifies the users (managers) for the ExceptIfManagerForEvaluatedUser parameter.
The ManagerForEvaluatedUser parameter specifies a condition that looks for users in the Manager attribute of senders or recipients.
DEPRECATED
The MessageSizeOver parameter specifies a condition that looks for messages larger than the specified size. The size includes the message and all attachments.
The MessageTypeMatches parameter specifies a condition that looks for messages of the specified type.
The Mode parameter specifies how the rule operates.
The ModerateMessageByManager parameter specifies an action that forwards messages for approval to the user that's specified in the sender's Manager attribute.
The ModerateMessageByUser parameter specifies an action that forwards messages for approval to the specified users.
DEPRECATED
The PrependSubject parameter specifies an action that adds text to add to the beginning of the Subject field of messages.
The Priority parameter specifies a priority value for the rule that determines the order of rule processing.
The Quarantine parameter specifies an action that quarantines messages.
The RecipientADAttributeContainsWords parameter specifies a condition that looks for words in the Active Directory attributes of recipients.
The RecipientADAttributeMatchesPatterns parameter specifies a condition that looks for text patterns in the Active Directory attributes of recipients by using regular expressions.
The RecipientAddressContainsWords parameter specifies a condition that looks for words in recipient email addresses.
The RecipientAddressMatchesPatterns parameter specifies a condition that looks for text patterns in recipient email addresses by using regular expressions.
The RecipientAddressType parameter specifies how conditions and exceptions check recipient email addresses.
The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains.
This parameter is reserved for internal Microsoft use.
The RedirectMessageTo parameter specifies a rule action that redirects messages to the specified recipients.
The RejectMessageEnhancedStatusCode parameter specifies the enhanced status code that's used when the rule rejects messages.
The RejectMessageReasonText parameter specifies the explanation text that's used when the rule rejects messages.
The RemoveHeader parameter specifies an action that removes a header field from the message header.
The RemoveOME parameter specifies an action that removes the previous version of Office 365 Message Encryption from messages and their attachments.
The RemoveOMEv2 parameter specifies an action that removes Office 365 Message Encryption from messages and their attachments.
This parameter specifies an action or part of an action for the rule.
The RouteMessageOutboundConnector parameter specifies an action that routes messages through the specified Outbound connector in Office 365.
The RouteMessageOutboundRequireTls parameter specifies an action that uses Transport Layer Security (TLS) encryption to deliver messages outside your organization.
The RuleErrorAction parameter specifies what to do if rule processing can't be completed on messages.
The RuleSubType parameter specifies the rule type.
The SCLOver parameter specifies a condition that looks for the SCL value of messages
The SenderADAttributeContainsWords parameter specifies a condition that looks for words in Active Directory attributes of message senders.
The SenderADAttributeMatchesPatterns parameter specifies a condition that looks for text patterns in Active Directory attributes of message senders by using regular expressions.
The SenderAddressLocation parameter specifies where to look for sender addresses in conditions and exceptions that examine sender email addresses.
The SenderDomainIs parameter specifies a condition that looks for senders with email address in the specified domains.
This parameter is reserved for internal Microsoft use.
The SenderIpRanges parameter specifies a condition that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.
The SenderManagementRelationship parameter specifies a condition that looks for the relationship between the sender and recipients in messages.
The SentTo parameter specifies a condition that looks for recipients in messages.
The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups.
The SentToScope parameter specifies a condition that looks for the location of recipients.
The SetAuditSeverity parameter specifies an action that sets the severity level of the incident report and the corresponding entry that's written to the message tracking log when messages violate DLP policies.
The SetHeaderName parameter specifies an action that adds or modifies a header field in the message header.
The SetHeaderValue parameter specifies an action that adds or modifies a header field in the message header.
The SetSCL parameter specifies an action that adds or modifies the SCL value of messages.
The StopRuleProcessing parameter specifies an action that stops processing more rules.
The SubjectContainsWords parameter specifies a condition that looks for words in the Subject field of messages.
The SubjectMatchesPatterns parameter specifies a condition that looks for text patterns in the Subject field of messages by using regular expressions.
The SubjectOrBodyContainsWords parameter specifies a condition that looks for words in the Subject field or body of messages.
The SubjectOrBodyMatchesPatterns parameter specifies a condition that looks for text patterns in the Subject field or body of messages.
The WithImportance parameter specifies a condition that looks for messages with the specified importance level.
Specify if the Transport Rule should exist or not.
This resource configures an Azure AD Administrative Unit.
DisplayName of the Administrative Unit
Object-Id of the Administrative Unit
Description of the Administrative Unit
Visibility of the Administrative Unit. Specify HiddenMembership if members of the AU are hidden
Specify membership type. Possible values are Assigned and Dynamic. Note that the functionality is currently in preview.
Specify membership rule. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.
Specify dynamic membership-rule processing-state. Valid values are 'On' and 'Paused'. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.
Specify members. Only specify if MembershipType is NOT set to Dynamic
Specify Scoped Role Membership. Note: Any groups must be role-enabled
Present ensures the Administrative Unit exists, absent ensures it is removed.
This resource configures an Azure Active Directory Application.
DisplayName of the app
ObjectID of the app.
AppId for the app.
Indicates whether this application is available in other tenants.
A free text field to provide a description of the application object to end users. The maximum allowed size is 1024 characters.
A bitmask that configures the groups claim issued in a user or OAuth 2.0 access token that the application expects.
The URL to the application's homepage.
User-defined URI(s) that uniquely identify a Web application within its Azure AD tenant, or within a verified custom domain.
Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false, which means the fallback application type is confidential client such as web app. There are certain scenarios where Microsoft Entra ID cannot determine the client application type (for example, ROPC flow where it is configured without specifying a redirect URI). In those cases, Microsoft Entra ID will interpret the application type based on the value of this property.
Client applications that are tied to this resource application.
The logout url for this application.
Specifies whether this application is a public client (such as an installed application running on a mobile device). Default is false.
Specifies the URLs that user tokens are sent to for sign in, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to.
UPN or ObjectID values of the app's owners.
Specify if the Azure AD App should exist or not.
API permissions for the Azure Active Directory Application.
Represents a group of related custom security attribute definitions.
Identifier for the attribute set that is unique within a tenant. Can be up to 32 characters long and include Unicode characters. Cannot contain spaces or special characters. Cannot be changed later. Case insensitive
Identifier for the attribute set that is unique within a tenant. Can be up to 32 characters long and include Unicode characters. Cannot contain spaces or special characters. Cannot be changed later. Case insensitive
Maximum number of custom security attributes that can be defined in this attribute set. Default value is null. If not specified, the administrator can add up to the maximum of 500 active attributes per tenant. Can be changed later.
Present ensures the policy exists, absent ensures it is removed.
Represents a Microsoft Entra authentication context class reference. Authentication context class references are custom values that define a Conditional Access authentication requirement
Identifier used to reference the authentication context class. The id is used to trigger step-up authentication for the referenced authentication requirements and is the value that will be issued in the acrs claim of an access token. This value in the claim is used to verify that the required authentication context has been satisfied. The allowed values are c1 through c25.
A friendly name that identifies the authenticationContextClassReference object when building user-facing admin experiences. For example, a selection UX
A short explanation of the policies that are enforced by authenticationContextClassReference. This value should be used to provide secondary text to describe the authentication context class reference when building user-facing admin experiences. For example, a selection UX.
Indicates whether the authenticationContextClassReference has been published by the security admin and is ready for use by apps. When it's set to false, it shouldn't be shown in admin UX experiences because the value isn't currently available for selection.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy
The name of the policy.
A description of the policy.
The state of migration of the authentication methods policy from the legacy multifactor authentication and self-service password reset (SSPR) policies. The possible values are: premigration - means the authentication methods policy is used for authentication only, legacy policies are respected. migrationInProgress - means the authentication methods policy is used for both authentication and SSPR, legacy policies are respected. migrationComplete - means the authentication methods policy is used for authentication and SSPR, legacy policies are ignored. unknownFutureValue - Evolvable enumeration sentinel value. Do not use.
The version of the policy in use.
Days before the user will be asked to reconfirm their method.
Enforce registration at sign-in time. This property can be used to remind users to set up targeted authentication methods.
1 nested properties
Run campaigns to remind users to setup targeted authentication methods.
4 nested properties
Users and groups of users that are excluded from being prompted to set up the authentication method.
Users and groups of users that are prompted to set up the authentication method.
Specifies the number of days that the user sees a prompt again if they select 'Not now' and snoozes the prompt. Minimum 0 days. Maximum: 14 days. If the value is '0' The user is prompted during every MFA attempt.
Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.
Prompt users with their most-preferred credential for multifactor authentication.
3 nested properties
Users and groups excluded from the preferred authentication method experience of the system.
Users and groups included in the preferred authentication method experience of the system.
Indicates whether the feature is enabled or disabled. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set, and uses the default behavior of Azure Active Directory for the setting. The default value is disabled.
The unique identifier for an entity. Read-only.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy Authenticator
The unique identifier for an entity. Read-only.
A collection of Microsoft Authenticator settings such as number matching and location context, and whether they are enabled for all users or specific users only.
4 nested properties
Determines whether users will be able to approve push notifications on other Microsoft applications such as Outlook Mobile.
3 nested properties
A single entity that's excluded from using this feature.
A single entity that's allowed to use this feature.
Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.
Determines whether the user's Authenticator app will show them the client app they are signing into.
3 nested properties
A single entity that's excluded from using this feature.
A single entity that's allowed to use this feature.
Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.
Determines whether the user's Authenticator app will show them the geographic location of where the authentication request originated from.
3 nested properties
A single entity that's excluded from using this feature.
A single entity that's allowed to use this feature.
Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.
Specifies whether the user needs to enter a number in the Authenticator app from the login screen to complete their login. Value is ignored for phone sign-in notifications.
3 nested properties
A single entity that's excluded from using this feature.
A single entity that's allowed to use this feature.
Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.
true if users can use the OTP code generated by the Microsoft Authenticator app, false otherwise.
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy Email
The unique identifier for an entity. Read-only.
Determines whether email OTP is usable by external users for authentication. Possible values are: default, enabled, disabled, unknownFutureValue. Tenants in the default state who did not use public preview will automatically have email OTP enabled beginning in October 2021.
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy Fido2
The unique identifier for an entity. Read-only.
Determines whether attestation must be enforced for FIDO2 security key registration.
Determines if users can register new FIDO2 security keys.
Controls whether key restrictions are enforced on FIDO2 security keys, either allowing or disallowing certain key types as defined by Authenticator Attestation GUID (AAGUID), an identifier that indicates the type (e.g. make and model) of the authenticator.
3 nested properties
A collection of Authenticator Attestation GUIDs. AADGUIDs define key types and manufacturers.
Enforcement type. Possible values are: allow, block.
Determines if the configured key enforcement is enabled.
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy Sms
The unique identifier for an entity. Read-only.
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy Software
The unique identifier for an entity. Read-only.
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy Temporary
The unique identifier for an entity. Read-only.
Default length in characters of a Temporary Access Pass object. Must be between 8 and 48 characters.
Default lifetime in minutes for a Temporary Access Pass. Value can be any integer between the minimumLifetimeInMinutes and maximumLifetimeInMinutes.
If true, all the passes in the tenant will be restricted to one-time use. If false, passes in the tenant can be created to be either one-time use or reusable.
Maximum lifetime in minutes for any Temporary Access Pass created in the tenant. Value can be between 10 and 43200 minutes (equivalent to 30 days).
Minimum lifetime in minutes for any Temporary Access Pass created in the tenant. Value can be between 10 and 43200 minutes (equivalent to 30 days).
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy Voice
The unique identifier for an entity. Read-only.
true if users can register office phones, otherwise, false.
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Method Policy X509
The unique identifier for an entity. Read-only.
Defines strong authentication configurations. This configuration includes the default authentication mode and the different rules for strong authentication bindings.
2 nested properties
Rules are configured in addition to the authentication mode to bind a specific x509CertificateRuleType to an x509CertificateAuthenticationMode. For example, bind the policyOID with identifier 1.32.132.343 to x509CertificateMultiFactor authentication mode.
The type of strong authentication mode. The possible values are: x509CertificateSingleFactor, x509CertificateMultiFactor, unknownFutureValue.
Defines fields in the X.509 certificate that map to attributes of the Azure AD user object in order to bind the certificate to the user. The priority of the object determines the order in which the binding is carried out. The first binding that matches will be used and the rest ignored.
Displayname of the groups of users that are excluded from a policy.
Displayname of the groups of users that are included from a policy.
The state of the policy. Possible values are: enabled, disabled.
Present ensures the policy exists, absent ensures it is removed.
Azure AD Authentication Strength Policy
The name of the policy.
A description of the policy.
The unique identifier of the policy.
The authentication method combinations allowed by this authentication strength policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the Azure Active Directory Authorization Policy.
The policy is managed using the BETA API, some properties may have been added in the API but not in the resource
Azure AD Permissions
To authenticate via Microsoft Graph, this resource required the following Application permissions:
-
Automate
- Policy.Read.All
- Policy.ReadWrite.Authorization
-
Export
- Policy.Read.All
NOTE: All permissions listed above require admin consent.
Only valid value is 'Yes'.
Display name for this policy.
Description of this policy.
Boolean Indicates whether users can sign up for email based subscriptions.
Boolean Indicates whether the Self-Serve Password Reset feature can be used by users on the tenant.
Boolean Indicates whether a user can join the tenant by email validation.
Indicates who can invite external users to the organization. Possible values are: None, AdminsAndGuestInviters, AdminsGuestInvitersAndAllMembers, Everyone. Everyone is the default setting for all cloud environments except US Government.
Boolean To disable the use of MSOL PowerShell, set this property to true. This will also disable user-based access to the legacy service endpoint used by MSOL PowerShell. This does not affect Azure AD Connect or Microsoft Graph.
Boolean Indicates whether the default user role can create applications.
Boolean Indicates whether the default user role can create security groups.
Indicates whether the registered owners of a device can read their own BitLocker recovery keys with default user role.
Indicates whether the default user role can create tenants. This setting corresponds to the Restrict non-admin users from creating tenants setting in the User settings menu in the Azure portal. When this setting is false, users assigned the Tenant Creator role can still create tenants.
Boolean Indicates whether the default user role can read other users.
The role that should be granted to guest users. Refer to List unifiedRoleDefinitions to find the list of available role templates. Only supported roles today are User, Guest User, and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b).
String collection Indicates if user consent to apps is allowed, and if it is, which permission to grant consent and which app consent policy (permissionGrantPolicy) govern the permission for users to grant consent. Value should be in the format managePermissionGrantsForSelf.{id}, where {id} is the id of a built-in or custom app consent policy. An empty list indicates user consent to apps is disabled.
Specify that the Azure Authorization Policy should exist.
This resource configures an Azure Active Directory Conditional Access Policy.
DisplayName of the AAD CA Policy
Specifies the GUID for the Policy.
Specifies the State of the Policy.
Cloud Apps in scope of the Policy.
Rule syntax is similar to that used for membership rules for groups in Microsoft Entra ID.
Mode to use for the filter. Possible values are include or exclude.
Cloud Apps out of scope of the Policy.
User Actions in scope of the Policy.
Users in scope of the Policy.
Users out of scope of the Policy.
Groups in scope of the Policy.
Groups out of scope of the Policy.
AAD Admin Roles in scope of the Policy.
AAD Admin Roles out of scope of the Policy.
Represents the Included internal guests or external user types. This is a multi-valued property. Supported values are: b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser, internalGuest, OtherExternalUser, serviceProvider and unknownFutureValue.
Represents the Included Tenants membership kind. The possible values are: all, enumerated, unknownFutureValue. enumerated references an object of conditionalAccessEnumeratedExternalTenants derived type.
Represents the Included collection of tenant ids in the scope of Conditional Access for guests and external users policy targeting.
Represents the Excluded internal guests or external user types. This is a multi-valued property. Supported values are: b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser, internalGuest, OtherExternalUser, serviceProvider and unknownFutureValue.
Represents the Excluded Tenants membership kind. The possible values are: all, enumerated, unknownFutureValue. enumerated references an object of conditionalAccessEnumeratedExternalTenants derived type.
Represents the Excluded collection of tenant ids in the scope of Conditional Access for guests and external users policy targeting.
Client Device Platforms in scope of the Policy.
Client Device Platforms out of scope of the Policy.
AAD Named Locations in scope of the Policy.
AAD Named Locations out of scope of the Policy.
Client Device Filter mode of the Policy.
Client Device Filter rule of the Policy.
AAD Identity Protection User Risk Levels in scope of the Policy.
AAD Identity Protection Sign-in Risk Levels in scope of the Policy.
Client App types in scope of the Policy.
Operator to be used for Grant Controls.
List of built-in Grant Controls to be applied by the Policy.
Specifies, whether Application Enforced Restrictions are enabled in the Policy.
Specifies, whether Cloud App Security is enforced by the Policy.
Specifies, what Cloud App Security control is enforced by the Policy.
Sign in frequency time in the given unit to be enforced by the policy.
Display name of the terms of use to assign.
Custom Controls assigned to the grant property of this policy.
Sign in frequency unit (days/hours) to be interpreted by the policy.
Specifies, whether sign-in frequency is enforced by the Policy.
Sign in frequency interval. Possible values are: 'timeBased', 'everyTime' and 'unknownFutureValue'.
Specifies, whether Browser Persistence is controlled by the Policy.
Specifies, what Browser Persistence control is enforced by the Policy.
Name of the associated authentication strength policy.
Names of the associated authentication flow transfer methods. Possible values are '', 'deviceCodeFlow', 'authenticationTransfer', or 'deviceCodeFlow,authenticationTransfer'.
Authentication context class references.
Specify if the Azure AD CA Policy should exist or not.
This resource manages Azure AD Cross Tenant Access Policies.
Only valid value is 'Yes'.
The name of the policy.
Used to specify which Microsoft clouds an organization would like to collaborate with. By default, this value is empty.
Specify if the policy should exist or not.
This resource manages Azure AD Cross Tenant Access Policies Configuration Default.
Only valid value is 'Yes'.
Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B collaboration.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B collaboration.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B direct connect.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Determines the partner-specific configuration for trusting other Conditional Access claims from external Azure AD organizations.
3 nested properties
Specifies whether compliant devices from external Azure AD organizations are trusted.
Specifies whether hybrid Azure AD joined devices from external Azure AD organizations are trusted.
Specifies whether MFA from external Azure AD organizations is trusted.
Specify if the instance should exist or not.
This resource manages Azure AD Cross Tenant Access Policies Configuration Partner.
The tenant identifier for the partner Azure Active Directory (Azure AD) organization.
Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B collaboration.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B collaboration.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B direct connect.
2 nested properties
The list of applications targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
The list of users and groups targeted with your cross-tenant access policy.
2 nested properties
Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.
Specifies whether to target users, groups, or applications with this rule.
Determines the partner-specific configuration for accepting trust claims from other tenant invitations.
2 nested properties
Specifies whether you want to automatically trust Inbound invitations.
Specifies whether you want to automatically trust Outbound invitations.
Determines the partner-specific configuration for trusting other Conditional Access claims from external Azure AD organizations.
3 nested properties
Specifies whether compliant devices from external Azure AD organizations are trusted.
Specifies whether hybrid Azure AD joined devices from external Azure AD organizations are trusted.
Specifies whether MFA from external Azure AD organizations is trusted.
Specify if the policy should exist or not.
This resource configures an Azure AD Entitlement Management Access Package.
The display name of the access package.
The Id of the access package.
Identifier of the access package catalog referencing this access package.
The description of the access package.
Whether the access package is hidden from the requestor.
Indicates whether role scopes are visible.
The resources and roles included in the access package.
The access packages whose assigned users are ineligible to be assigned this access package.
The access packages that are incompatible with this package.
The groups whose members are ineligible to be assigned this access package.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.
The display name of the policy.
Id of the access package assignment policy.
Identifier of the access package.
Who must review, and how often, the assignments to the access package from this policy. This property is null if reviews are not required.
9 nested properties
The default decision to apply if the request is not reviewed within the period specified in durationInDays.
The number of days within which reviewers should provide input.
Specifies whether to display recommendations to the reviewer. The default value is true
Specifies whether the reviewer must provide justification for the approval. The default value is true.
If true, access reviews are required for assignments from this policy.
The interval for recurrence, such as monthly or quarterly.
Who should be asked to do the review, either Self or Reviewers.
If the reviewerType is Reviewers, this collection specifies the users who will be reviewers, either by ID or as members of a group, using a collection of singleUser and groupMembers.
When the first review should start.
Indicates whether a user can extend the access package assignment duration after approval.
The description of the policy.
The number of days in which assignments from this policy last until they are expired.
The expiration date for assignments created in this policy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
Questions that are posed to the requestor.
Who must approve requests for access package in this policy.
5 nested properties
One of SingleStage, Serial, Parallel, NoApproval (default). NoApproval is used when isApprovalRequired is false.
If approval is required, the one or two elements of this collection define each of the stages of approval. An empty array if no approval is required.
Indicates whether approval is required for requests in this policy.
Indicates whether approval is required for a user to extend their assignment.
Indicates whether the requestor is required to supply a justification in their request.
Who can request this access package from this policy.
3 nested properties
Indicates whether new requests are accepted on this policy.
The users who are allowed to request on this policy, which can be singleUser, groupMembers, and connectedOrganizationMembers.
Who can request.
The collection of stages when to execute one or more custom access package workflow extensions.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Azure AD Entitlement Management Access Package Catalog.
The display name of the access package catalog.
The id of the access package catalog.
Has the value Published if the access packages are available for management.
One of UserManaged or ServiceDefault.
The description of the access package catalog.
Whether the access packages in this catalog can be requested by users outside of the tenant.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Azure AD Entitlement Management Access Package Catalog Resource.
The display name of the resource, such as the application name, group name or site name.
Id of the access package catalog resource.
The unique ID of the access package catalog.
The name of the user or application that first added this resource. Read-only.
The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.
Contains information about the attributes to be collected from the requestor and sent to the resource application.
A description for the resource.
True if the resource is not yet available for assignment. Read-only.
The unique identifier of the resource in the origin system. In the case of an Azure AD group, this is the identifier of the group.
The type of the resource in the origin system.
The type of the resource.
A unique resource locator for the resource, such as the URL for signing a user into an application.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Azure AD Entitlement Management Connected Organization.
The display name of the connected organization.
The Id of the Connected organization object.
The description of the connected organization.
The identity sources in this connected organization.
The state of a connected organization defines whether assignment policies with requestor scope type AllConfiguredConnectedOrganizationSubjects are applicable or not.
Collection of objectID of external sponsors. the sponsor can be a user or a group.
Collection of objectID of internal sponsors. the sponsor can be a user or a group.
Present ensures the policy exists, absent ensures it is removed.
Represents the tenant-wide policy that controls whether external users can leave the guest Microsoft Entra tenant via self-service controls.
Only valid value is 'Yes'.
Defines whether external users can leave the guest tenant. If set to false, self-service controls are disabled, and the admin of the guest tenant must manually remove the external user from the guest tenant. When the external user leaves the tenant, their data in the guest tenant is first soft-deleted then permanently deleted in 30 days.
Reserved for future use.
This resource configures an Azure Active Directory group. IMPORTANT: It does not support mail enabled security groups or mail enabled groups that are not unified or dynamic groups.
If using with AADUser, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADUser
DisplayName of the Azure Active Directory Group
Specifies a mail nickname for the group.
Specifies whether the group is security enabled. For security groups, this value must be $True.
Specifies whether this group is mail enabled. Currently, you cannot create mail enabled groups in Azure AD.
Specifies a description for the group.
Specifies an ID for the group.
User Service Principal values for the group's owners.
User Service Principal values for the group's members.
Displayname values for the groups member of the group.
DisplayName values for the groups that this group is a member of.
Specifies that the group is a dynamic group. To create a dynamic group, specify a value of DynamicMembership.
Specifies the membership rule for a dynamic group.
Specifies the rule processing state. The acceptable values for this parameter are: On. Process the group rule or Paused. Stop processing the group rule.
Specifies whether this group can be assigned a role. Only available when creating a group and can't be modified after group is created.
DisplayName values for the roles that the group is assigned to.
This parameter determines the visibility of the group's content and members list.
List of Licenses assigned to the group.
Specify if the Azure AD Group should exist or not.
This resource configures an Azure Active Directory Group Lifecycle Policy (e.g. Expiration).
Only valid value is 'Yes'.
The number of days a group can exist before it needs to be renewed.
This parameter allows the admin to select which office 365 groups the policy will apply to. 'None' will create the policy in a disabled state. 'All' will apply the policy to every Office 365 group in the tenant. 'Selected' will allow the admin to choose specific Office 365 groups that the policy will apply to.
Notification emails for groups that have no owners will be sent to these email addresses.
Specify if the Azure AD Groups Lifecycle Policy should exist or not.
This resource configures an Azure Active Directory Group Naming Policy.
Only valid value is 'Yes'.
Prefixes and suffixes to add to the group name.
Comma delimited list of words that should be blocked from being included in groups' names.
Specify if the Azure AD Groups Naming Policy should exist or not.
This resource configures an Azure Active Directory Groups Settings.
Only valid value is 'Yes'.
The flag indicating whether Office 365 group creation is allowed in the directory by non-admin users. This setting does not require an Azure Active Directory Premium P1 license.
Boolean indicating whether or not sensitivity labels can be assigned to M365-groups.
Boolean indicating whether or not a guest user can be an owner of groups.
Boolean indicating whether or not a guest user can have access to Office 365 groups content. This setting does not require an Azure Active Directory Premium P1 license.
The url of a link to the guest usage guidelines.
Name of the security group for which the members are allowed to create Office 365 groups even when EnableGroupCreation == false.
A boolean indicating whether or not is allowed to add guests to this directory.
A link to the Group Usage Guidelines.
Boolean, a tenant-wide setting that assigns the default value to the writebackConfiguration/isEnabled property of new groups, if the property isn't specified during group creation. This setting is applicable when group writeback is configured in Microsoft Entra Connect.
Specify if the Azure AD Groups Naming Policy should exist or not.
This resource configures the Azure AD Named Location Policies in Azure Active Directory
Specifies the Display Name of a Named Location in Azure Active Directory
Specifies the Odata Type of a Named Location object in Azure Active Directory
Specifies the ID of a Named Location in Azure Active Directory.
Specifies the IP ranges of the Named Location in Azure Active Directory
Specifies the isTrusted value for the Named Location (IP ranges only) in Azure Active Directory
Specifies the countries and regions for the Named Location in Azure Active Directory
Determines what method is used to decide which country the user is located in. Possible values are clientIpAddress(default) and authenticatorAppGps.
Specifies the includeUnknownCountriesAndRegions value for the Named Location in Azure Active Directory
Specify if the Azure AD Named Location should exist or not.
This resource configures an Azure Active Directory role definition. To configure custom roles you require an Azure AD Premium P1 license. The account used to configure role definitions based on this resource needs either to be a "Global Administrator" or a "Privileged role administrator".
Specifies a display name for the role definition.
Specifies whether the role definition is enabled.
Specifies permissions for the role definition.
Specifies Id for the role definition.
Specifies a description for the role definition.
Specifies the resource scopes for the role definition.
Specifies template id for the role definition.
Specifies version for the role definition.
Specify if the Azure AD Role definition should exist or not.
Represents a request for a role eligibility for a principal through PIM. The role eligibility can be permanently eligible without an expiry date or temporarily eligible with an expiry date. Inherits from request.
User Principal Name of the eligibility request.
Role associated with the eligibility request.
Represented the type of principal to assign the request to. Accepted values are: Group and User.
Identifier of the directory object representing the scope of the role eligibility. The scope of an role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use / for tenant-wide scope. Use appScopeId to limit the scope to an application only. Either directoryScopeId or appScopeId is required.
Identifier for the Role Eligibility Schedule Request.
Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of a role eligibility determines the set of resources for which the principal is eligible to access. App scopes are scopes that are defined and understood by this application only. Use / for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Either directoryScopeId or appScopeId is required.
Represents the type of operation on the role eligibility request.The possible values are: adminAssign, adminUpdate, adminRemove, selfActivate, selfDeactivate, adminExtend, adminRenew, selfExtend, selfRenew, unknownFutureValue.
Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.
A message provided by users and administrators when create they create the unifiedRoleEligibilityScheduleRequest object. Optional when action is adminRemove. Whether this property is required or optional is also dependent on the settings for the Azure AD role.
The period of the role eligibility. Optional when action is adminRemove. The period of eligibility is dependent on the settings of the Azure AD role.
3 nested properties
When the eligible or active assignment expires.
3 nested properties
The requestor's desired duration of access represented in ISO 8601 format for durations. For example, PT3H refers to three hours. If specified in a request, endDateTime should not be present and the type property should be set to afterDuration.
Timestamp of date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
The requestor's desired expiration pattern type. The possible values are: notSpecified, noExpiration, afterDateTime, afterDuration.
The frequency of the eligible or active assignment. This property is currently unsupported in PIM.
2 nested properties
The frequency of an event.
The duration of an event.
When the eligible or active assignment becomes active.
Ticket details linked to the role eligibility request including details of the ticket number and ticket system.
2 nested properties
The ticket number.
The description of the ticket system.
Present ensures the instance exists, absent ensures it is removed.
This resource configure existing Azure roles. All UI parameters can be configured using this resource like:
- Notifications
- require approval / ticket / justification / MFA
RuleDefinition DisplayName
Specifies the RoleId.
Activation maximum duration (hours).
Require justification on activation (True/False)
Require ticket information on activation (True/False)
Require MFA on activation (True/False)
Require approval to activate (True/False)
Approver User UPN and/or Group Displayname
Allow permanent eligible assignment (True/False)
Expire eligible assignments after (Days)
Allow permanent active assignment (True/False)
Expire active assignments after (Days)
Require Azure Multi-Factor Authentication on active assignment (True/False)
Require justification on active assignment (True/False)
Require Azure Multi-Factor Authentication on eligible assignment (True/False)
Require justification on eligible assignment (True/False)
Send notifications when members are assigned as eligible to this role: Role assignment alert, default recipient (True/False)
Send notifications when members are assigned as eligible to this role: Role assignment alert, additional recipient (UPN)
Send notifications when members are assigned as eligible to this role: Role assignment alert, only critical Email (True/False)
Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), default recipient (True/False)
Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), additional recipient (UPN)
Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), only critical Email (True/False)
Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, default recipient (True/False)
Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, additional recipient (UPN)
Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, only critical Email (True/False)
Send notifications when members are assigned as active to this role: Role assignment alert, default recipient (True/False)
Send notifications when members are assigned as active to this role: Role assignment alert, additional recipient (UPN)
Send notifications when members are assigned as active to this role: Role assignment alert, only critical Email (True/False)
Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), default recipient (True/False)
Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), additional recipient (UPN)
Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), only critical Email (True/False)
Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, default recipient (True/False)
Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, additional recipient (UPN)
Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, only critical Email (True/False)
Send notifications when eligible members activate this role: Role assignment alert, default recipient (True/False)
Send notifications when eligible members activate this role: Role assignment alert, additional recipient (UPN)
Send notifications when eligible members activate this role: Role assignment alert, only critical Email (True/False)
Send notifications when eligible members activate this role: Notification to activated user (requestor), default recipient (True/False)
Send notifications when eligible members activate this role: Notification to activated user (requestor), additional recipient (UPN)
Send notifications when eligible members activate this role: Notification to activated user (requestor), only critical Email (True/False)
Authorization context is required (True/False)
Descriptive name of associated authorization context
Authorization context id
Specify if the Azure AD role setting should exist or not.
This resource configures the Security Defaults in Azure Active Directory.
Only valid value is 'Yes'.
Display name of the security defaults.
Description of the security defaults.
Represents whether or not security defaults are enabled.
Specify if the Azure AD App should exist or not.
This resource configures an Azure Active Directory ServicePrincipal.
The unique identifier for the associated application.
App role assignments for this app or service, granted to users, groups, and other service principals.
The ObjectID of the ServicePrincipal
Displayname of the ServicePrincipal.
The alternative names for this service principal
True if the service principal account is enabled; otherwise, false.
Indicates whether an application role assignment is required.
Specifies the error URL of the ServicePrincipal.
Specifies the homepage of the ServicePrincipal.
Specifies the LogoutURL of the ServicePrincipal.
Specifies the PublisherName of the ServicePrincipal.
The URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.
The URL for the SAML metadata of the ServicePrincipal.
Specifies an array of service principal names. Based on the identifierURIs collection, plus the application's appId property, these URIs are used to reference an application's service principal.
The type of the service principal.
Tags linked to this service principal.Note that if you intend for this service principal to show up in the All Applications list in the admin portal, you need to set this value to {WindowsAzureActiveDirectoryIntegratedApp}
Specify if the Azure AD App should exist or not.
Represents identity providers with External Identities for both Microsoft Entra ID and Azure AD B2C tenants. For Microsoft Entra B2B scenarios in a Microsoft Entra tenant, the identity provider type can be Google or Facebook.
The client identifier for the application obtained when registering the application with the identity provider.
The client secret for the application that is obtained when the application is registered with the identity provider. This is write-only. A read operation returns ****.
The display name of the identity provider.
For a B2B scenario, possible values: Google, Facebook. For a B2C scenario, possible values: Microsoft, Google, Amazon, LinkedIn, Facebook, GitHub, Twitter, Weibo, QQ, WeChat.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the Azure AD Tenant Details
Only valid value is 'Yes'.
Email-addresses from the people who should receive Marketing Notifications
Email-addresses from the people who should receive Security Compliance Notifications
Phone Numbers from the people who should receive Security Notifications
Email-addresses from the people who should receive Technical Notifications
This resource configures the Azure AD Token Lifetime Policies
DisplayName of the Policy
ObjectID of the Policy.
Description of the Policy.
Definition of the Policy.
IsOrganizationDefault of the Policy.
Specify if the Azure AD Policy should exist or not.
This resource allows users to create Azure AD Users and assign them licenses, roles and/or groups.
If using with AADGroup, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADGroup
The login name of the user
The display name for the user
The first name of the user
The last name of the user
The list of Azure Active Directory roles assigned to the user.
The country code the user will be assigned to
The account SKU Id for the license to be assigned to the user
The City name of the user
The Country name of the user
The Department name of the user
The Fax Number of the user
The Groups that the user is a direct member of
The Mobile Phone Number of the user
The Office Name of the user
Specifies whether the user password expires periodically. Default value is false
Specifies password policies for the user.
The Phone Number of the user
The Postal Code of the user
The Preferred Language of the user
Specifies the state or province where the user is located
Specifies the street address of the user
Specifies the title of the user
Specifies the title of the user
Present ensures the user exists, absent ensures it is removed
Manages the Teams App Permission Policies.
Unique identifier to be assigned to the new Teams app permission policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.
Enables administrators to provide explanatory text to accompany a Teams app permission policy.
The types of apps for the Global Catalog.
The types of apps for the Private Catalog.
The types of apps for the Default Catalog.
The list of apps for the Global Catalog.
The list of apps for the Private Catalog.
The list of apps for the Default Catalog.
Present ensures the instance exists, absent ensures it is removed.
Manages Teams app setup policies in your tenant.
Unique identifier to be assigned to the new Teams app setup policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.
Enables administrators to provide explanatory text to accompany a Teams app setup policy.
Choose which apps and messaging extensions you want to be installed in your users' personal Teams environment and in meetings they create. Users can install other available apps from the Teams app store.
Choose which apps and meeting extensions you want to be installed in your users' personal Teams environment and in meetings they create. Users can install other available apps from the Teams app store.
Pinning an app displays the app in the app bar in Teams client. Admins can pin apps and they can allow users to pin apps. Pinning is used to highlight apps that are needed the most by users and promote ease of access.
Apps are pinned in messaging extensions and into the ellipsis menu.
If you turn this on, the user's existing app pins will be added to the list of pinned apps set in this policy. Users can rearrange, add, and remove pins as they choose. If you turn this off, the user's existing app pins will be removed and replaced with the apps defined in this policy.
This is also known as side loading. This setting determines if a user can upload a custom app package in the Teams app. Turning it on lets you create or develop a custom app to be used personally or across your organization without having to submit it to the Teams app store. Uploading a custom app also lets you test an app before you distribute it more widely by only assigning it to a single user or group of users.
Present ensures the instance exists, absent ensures it is removed.
Configures a Teams Audio Conferencing Policy.
Specify the name of the policy that you are creating
Determines whether users of the Policy can have Toll free numbers
Determines the list of audio-conferencing Toll- and Toll-free telephone numbers that will be included in meetings invites created by users of this policy.
Present ensures the instance exists, absent ensures it is removed.
Creates a new Teams call hold policy in your tenant. The Teams call hold policy is used to customize the call hold experience for Teams clients.
Unique identifier to be assigned to the new Teams call hold policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.
A string representing the ID referencing an audio file uploaded via the Import-CsOnlineAudioFile cmdlet.
Enables administrators to provide explanatory text to accompany a Teams call hold policy.
Present ensures the instance exists, absent ensures it is removed.
This resource configures a Teams Calling Policy.
More information: https://docs.microsoft.com/en-us/microsoftteams/teams-calling-policy
Identity of the Teams Calling Policy.
Description of the Teams Calling Policy.
Controls all calling capabilities in Teams. Turning this off will turn off all calling functionality in Teams. If you use Skype for Business for calling, this policy will not affect calling functionality in Skype for Business.
Enables inbound calls to be routed to voice mail. Valid options are: AlwaysEnabled, AlwaysDisabled, UserOverride.
Enables inbound calls to be routed to call groups.
Enables inbound calls to be routed to delegates; allows delegates to make outbound calls on behalf of the users for whom they have delegated permissions.
Enables call forwarding or simultaneous ringing of inbound calls to other users in your tenant.
Enables call forwarding or simultaneous ringing of inbound calls to any phone number.
Setting this parameter provides the ability to configure call redirection capabilities on Teams phones.
Determines whether the user is allowed to use SIP devices for calling on behalf of a Teams client.
Allows PSTN calling from the Team web client
Setting this parameter to True will send calls through PSTN and incur charges rather than going through the network and bypassing the tolls.
Setting this parameter lets you configure how incoming calls are handled when a user is already in a call or conference or has a call placed on hold. New or incoming calls will be rejected with a busy signal. Valid options are: Enabled, Disabled and Unanswered.
Sets the expiration of the recorded 1:1 calls.
Setting this parameter allows you to turn on or turn off music on hold when a PSTN caller is placed on hold. It is turned on by default. Valid options are: Enabled, Disabled, UserOverride. For now setting the value to UserOverride is the same as Enabled. This setting does not apply to call park and SLA boss delegate features. Valid options are: Enabled, Disabled, UserOverride.
This parameter is not available for use. Valid options are: Enabled, Disabled, UserOverride.
Setting this parameter to True will allows 1:1 Calls to be recorded.
Determines whether post-meeting captions and transcriptions are allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether real-time captions are available for the user in Teams meetings. Set this to DisabledUserOverride to allow user to turn on live captions. Set this to Disabled to prohibit.
This setting allows the tenant admin to enable or disable the Auto-Answer setting. Valid options are: Enabled, Disabled.
Setting this parameter determines whether calls identified as Spam will be rejected or not (probably). Valid options are: Enabled, Disabled.
Present ensures the policyexists, absent ensures it is removed.
The TeamsCallParkPolicy controls whether or not users are able to leverage the call park feature in Microsoft Teams. Call park allows enterprise voice customers to place a call on hold and then perform a number of actions on that call: transfer to another department, retrieve via the same phone, or retrieve via a different Teams phone. The New-CsTeamsCallParkPolicy resource lets you create a new custom policy that can then be assigned to one or more specific users.
A unique identifier for the policy - this will be used to retrieve the policy later on to assign it to specific users.
If set to true, customers will be able to leverage the call park feature to place calls on hold and then decide how the call should be handled - transferred to another department, retrieved using the same phone, or retrieved using a different phone.
Description of the Teams Call Park Policy.
Specify the number of seconds to wait before ringing the parker when the parked call hasn't been picked up. Value can be from 120 to 1800 (seconds).
Specify the maximum value that a rendered pickup code can take. Value can be from 10 to 9999. Note: PickupRangeStart must be smaller than PickupRangeEnd.
Specify the minimum value that a rendered pickup code can take. Value can be from 10 to 9999.
Present ensures the instance exists, absent ensures it is removed.
This resource is used to manage Call Queue in your Skype for Business Online organization.
The Name parameter specifies a unique name for the Call Queue.
The Name parameter specifies a unique name for the Call Queue.
The AllowOptOut parameter indicates whether or not agents can opt in or opt out from taking calls from a Call Queue.
The DistributionLists parameter lets you add all the members of the distribution lists to the Call Queue. This is a list of distribution list GUIDs. A service wide configurable maximum number of DLs per Call Queue are allowed. Only the first N (service wide configurable) agents from all distribution lists combined are considered for accepting the call. Nested DLs are supported. O365 Groups can also be used to add members to the Call Queue.
The UseDefaultMusicOnHold parameter indicates that this Call Queue uses the default music on hold. This parameter cannot be specified together with MusicOnHoldAudioFileId.
The WelcomeMusicAudioFileId parameter represents the audio file to play when callers are connected with the Call Queue. This is the unique identifier of the audio file.
The MusicOnHoldFileContent parameter represents music to play when callers are placed on hold. This is the unique identifier of the audio file. This parameter is required if the UseDefaultMusicOnHold parameter is not specified.
The OverflowAction parameter designates the action to take if the overflow threshold is reached. The OverflowAction property must be set to one of the following values: DisconnectWithBusy, Forward, Voicemail, and SharedVoicemail. The default value is DisconnectWithBusy.
The OverflowActionTarget parameter represents the target of the overflow action. If the OverFlowAction is set to Forward, this parameter must be set to a Guid or a telephone number with a mandatory 'tel:' prefix. If the OverflowAction is set to SharedVoicemail, this parameter must be set to a group ID (Microsoft 365, Distribution list, or Mail-enabled security). Otherwise, this parameter is optional.
The OverflowThreshold parameter defines the number of calls that can be in the queue at any one time before the overflow action is triggered. The OverflowThreshold can be any integer value between 0 and 200, inclusive. A value of 0 causes calls not to reach agents and the overflow action to be taken immediately.
The TimeoutAction parameter defines the action to take if the timeout threshold is reached. The TimeoutAction property must be set to one of the following values: Disconnect, Forward, Voicemail, and SharedVoicemail. The default value is Disconnect.
The TimeoutActionTarget represents the target of the timeout action. If the TimeoutAction is set to Forward, this parameter must be set to a Guid or a telephone number with a mandatory 'tel:' prefix. If the TimeoutAction is set to SharedVoicemail, this parameter must be set to an Office 365 Group ID. Otherwise, this field is optional.
The TimeoutThreshold parameter defines the time (in seconds) that a call can be in the queue before that call times out. At that point, the system will take the action specified by the TimeoutAction parameter. The TimeoutThreshold can be any integer value between 0 and 2700 seconds (inclusive), and is rounded to the nearest 15th interval. For example, if set to 47 seconds, then it is rounded down to 45. If set to 0, welcome music is played, and then the timeout action will be taken.
The RoutingMethod defines how agents will be called in a Call Queue. If the routing method is set to Serial, then agents will be called one at a time. If the routing method is set to Attendant, then agents will be called in parallel. If routing method is set to RoundRobin, the agents will be called using Round Robin strategy so that all agents share the call-load equally. If routing method is set to LongestIdle, the agents will be called based on their idle time, i.e., the agent that has been idle for the longest period will be called.
The PresenceBasedRouting parameter indicates whether or not presence based routing will be applied while call being routed to Call Queue agents. When set to False, calls will be routed to agents who have opted in to receive calls, regardless of their presence state. When set to True, opted-in agents will receive calls only when their presence state is Available.
The ConferenceMode parameter indicates whether or not Conference mode will be applied on calls for this Call queue. Conference mode significantly reduces the amount of time it takes for a caller to be connected to an agent, after the agent accepts the call.
The Users parameter lets you add agents to the Call Queue. This parameter expects a list of user unique identifiers (GUID).
The LanguageId parameter indicates the language that is used to play shared voicemail prompts. This parameter becomes a required parameter If either OverflowAction or TimeoutAction is set to SharedVoicemail. You can query the supported languages using the Get-CsAutoAttendantSupportedLanguage cmdlet.
The OboResourceAccountIds parameter lets you add resource account with phone number to the Call Queue. The agents in the Call Queue will be able to make outbound calls using the phone number on the resource accounts. This is a list of resource account GUIDs. Only Call Queue managed by a Teams Channel will be able to use this feature.
The OverflowDisconnectTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being disconnected due to overflow.
The OverflowDisconnectAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being disconnected due to overflow.
The OverflowRedirectPersonTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person in the organization due to overflow.
The OverflowRedirectPersonAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person in the organization due to overflow.
The OverflowRedirectVoiceAppsTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a voice application due to overflow.
The OverflowRedirectVoiceAppAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a voice application due to overflow.
The OverflowRedirectPhoneNumberTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to an external PSTN phone number due to overflow.
The OverflowRedirectPhoneNumberAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to an external PSTN phone number due to overflow.
The OverflowRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to overflow.
The OverflowRedirectVoiceMailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person's voicemail due to overflow.
The OverflowRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to overflow.
The OverflowSharedVoicemailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is to be played as a greeting to the caller when transferred to shared voicemail on overflow. This parameter becomes a required parameter when OverflowAction is SharedVoicemail and OverflowSharedVoicemailTextToSpeechPrompt is null.
The EnableOverflowSharedVoicemailTranscription parameter is used to turn on transcription for voicemails left by a caller on overflow. This parameter is only applicable when OverflowAction is set to SharedVoicemail.
The TimeoutDisconnectTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being disconnected due to timeout.
The TimeoutDisconnectAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being disconnected due to timeout.
The TimeoutRedirectPersonTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person in the organization due to timeout.
The TimeoutRedirectPersonAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person in the organization due to timeout.
The TimeoutRedirectVoiceAppsTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a voice application due to timeout.
The TimeoutRedirectVoiceAppAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a voice application due to timeout.
The TimeoutRedirectPhoneNumberTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to an external PSTN phone number due to timeout.
The TimeoutRedirectPhoneNumberAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to an external PSTN phone number due to timeout.
The TimeoutRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to timeout.
The TimeoutRedirectVoiceMailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person's voicemail due to timeout.
The TimeoutSharedVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is to be played as a greeting to the caller when transferred to shared voicemail on timeout. This parameter becomes a required parameter when TimeoutAction is SharedVoicemail and TimeoutSharedVoicemailAudioFilePrompt is null.
The TimeoutSharedVoicemailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is to be played as a greeting to the caller when transferred to shared voicemail on timeout. This parameter becomes a required parameter when TimeoutAction is SharedVoicemail and TimeoutSharedVoicemailTextToSpeechPrompt is null.
The EnableTimeoutSharedVoicemailTranscription parameter is used to turn on transcription for voicemails left by a caller on timeout. This parameter is only applicable when TimeoutAction is set to SharedVoicemail.
Id of the channel to connect a call queue to.
Guid should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). This is the GUID of one of the owners of the team the channels belongs to.
This is a list of GUIDs for users who are authorized to make changes to this call queue. The users must also have a TeamsVoiceApplications policy assigned. The GUID should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).
Present ensures the Team Message Policy exists, absent ensures it is removed
This resource configures a Teams Channel Policy.
More information: https://docs.microsoft.com/en-us/microsoftteams/teams-policies
Identity of the Teams Channel Policy.
Description of the Teams Channel Policy.
Determines whether a user is allowed to share a shared channel with an external user. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to create an org-wide team. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to discover private teams in suggestions and search results. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to create a private channel. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to create a shared channel. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to participate in a shared channel that has been shared by an external user. Set this to TRUE to allow. Set this FALSE to prohibit.
Present ensures the policy exists, absent ensures it is removed.
This resource is used to add and update channels in existing Teams.
Current channel name
Name of the team the Channel belongs to
Team group ID, only used to target a Team when duplicated display names occurs.
Used to update current channel name
Channel description
Present ensures the Team channel exists, absent ensures it is removed
This resource configures a new Custom tab in a Channel.
Display Name of the Channel Tab.
Display Name of the Team.
Display Name of the Channel.
Unique Id of the Team of the instance on the source tenant.
Id of the Teams App associated with the custom tab.
Index of the sort order for the custom tab.
Url of the website linked to the Channel Tab.
Url of the content linked to the Channel Tab.
Url of the location used to remove the app.
Id of the Entity linked to the Channel Tab.
Present ensures the Tab exists, absent ensures it is removed.
This resource is used to configure the Teams client settings.
More information: https://docs.microsoft.com/en-us/microsoftteams/enable-features-office-365#teams-settings-and-teams-upgrade-settings-in-the-microsoft-teams-admin-center
The only valid input is Global - the tenant wide configuration
Designates whether users are able to leverage Box as a third party storage solution in Microsoft Teams. If $true, users will be able to add Box in the client and interact with the files stored there.
Designates whether users are able to leverage DropBox as a third party storage solution in Microsoft Teams. If $true, users will be able to add DropBox in the client and interact with the files stored there.
When set to $true, mail hooks are enabled, and users can post messages to a channel by sending an email to the email address of Teams channel.
Designates whether users are able to leverage GoogleDrive as a third party storage solution in Microsoft Teams. If $true, users will be able to add Google Drive in the client and interact with the files stored there.
Designates whether or not guest users in your organization will have access to the Teams client. If $true, guests in your tenant will be able to access the Teams client. Note that this setting has a core dependency on Guest Access being enabled in your Office 365 tenant.
When set to $true, users will be able to see the organizational chart icon other users' contact cards, and when clicked, this icon will display the detailed organizational chart.
Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the from party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed anonymous because it originated from the Surface Hub's device account. If set to $true, these device accounts will be able to send chat messages in Skype for Business Online (does not apply to Microsoft Teams).
If set to $true, the Exchange address book policy (ABP) will be used to provide customized view of the global address book for each user. This is only a virtual separation and not a legal separation.
Designates whether users are able to leverage ShareFile as a third party storage solution in Microsoft Teams. If $true, users will be able to add ShareFile in the client and interact with the files stored there.
When set to $true, Teams conversations automatically show up in Skype for Business for users that aren't enabled for Teams.
Designates whether users are able to leverage Egnyte as a third party storage solution in Microsoft Teams. If $true, users will be able to add Egnyte in the client and interact with the files stored there.
This setting applies only to Skype for Business Online (not Microsoft Teams) and defines whether the user must provide a secondary form of authentication to access the meeting content from a resource device account. Meeting content is defined as files that are shared to the Content Bin - files that have been attached to the meeting.
Require a secondary form of authentication to access meeting content.
Senders domains can be further restricted to ensure that only allowed SMTP domains can send emails to the Teams channels. This is a comma-separated string of the domains you'd like to allow to send emails to Teams channels.
Creates a new Teams recording policy for governing automatic policy-based recording in your tenant. Automatic policy-based recording is only applicable to Microsoft Teams users.
Unique identifier of the application instance of a policy-based recording application to be retrieved.
A list of application instances of policy-based recording applications to assign to this policy. The Id of each of these application instances must be the ObjectId of the application instance as obtained by the Get-CsOnlineApplicationInstance cmdlet.
Enables administrators to provide explanatory text to accompany a Teams recording policy. For example, the Description might include information about the users the policy should be assigned to.
Setting this attribute to true disables recording audio notifications for 1:1 calls that are under compliance recording.
Controls whether this Teams recording policy is active or not.
This parameter is reserved for future use.
Present ensures the instance exists, absent ensures it is removed.
The CsTeamsCortanaPolicy resources enable administrators to control settings for Cortana voice assistant in Microsoft Teams.
Unique identifier for Teams cortana policy you're creating.
The value of this field indicates if Cortana is enabled and mode of invocation.
Provide a description of your policy to identify purpose of creating it.
Present ensures the instance exists, absent ensures it is removed.
This resource configures a Teams User's Calling Settings.
More information: https://learn.microsoft.com/en-us/microsoftteams/user-call-settings
Only accepted value is Yes.
Specifies the default value that gets assigned to the 'AllowPSTNOnlyMeetings' setting of users when they are enabled for dial-in conferencing, or when a user's dial-in conferencing provider is set to Microsoft. If set to $true, the 'AllowPSTNOnlyMeetings' setting of the user will also be set to true. If $false, the user setting will be false. The default value for AllowPSTNOnlyMeetingsByDefault is $false.
Automatically Migrate User Meetings.
Automatically replace ACP Provider.
Specifies whether advisory emails will be sent to users when the events listed below occur. Setting the parameter to $true enables the emails to be sent, $false disables the emails. The default is $true.
Enable Dial out join confirmation.
Specifies if, by default, announcements are made as users enter and exit a conference call. Set to $true to enable notifications, $false to disable notifications. The default is $true.
Supported entry and exit announcement type.
This parameter allows tenant administrators to configure masking of PSTN participant phone numbers in the roster view for Microsoft Teams meetings enabled for Audio Conferencing, scheduled within the organization. Possible values are MaskedForExternalUsers, MaskedForAllUsers or NoMasking
Specifies the number of digits in the automatically generated PINs. Organizers can enter their PIN to start a meeting they scheduled if they join via phone and are the first person to join. The minimum value is 4, the maximum is 12, and the default is 5.
This resource configures the Teams Emergency Calling Policies.
More information: https://docs.microsoft.com/en-us/microsoftteams/manage-emergency-calling-policies
Identity of the Teams Emergency Calling Policy.
Description of the Teams Emergency Calling Policy.
Allows the tenant administrator to configure a text string, which is shown at the top of the Calls app.
Enables ExternalLocationLookupMode. This mode allows users to set Emergency addresses for remote locations.
This parameter represents PSTN number which can be dialed out if NotificationMode is set to either of the two Conference values.
NotificationGroup is a email list of users and groups to be notified of an emergency call.
The type of conference experience for security desk notification.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the Teams Emergency Call Routing Policies.
More information: https://docs.microsoft.com/en-us/microsoftteams/manage-emergency-call-routing-policies
Identity of the Teams Emergency Call Routing Policy.
Description of the Teams Emergency Call Routing Policy.
Emergency number(s) associated with the policy.
Flag to enable Enhanced Emergency Services
Present ensures the policy exists, absent ensures it is removed.
Use this resource to create a new Teams enhanced encryption policy.
Unique identifier assigned to the Teams enhanced encryption policy.
Determines whether End-to-end encrypted calling is available for the user in Teams. Set this to DisabledUserOverride to allow user to turn on End-to-end encrypted calls. Set this to Disabled to prohibit.
Enables administrators to provide explanatory text to accompany a Teams enhanced encryption policy.
N/A
Present ensures the instance exists, absent ensures it is removed.
This resource configures the Teams Events Policies.
Identity of the Teams Events Policy.
Description of the Teams Events Policy.
This setting governs if a user is allowed to edit the communication emails in Teams Town Hall or Teams Webinar events.
This setting governs access to the integrations tab in the event creation workflow.
Determines if webinars are allowed by the policy or not.
This setting governs if a user can create town halls using Teams Events.
This setting governs which users in a tenant can add which registration form questions to an event registration page for attendees to answer when registering for the event.
This setting describes how IT admins can control which types of Town Hall attendees can have their recordings published.
This setting describes how IT admins can control which types of webinar attendees can have their recordings published.
Defines who is allowed to join the event.
Present ensures the policy exists, absent ensures it is removed.
This setting governs whether the user can enable the Comment Stream chat experience for Town Halls.
This setting governs whether the global admin disables this property and prevents the organizers from creating town halls that use Microsoft eCDN even though they have been assigned a Teams Premium license.
This resource is used to configure the Teams Federation Configuration (CsTenantFederationConfiguration). In the Teams admin center this is available in 'External access' in the Users section.
More information: https://docs.microsoft.com/en-us/microsoftteams/manage-external-access
The only valid input is Global - the tenant wide configuration
When set to True users will be potentially allowed to communicate with users from other domains.
List of federated domains to allow.
List of federated domains to block.
When set to True users will be potentially allowed to communicate with users who have accounts on public IM and presence providers.
Allows federation with people using Teams with an account that's not managed by an organization.
Allows people using Teams with an account that's not managed by an organization, to discover and start communication with users in your organization.
When set to Blocked, all external access with users from Teams subscriptions that contain only trial licenses will be blocked. This means users from these trial-only tenants will not be able to reach to your users via chats, Teams calls, and meetings (using the users authenticated identity) and your users will not be able to reach users in these trial-only tenants. If this setting is set to Blocked, users from the trial-only tenant will also be removed from existing chats.
When set to True, messages sent from discovered partners are considered unverified. That means that those messages will be delivered only if they were sent from a person who is on the recipient's Contacts list.
When set to True, indicates that the users homed on Skype for Business Online use the same SIP domain as users homed on the on-premises version of Skype for Business Server.
When set to True, Teamsconsumer have access only to external user profiles
New-CsTeamsFeedbackPolicy [-Identity]
Specify the name of the Teams Feedback Policy.
Specifies if users are allowed to give feedback.
Specifies if users are allowed to receive the survey.
Specifies if Screenshot Collection is enabled or not.
Specifies if Email Collection is enabled or not.
Specifies if Log Collection is enabled or not.
Specifies if users are allowed to provide feature suggestions
Present ensures the instance exists, absent ensures it is removed.
New-CsTeamsFilesPolicy [-Identity]
Specifies the policy instance name
Specifies whether users see the options to upload files from OneDrive for Business, other cloud storage services configured for the user account, and SharePoint Online
Specifies whether users see the Teams Files channel tab in any channel or in Teams chat.
Present ensures the instance exists, absent ensures it is removed.
This resource is used to assign Teams policy to a specified group
Group Displayname of the group the policies are assigned to
Teams PolicyType. The type of the policy to be assigned. Possible values:
GroupId, alternatively to Group Displayname
Teams PolicyName. The name of the policy to be assigned.
Teams Priority. The rank of the policy assignment, relative to other group policy assignments for the same policy type
Present ensures the group policy assignment exists, absent ensures it is removed.
This resource is used to configure the Teams guest calling configuration.
More information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests
The only valid input is Global - the tenant wide configuration
Designates whether guests who have been enabled for Teams can use calling functionality. If $false, guests cannot call.
This resource is used to configure the Teams Guest Meetings Configuration.
More information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests
The only valid input is Global - the tenant wide configuration
Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow guests to share their video. Set this to FALSE to prohibit guests from sharing their video.
Determines whether real-time captions are available for guests in Teams meetings.
Determines the mode in which guests can share a screen in calls or meetings. Set this to SingleApplication to allow the user to share an application at a given point in time. Set this to EntireScreen to allow the user to share anything on their screens. Set this to Disabled to prohibit the user from sharing their screens.
Determines whether guests can start ad-hoc meetings. Set this to TRUE to allow guests to start ad-hoc meetings. Set this to FALSE to prohibit guests from starting ad-hoc meetings.
Determines whether guests can enable post-meeting captions and transcriptions in meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.
This resource is used to configure the Teams Guest Messaging Configuration.
More information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests
The only valid input is Global - the tenant wide configuration
Determines if a user is allowed to edit their own messages.
Determines if a user is allowed to delete their own messages.
Determines if a user is allowed to chat.
Turn this setting on to allow users to permanently delete their one-on-one chat, group chat, and meeting chat as participants (this deletes the chat only for them, not other users in the chat).
Determines Giphy content restrictions. Default value is Moderate, other options are Strict and NoRestriction.
Determines if memes are available for use.
Determines if stickers are available for use.
Determines if Giphy are available for use.
Determines if Immersive Reader is enabled.
New-CsTeamsIPPhonePolicy allows you to create a policy to manage features related to Teams phone experiences. Teams phone policies determine the features that are available to users.
Specifies the policy instance name
Determines whether Better Together mode is enabled, phones can lock and unlock in an integrated fashion when connected to their Windows PC running a 64-bit Teams desktop client.
Determines whether the Home Screen feature of the Teams IP Phones is enabled.
Determines whether hot desking mode is enabled.
Specifies the description of the policy
Determines the idle timeout value in minutes for the signed in user account. When the timeout is reached, the account is logged out.
Determines whether a user can search the Global Address List in Common Area Phone Mode.
Determines the sign in mode for the device when signing in to Teams.
Present ensures the instance exists, absent ensures it is removed.
This resource is used to configure the Teams Meeting Broadcast Settings.
More information: https://docs.microsoft.com/en-us/microsoftteams/teams-live-events/configure-teams-live-events
The only valid input is Global - the tenant wide configuration
Specifies a URL where broadcast event attendees can find support information or FAQs specific to that event. The URL will be displayed to the attendees during the broadcast.
If set to $true, Teams meeting broadcast streams are enabled to take advantage of the network and bandwidth management capabilities of your Software Defined Network (SDN) provider.
Specifies the Software Defined Network (SDN) provider's name. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.
Specifies the Software Defined Network (SDN) license identifier. This is required and provided by some SDN providers. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.
Specifies the Software Defined Network (SDN) provider's HTTP API endpoint. This information is provided to you by the SDN provider. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.
Specifies the Software Defined Network (SDN) provider's authentication token which is required to use their SDN license. This is required by some SDN providers who will give you the required token. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.
This resource is used to configure the Teams Meeting Broadcast Policies.
More information: https://docs.microsoft.com/en-us/microsoftteams/teams-live-events/set-up-for-teams-live-events
The identifier of the Teams Meeting Broadcast Policy.
Specifies whether this user can create broadcast events in Teams. This setting impacts broadcasts that use both self-service and external encoder production methods.
Specifies whether real-time transcription and translation can be enabled in the broadcast event. Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.
Specifies the attendee visibility mode of the broadcast events created by this user. This setting controls who can watch the broadcast event - e.g. anyone can watch this event including anonymous users or only authenticated users in my company can watch the event. Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.
Specifies whether broadcast events created by this user are always recorded, never recorded or user can choose whether to record or not. Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.
Present ensures the Policy exists, absent ensures it is removed
This resource is used to configure the Teams Meeting Configuration.
More information: https://docs.microsoft.com/en-us/microsoftteams/meeting-settings-in-teams
The only valid input is Global - the tenant wide configuration
URL to a logo image. This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.
URL to a website containing legal information and meeting disclaimers. This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.
URL to a website where users can obtain assistance on joining the meeting.This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.
Text to be used on custom meeting invitations.
Determines whether anonymous users are blocked from joining meetings in the tenant. Set this to TRUE to block anonymous users from joining. Set this to FALSE to allow anonymous users to join meetings.
Determines whether Quality of Service Marking for real-time media (audio, video, screen/app sharing) is enabled in the tenant. Set this to TRUE to enable and FALSE to disable.
Determines the starting port number for client audio. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50000.
Determines the total number of ports available for client audio. Default value is 20.
Determines the starting port number for client video. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50020.
Determines the total number of ports available for client video. Default value is 20.
Determines the starting port number for client screen sharing or application sharing. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50040.
Determines whether custom media port and range selections need to be enforced. When set to True, clients will use the specified port range for media traffic. When set to False (the default value) for any available port (from port 1024 through port 65535) will be used to accommodate media traffic.
Determines the total number of ports available for client sharing or application sharing. Default value is 20.
This resource configures the Teams Meeting Policies.
More information: https://docs.microsoft.com/en-us/microsoftteams/meeting-policies-overview
Identity of the Teams Meeting Policy.
Description of the Teams Meeting Policy.
Determines whether a user can schedule channel meetings. Set this to TRUE to allow a user to schedule channel meetings. Set this to FALSE to prohibit the user from scheduling channel meetings. Note this only restricts from scheduling and not from joining a meeting scheduled by another user.
Determines whether a user can start ad-hoc meetings. Set this to TRUE to allow a user to start ad-hoc meetings. Set this to FALSE to prohibit the user from starting ad-hoc meetings.
Determines whether a user can start private ad-hoc meetings. Set this to TRUE to allow a user to start private ad-hoc meetings. Set this to FALSE to prohibit the user from starting private ad-hoc meetings.
Determines whether or not Chat will be enabled, enabled except anonymous or disabled for meetings.
Determines whether a user should have the option to view live captions or not in a meeting.
Determines whether audio is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their audioo. Set this to FALSE to prohibit the user from sharing their audio.
Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their video. Set this to FALSE to prohibit the user from sharing their video.
Determines whether or not a meeting Organizer can track join and leave times for all users within their meetings as well as download a roster.
Determines whether or not a user can use audio in a meeting that supports it.
Determines whether or not a user can use video in a meeting that supports it. Can only be enabled if IPAudioMode is enabled
CURRENTLY DISABLED: Determines whether anonymous users can use the Call Me At feature for meeting audio.
Determines whether anonymous users can initiate a meeting. Set this to TRUE to allow anonymous users to initiate a meeting. Set this to FALSE to prohibit them from initiating a meeting.
Determines whether a user can schedule private meetings. Set this to TRUE to allow a user to schedule private meetings. Set this to FALSE to prohibit the user from scheduling private meetings. Note this only restricts from scheduling and not from joining a meeting scheduled by another user.
Determines what types of participants will automatically be added to meetings organized by this user. Set this to EveryoneInCompany if you would like meetings to place every external user in the lobby but allow all users in the company to join the meeting immediately. Set this to Everyone if you'd like to admit anonymous users by default. Set this to EveryoneInSameAndFederatedCompany if you would like meetings to allow federated users to join like your company's users, but place all other external users in a lobby. Set this to InvitedUsers if you would like meetings to allow only the invited users.
Determines whether PSTN users should be automatically admitted to the meetings. Set this to TRUE to allow the PSTN user to be able bypass the meetinglobby. Set this to FALSE to prohibit the PSTN user from bypassing the meetinglobby.
Determines whether cloud recording is allowed in a user's meetings. Set this to TRUE to allow the user to be able to record meetings. Set this to FALSE to prohibit the user from recording meetings.
Determines whether cloud recording can be stored out of region for go-local tenants where recording is not yet enabled.
Determines if users can change the default value of the Who can present? setting in Meeting options in the Teams client. This policy setting affects all meetings, including Meet Now meetings.
Determines whether a user can schedule Teams Meetings in Outlook desktop client. Set this to TRUE to allow the user to be able to schedule Teams meetings in Outlook client. Set this to FALSE to prohibit a user from scheduling Teams meeting in Outlook client.
Determines whether Powerpoint sharing is allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether participants can request or give control of screen sharing during meetings scheduled by this user. Set this to TRUE to allow the user to be able to give or request control. Set this to FALSE to prohibit the user from giving, requesting control in a meeting.
Determines whether external participants can request or give control of screen sharing during meetings scheduled by this user. Set this to TRUE to allow the user to be able to give or request control. Set this to FALSE to prohibit an external user from giving or requesting control in a meeting.
Determines whether users are allowed to take shared notes. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether whiteboard is allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether real-time and/or post-meeting captions and transcriptions are allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines the media bit rate for audio/video/app sharing transmissions in meetings.
Determines the mode in which a user can share a screen in calls or meetings. Set this to SingleApplication to allow the user to share an application at a given point in time. Set this to EntireScreen to allow the user to share anything on their screens. Set this to Disabled to prohibit the user from sharing their screens.
Determines which background filters are available to meeting attendees.
Determines whether organizers can override lobby settings for both VOIP and PSTN. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines which Outlook Add-in the user will get as preferred Meeting provider(TeamsAndSfb or Teams).
Determines whether a user is able to use NDI (Network Device Interface) in meetings - both for output and input streams.
Determines what types of external meetings users can join. Enabled is able join all external meetings.
Determines whether or not users will be able to enroll/capture their Biometric data: Face & Voice.
Determines whether or not biometric data will be used to distinguish and or attribute in the transcript.
Determines whether or not meetings created by users with this policy are able to utilize the meeting overflow capability.
Determines whether or not meetings created by users with this policy are able to utilize the Camera Far-End PTZ Mode.
Determines whether or not meetings created by users with this policy are able to utilize the Meeting Reactions feature.
Specifies who can attend and register for webinars.
N/A
Determines whether anonymous users can join the meetings that impacted users organize. Set this to TRUE to allow anonymous users to join a meeting. Set this to FALSE to prohibit them from joining a meeting.
N/A
Controls if a user can create a webinar meeting. The default value is True.
Determines whether network configuration setting lookups can be made by users who are not Enterprise Voice enabled. It is used to enable Network Roaming policies.
N/A
N/A
Specifies the number of days before meeting recordings will expire and move to the recycle bin. Value can be from 1 to 99,999 days. NOTE: You may opt to set Meeting Recordings to never expire by entering the value -1.
Determines whether a user can add a URL for captions from a Communications Access Real-Time Translation (CART) captioner for providing real-time captions in meetings.
N/A
N/A
A user can join a Teams meeting anonymously using a Teams client or using a custom application built using Azure Communication Services. When anonymous meeting join is enabled, both types of clients may be used by default. This optional parameter can be used to block one of the client types that can be used. The allowed values are ACS (to block the use of Azure Communication Services clients) or Teams (to block the use of Teams clients). Both can also be specified, separated by a comma, but this is equivalent to disabling anonymous join completely.
Determines how channel meeting recordings are saved, permissioned, and who can download them.
N/A
N/A
N/A
Determines how meeting organizers can configure a meeting for language interpretation, select attendees of the meeting to become interpreters that other attendees can select and listen to the real-time translation they provide.
Determines whether you provide support for your users to stream their Teams meetings to large audiences through Real-Time Messaging Protocol (RTMP).
Controls how the join information in meeting invitations is displayed by enforcing a common language or enabling up to two languages to be displayed. Note: All Teams supported languages can be specified using language codes.
N/A
N/A
Possible values: EnabledUserOverride or Disabled.
Present ensures the policy exists, absent ensures it is removed.
This resource is used to configure the Teams messaging policy.
More information: https://docs.microsoft.com/en-us/microsoftteams/messaging-policies-in-teams
Identity for the teams messaging policy you're modifying. To modify the global policy, use this syntax: -Identity global. To modify a per-user policy, use syntax similar to this: -Identity TeamsMessagingPolicy.
Report inappropriate content.
Determines is Fluid Collaboration should be enabled or not.
Report a security concern.
Determines whether a user is allowed to access and post Giphys. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to access and post memes. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether owners are allowed to delete all the messages in their team. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether a user is allowed to edit their own messages. Set this to TRUE to allow. Set this to FALSE to prohibit.
Turn on this setting to let a user get text predictions for chat messages.
Turn this setting on to enable suggested replies for chat messages. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether a user is allowed to access and post stickers. Set this to TRUE to allow. Set this FALSE to prohibit.
Use this setting to turn automatic URL previewing on or off in messages. Set this to TRUE to turn on. Set this to FALSE to turn off.
Determines whether a user is allowed to chat. Set this to TRUE to allow a user to chat across private chat, group chat and in meetings. Set this to FALSE to prohibit all chat.
Determines whether a user is allowed to delete their own messages. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether a user is allowed to translate messages to their client languages. Set this to TRUE to allow. Set this to FALSE to prohibit.
Determines whether a user is allowed to use Immersive Reader for reading conversation messages. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to remove a user from a conversation. Set this to TRUE to allow. Set this FALSE to prohibit.
Determines whether a user is allowed to send priorities messages. Set this to TRUE to allow. Set this FALSE to prohibit.
Turn this setting on to allow users to permanently delete their 1:1, group chat, and meeting chat as participants (this deletes the chat only for them, not other users in the chat).
Determines whether a user is allowed to send video messages in Chat. Set this to TRUE to allow a user to send video messages. Set this to FALSE to prohibit sending video messages.
Provide a description of your policy to identify purpose of creating it.
Determines the Giphy content restrictions applicable to a user. Set this to STRICT, MODERATE or NORESTRICTION.
Use this setting to specify whether read receipts are user controlled, enabled for everyone, or disabled. Set this to UserPreference, Everyone or None.
Possible values are: DisabledUserOverride,EnabledUserOverride.
Determines whether a user is allowed to send audio messages. Possible values are: ChatsAndChannels,ChatsOnly,Disabled.
Globally unique identifier (GUID) of the tenant account whose external user communication policy are being created.
Present ensures the Team Message Policy exists, absent ensures it is removed
The TeamsMobilityPolicy allows Admins to control Teams mobile usage for users.
Specify the name of the Teams Mobility Policy.
Enables administrators to provide explanatory text about the policy. For example, the Description might indicate the users the policy should be assigned to.
When set to WifiOnly, prohibits the user from making and receiving calls or joining meetings using VoIP calls on the mobile device while on a cellular data connection. Possible values are: WifiOnly, AllNetworks.
When set to WifiOnly, prohibits the user from making and receiving video calls or enabling video in meetings using VoIP calls on the mobile device while on a cellular data connection. Possible values are: WifiOnly, AllNetworks.
Determines the mobile dialer preference, possible values are: Teams, Native, UserOverride.
Present ensures the instance exists, absent ensures it is removed.
New-CsTeamsNetworkRoamingPolicy allows IT Admins to create policies for Network Roaming and Bandwidth Control experiences in Microsoft Teams.
Specify the name of the Teams Network Roaming Policy.
Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their video. Set this to FALSE to prohibit the user from sharing their video.
Description of the new policy to be created.
Determines the media bit rate for audio/video/app sharing transmissions in meetings.
Present ensures the instance exists, absent ensures it is removed.
This resource configures the Teams Online Voicemail Policies.
More information: https://learn.microsoft.com/en-us/microsoftteams/manage-voicemail-policies
Identity of the Teams Online Voicemail Policy.
Controls if editing call answer rule settings are enabled or disabled for a user. Possible values are $true or $false.
Allows you to disable or enable voicemail transcription. Possible values are $true or $false.
Allows you to disable or enable profanity masking for the voicemail transcriptions. Possible values are $true or $false.
Allows you to disable or enable translation for the voicemail transcriptions. Possible values are $true or $false.
A duration of voicemail maximum recording length. The length should be between 30 seconds to 600 seconds.
The primary (or first) language that voicemail system prompts will be presented in. Must also set SecondarySystemPromptLanguage. When set, this overrides the user language choice.
The secondary language that voicemail system prompts will be presented in. Must also set PrimarySystemPromptLanguage and may not be the same value as PrimarySystemPromptanguage. When set, this overrides the user language choice.
Specifies whether voicemail and transcription data are shared with the service for training and improving accuracy. Possible values are Defer and Deny.
Present ensures the policy exists, absent ensures it is removed.
This resource configures a Teams User's Online Voicemail Settings.
The Identity parameter represents the ID of the specific user in your organization; this can be either a SIP URI or an Object ID.
The CallAnswerRule parameter represents the value of the call answer rule, which can be any of the following: DeclineCall, PromptOnly, PromptOnlyWithTransfer, RegularVoicemail, VoicemailWithTransferOption.
The DefaultGreetingPromptOverwrite parameter represents the contents that overwrite the default normal greeting prompt. If the user's normal custom greeting is not set and DefaultGreetingPromptOverwrite is not empty, the voicemail service will play this overwrite greeting instead of the default normal greeting in the voicemail deposit scenario.
The DefaultOofGreetingPromptOverwrite parameter represents the contents that overwrite the default out-of-office greeting prompt. If the user's out-of-office custom greeting is not set and DefaultOofGreetingPromptOverwrite is not empty, the voicemail service will play this overwrite greeting instead of the default out-of-office greeting in the voicemail deposit scenario.
The OofGreetingEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario.
The OofGreetingFollowAutomaticRepliesEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario when user set automatic replies in Outlook.
The OofGreetingFollowCalendarEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario when user set out-of-office in calendar.
The PromptLanguage parameter represents the language that is used to play voicemail prompts.
Specifies whether voicemail and transcription data is shared with the service for training and improving accuracy.
The TransferTarget parameter represents the target to transfer the call when call answer rule set to PromptOnlyWithTransfer or VoicemailWithTransferOption. Value of this parameter should be a SIP URI of another user in your organization. For user with Enterprise Voice enabled, a valid telephone number could also be accepted as TransferTarget.
The VoicemailEnabled parameter represents whether to enable voicemail service. If set to $false, the user has no voicemail service.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the Teams Online Voice User.
Specifies the identity of the target user.
Specifies the unique identifier of the emergency location to assign to the user. Location identities can be discovered by using the Get-CsOnlineLisLocation cmdlet.
Specifies the telephone number to be assigned to the user. The value must be in E.164 format: +14255043920. Setting the value to $Null clears the user's telephone number.
Present ensures the online voice user exists, absent ensures it is removed.
This resource configures Org-Wide App Settings for Teams.
Specifies the resource is a single instance, the value must be 'Yes'
Determines whether or not to allow interaction with custom apps.
This resource configures a Teams PSTN Usage.
More information: https://docs.microsoft.com/en-us/microsoftteams/direct-routing-voice-routing
An online PSTN usage (such as Local or Long Distance) that can be used in conjunction with voice routes and voice routing policies.
Present ensures the policy exists, absent ensures it is removed.
This resource allows you to create a new TeamsShiftPolicy instance and set it's properties.
Specifies the policy instance name
Determines the grace period time in minutes between when the first shift starts or last shift ends and when access is blocked
Determines the Teams access type granted to the user. Today, only unrestricted access to Teams app is supported.
Determines whether a user can manage a Shifts schedule as a team member.
Determines whether a user is given shift-based presence (On shift, Off shift, or Busy). This must be set in order to have any off shift warning message-specific settings.
Determines the frequency of warning dialog displayed when user opens Teams.
Specifies a custom message. Must set ShiftNoticeMessageType to 'CustomMessage' to enforce this
Specifies the warning message is shown in the blocking dialog when a user access Teams off shift hours. Select one of 7 Microsoft provided messages, a default message or a custom message.
Present ensures the instance exists, absent ensures it is removed.
This resource configures a Teams Templates Policy.
More information: https://learn.microsoft.com/en-us/microsoftteams/templates-policies
Identity of the Teams Templates Policy.
Description of the Teams Templates Policy.
The list of Teams templates to hide.
Present ensures the policy exists, absent ensures it is removed.
This resource is used to configure the tenant-wide dial plans for Microsoft Teams.
More information: https://docs.microsoft.com/en-us/microsoftteams/create-and-manage-dial-plans
The Identity parameter is a unique identifier that designates the name of the tenant dial plan. Identity is an alphanumeric string that cannot exceed 49 characters. Valid characters are alphabetic or numeric characters, hyphen (-) and dot (.). The value should not begin with a (.).
The Description parameter describes the tenant dial plan - what it's for, what type of user it applies to and any other information that helps to identify the purpose of the tenant dial plan. Maximum characters: 512.
List of normalization rules that are applied to this dial plan.
The ExternalAccessPrefix parameter is a number (or set of numbers) that designates the call as external to the organization. (For example, to tenant-dial an outside line, first press 9.) This prefix is ignored by the normalization rules, although these rules are applied to the remainder of the number. The OptimizeDeviceDialing parameter must be set to True for this value to take effect. This parameter must match the regular expression [0-9]{1,4}: that is, it must be a value 0 through 9 and one to four digits in length. The default value is 9.
Specifies if the dial plan should optimize device dialing or not.
The SimpleName parameter is a display name for the tenant dial plan. This name must be unique among all tenant dial plans within the Skype for Business Server deployment.This string can be up to 49 characters long. Valid characters are alphabetic or numeric characters, hyphen (-), dot (.) and parentheses (()).
Specify if this dial plan should exist or not.
As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkRegion to define network regions. A network region interconnects various parts of a network across multiple geographic areas. The RegionID parameter is a logical name that represents the geography of the region, and has no dependencies or restrictions. Tenant network region is used for Location Based Routing.
Unique identifier for the network region to be created.
Name of the associated Central Site.
Provide a description of the network region to identify purpose of creating it.
Present ensures the instance exists, absent ensures it is removed.
As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkSite to define network sites. Network sites are defined as a collection of IP subnets. Each network site must be associated with a network region. Tenant network site is used for Location Based Routing.
Unique identifier for the network site to be created.
Provide a description of the network site to identify purpose of creating it.
This parameter is used to assign a custom emergency calling policy to a network site
This parameter is used to assign a custom emergency call routing policy to a network site
This parameter determines whether the current site is enabled for location based routing.
LocationPolicy is the identifier for the location policy which the current network site is associating to.
NetworkRegionID is the identifier for the network region which the current network site is associating to.
NetworkRoamingPolicy is the identifier for the network roaming policy to which the network site will associate to.
The address of current network site.
Present ensures the instance exists, absent ensures it is removed.
As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkSubnet to define network subnets and assign them to network sites. Each internal subnet may only be associated with one site. Tenant network subnet is used for Location Based Routing.
This parameter determines the length of bits to mask to the subnet. IPv4 format subnet accepts maskbits from 0 to 32 inclusive. IPv6 format subnet accepts maskbits from 0 to 128 inclusive.
Unique identifier for the network subnet to be created.
Provide a description of the network subnet to identify purpose of creating it.
NetworkSiteID is the identifier for the network site which the current network subnet is associating to.
Present ensures the instance exists, absent ensures it is removed.
As an Admin, you can use the Windows PowerShell command, New-CsTenantTrustedIPAddress to define external subnets and assign them to the tenant. You can define an unlimited number of external subnets for a tenant.
Unique identifier for the IP address to be created.
Provide a description of the trusted IP address to identify purpose of creating it.
This parameter determines the length of bits to mask to the subnet.
Present ensures the instance exists, absent ensures it is removed.
Cmdlet to create a new telephone number manipulation rule.
The Identifier of the rule. This parameter is required and later used to assign the rule to the Inbound or Outbound Trunk Normalization policy.
A friendly description of the normalization rule.
A regular expression that caller or callee number must match in order for this rule to be applied.
The regular expression pattern that will be applied to the number to convert it.
Present ensures the instance exists, absent ensures it is removed.
Creates a new treatment for how calls to an unassigned number range should be routed. The call can be routed to a user, an application or to an announcement service where a custom message will be played to the caller.
The Id of the treatment.
Free format description of this treatment.
A regular expression that the called number must match in order for the treatment to take effect. It is best practice to start the regular expression with the hat character and end it with the dollar character. You can use various regular expression test sites on the Internet to validate the expression.
The identity of the destination the call should be routed to. Depending on the TargetType it should either be the ObjectId of the user or application instance/resource account or the AudioFileId of the uploaded audio file.
The type of target used for the treatment. Allowed values are User, ResourceAccount and Announcement.
The priority of the treatment. Used to distinguish identical patterns. The lower the priority the higher preference. The priority needs to be unique.
Present ensures the instance exists, absent ensures it is removed.
This resource configures the Teams Update policies. For additional information, please refer to https://docs.microsoft.com/en-us/MicrosoftTeams/public-preview-doc-updates#set-the-update-policy
Identity of the Teams Update Management Policy.
The description of the Teams Update Management Policy.
Determines if managed updates should be allowed or not.
Determines if preview builds should be allowed or not.
Determines the ring of public previews to subscribes to.
Determines the day of week to perform the updates. Value should be between 0 and 6.
Determines the time of day to perform the updates. Must be a valid HH:MM format string with leading 0. For instance 08:30.
Determines the time of day to perform the updates. Accepts a DateTime as string. Only the time will be considered.
Determines whether or not users will use the new Teams client.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the Teams Upgrade settings.
More information: https://docs.microsoft.com/en-us/MicrosoftTeams/migration-interop-guidance-for-teams-with-skype
Specifies the resource is a single instance, the value must be 'Yes'
The DownloadTeams property allows admins to control whether the Skype for Business client should automatically download Teams in the background. This Boolean setting is only honored on Windows clients, and only for certain values of the user's TeamsUpgradePolicy. If NotifySfbUser=true or if Mode=TeamsOnly in TeamsUpgradePolicy, this setting is honored. Otherwise it is ignored.
The SfBMeetingJoinUx property allows admins to specify which app is used to join Skype for Business meetings, even after the user has been upgraded to Teams. Allowed values are: 'SkypeMeetingsApp' and 'NativeLimitedClient'. 'NativeLimitedClient' means the existing Skype for Business rich client will be used, but since the user is upgraded, only meeting functionality is available. Calling and Messaging are done via Teams. 'SkypeMeetingsApp' means use the web-downloadable app. This setting can be useful for organizations that have upgraded to Teams and no longer want to install Skype for Business on their users' computers.
This resource configures the Teams Upgrade policies.
More information: https://docs.microsoft.com/en-us/microsoftteams/meetings-first#prepare-for-teams-meetings-in-meetings-first
Identity of the Teams Upgrade Policy.
List of users that will be granted the Upgrade Policy to.
Specifies whether to move existing Skype for Business meetings organized by the user to Teams. This parameter can only be true if the mode of the specified policy instance is either TeamsOnly or SfBWithTeamsCollabAndMeetings, and if the policy instance is being granted to a specific user. It not possible to trigger meeting migration when granting TeamsUpgradePolicy to the entire tenant.
This resource is used to add new users to a team
Team NAme
UPN of user to add to Team
User role in Team
Present ensures the Team user exists, absent ensures it is removed
This resource configures a Teams User's Calling Settings.
More information: https://learn.microsoft.com/en-us/microsoftteams/user-call-settings
The Identity of the user to set call forwarding, simultaneous ringing and call group settings for. Can be specified using the ObjectId or the SIP address.
The group notification override that will be set on the specified user. The supported values are Ring, Mute and Banner.
The order in which to call members of the Call Group. The supported values are Simultaneous and InOrder.
The members of the Call Group. You need to always specify the full set of members as the parameter value. What you set here will overwrite the current call group membership.
This parameter controls whether forwarding for unasnwered calls is enabled or not.
The time the call will ring the user before it is forwarded to the unanswered target. The supported format is hh:mm:ss and the delay range needs to be between 10 and 60 seconds in 10 seconds increments, i.e. 00:00:10, 00:00:20, 00:00:30, 00:00:40, 00:00:50 and 00:01:00. The default value is 20 seconds.
The unanswered target. Supported type of values are ObjectId, SIP address and phone number. For phone numbers we support the following types of formats: E.164 (+12065551234 or +1206555000;ext=1234) or non-E.164 like 1234.
The unanswered target type. Supported values are Voicemail, SingleTarget, MyDelegates and Group.
This parameter controls whether forwarding is enabled or not.
The type of forwarding to set. Supported values are Immediate and Simultaneous
The forwarding target type. Supported values are Voicemail, SingleTarget, MyDelegates and Group. Voicemail is only supported for Immediate forwarding.
The forwarding target. Supported types of values are ObjectId's, SIP addresses and phone numbers. For phone numbers we support the following types of formats: E.164 (+12065551234 or +1206555000;ext=1234) or non-E.164 like 1234.
Present ensures the policy exists, absent ensures it is removed.
This resource is used to assign Teams policy to a specified user.
User Principal Name of the user representing the policy assignments.
Name of the Calling Line Policy.
Name of the External Access Policy.
Name of the Online Voicemail Policy.
Name of the Online VOice Routing Policy.
Name of the Teams App Permission Policy.
Name of the Teams App Setup Policy.
Name of the Teams Audio Conferencing Policy.
Name of the Teams Call Hold Policy.
Name of the Teams Calling Policy.
Name of the Teams Call Park Policy.
Name of the Teams Channel Policy.
Name of the Teams Emergency Calling Policy.
Name of the Teams Emergency Call Routing Policy.
Name of the Teams Enhanced Encryption Policy.
Name of the Teams Events Policy.
Name of the Teams Meeting Broadcast Policy.
Name of the Teams Meeting Policy.
Name of the Teams Messaging Policy.
Name of the Teams Mobility Policy.
Name of the Teams Update Management Policy.
Name of the Teams Upgrade Policy.
Name of the Tenant Dial Plan Policy.
This resource implements Teams VDI Policies.
Unique identity of the VDI Policy.
Disables Audio and Video in Calls and Meeting.
Disables Calls and Meetings.
Present ensures the instance exists, absent ensures it is removed.
This resource configures a Teams Voice Route.
More information: https://docs.microsoft.com/en-us/microsoftteams/direct-routing-voice-routing
Identity of the Teams Voice Route.
A description of what this online voice route is for.
A regular expression that specifies the phone numbers to which this route applies. Numbers matching this pattern will be routed according to the rest of the routing settings.
This parameter contains a list of online gateways associated with this online voice route. Each member of this list must be the service Identity of the online PSTN gateway.
A list of online PSTN usages (such as Local, Long Distance, etc.) that can be applied to this online voice route. The PSTN usage must be an existing usage (PSTN usages can be retrieved by calling the Get-CsOnlinePstnUsage cmdlet).
A number could resolve to multiple online voice routes. The priority determines the order in which the routes will be applied if more than one route is possible.
Present ensures the route exists, absent ensures it is removed.
This resource configures a Teams Voice Routing Policy.
More information: https://docs.microsoft.com/en-us/microsoftteams/manage-voice-routing-policies
Identity of the Teams Voice Routing Policy.
A list of online PSTN usages (such as Local or Long Distance) that can be applied to this online voice routing policy. The online PSTN usage must be an existing usage (PSTN usages can be retrieved by calling the Get-CsOnlinePstnUsage cmdlet).
Enables administrators to provide explanatory text to accompany an online voice routing policy. For example, the Description might include information about the users the policy should be assigned to.
Present ensures the policy exists, absent ensures it is removed.
This resources implements a Teams workload policy.
Unique identity for the Teams workload policy
Allows calling.
Allows pinning a call.
Allows meetins.
Allows pinning meetings.
Allows messaging.
Allows pinning a message.
Description of the policy.
Present ensures the instance exists, absent ensures it is removed.
This resource configures or creates a new Team.
Display Name of the Team
Description of Team.
Team group ID, only used to target a Team when duplicated display names occurs.
MailNickName of O365 Group associated with Team
Owners of the Team
Visibility of the Team
Allow add or remove apps from the Team.
Allow giphy in Team.
Giphy content rating of the Team.
Allow stickers and mimes in the Team.
Allow custom memes in Team.
Allow members to edit messages within Team.
Allow members to delete messages within Team.
Allow owners to delete messages within Team.
Allow members to delete channels within Team.
Allow members to manage connectors within Team.
Allow members to manage tabs within Team.
Allow mentions in Team.
Allow channel mention in Team.
Allow guests to create and update channels in Team.
Allow guests to delete channel in Team.
Allow members to create and update channels within Team.
determines whether or not private teams should be searchable from Teams clients for users who do not belong to that team. Set to $false to make those teams not discoverable from Teams clients.
Present ensures the Team exists, absent ensures it is removed.
This resource configures an Intune Account Protection Local Administrator Password Solution Policy.
Display name of the account protection local administrator password solution policy.
Identity of the account protection local administrator password solution policy.
Description of the account protection local administrator password solution policy.
Assignments of the account protection local administrator password solution policy.
Configures which directory the local admin account password is backed up to. 0 - Disabled, 1 - Azure AD, 2 - AD
Configures the maximum password age of the managed local administrator account for Azure AD. Minimum - 7, Maximum - 365
Configures the maximum password age of the managed local administrator account for Active Directory. Minimum - 1, Maximum - 365
Configures additional enforcement of maximum password age for the managed local administrator account.
Configures how many previous encrypted passwords will be remembered in Active Directory. Minimum - 0, Maximum - 12
Configures whether the password is encrypted before being stored in Active Directory.
Configures the name or SID of a user or group that can decrypt the password stored in Active Directory.
Configures the name of the managed local administrator account.
Configures the password complexity of the managed local administrator account. 1 - Large letters, 2 - Large + small letters, 3 - Large + small letters + numbers, 4 - Large + small letters + numbers + special characters, 5 - Large letters + small letters + numbers + special characters (improved readability)
Configures the length of the password of the managed local administrator account. Minimum - 8, Maximum - 64
Specifies the actions to take upon expiration of the configured grace period. 1 - Reset password, 3 - Reset password and log off, 5 - Reset password and restart
Specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. Minimum - 0, Maximum - 24
Present ensures the policy exists, absent ensures it is removed
This resource configures a Intune Account Protection Local User Group Membership policy.
Display name of the account protection rules policy.
Identity of the account protection policy.
Description of the account protection rules policy.
Assignments of the Intune Policy.
Local User Group Collections of the Intune Policy.
Present ensures the site collection exists, absent ensures it is removed
This resource configures a Intune Account Protection policy.
Display name of the account protection rules policy.
Identity of the account protection policy.
Description of the account protection rules policy.
Assignments of the Intune Policy.
Block Windows Hello for Business.
Minimum PIN length must be between 4 and 127. (4-127)
Maximum PIN length must be between 4 and 127. (4-127)
If required, user PIN must include at least one lowercase letter.
If required, user PIN must include at least one uppercase letter.
If required, user PIN must include at least one special character.
If configured, the user will be forced to change their PIN after the set number of days. (0, 730), 0 = Never
If configured, the user will not be able to reuse this number of previous PINs. (0, 50), 0 = Do not remember.
If enabled, the PIN recovery secret will be stored on the device and the user can change their PIN if needed. If disabled or not configured, the recovery secret will not be created or stored.
If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business.
If allowed, Windows Hello for Business can authenticate using gestures, such as face and fingerprint. Users must still configure a PIN in case of failure.
If enabled, devices will use enhanced anti-spoofing, when available. If not configured, the client configuration for anti-spoofing will be honored.
If configured, Windows Hello for Business can use certificates to authenticate to on-premise resources.
Enable Windows Hello security key as a logon credential for all PCs in the tenant.
Setting this Disable will disable the use of Credential Guard, which is the Windows default. Setting this to Enable with UEFI lock will enable Credential Guard and not allow it to be disabled remotely, as the UEFI persisted configuration must be manually cleared. Setting this to Enable without UEFI lock will enable Credential Guard and allow it to be turned off without physical access to the machine.
Present ensures the site collection exists, absent ensures it is removed
This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device. This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.
Display name of the endpoint protection policy for Windows 10.
Identity of the endpoint protection policy for Windows 10.
Description of the endpoint protection policy for Windows 10.
Allows or disallows scanning of archives. (0: enable feature. 1: disable feature)
Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)
Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)
Disable the Clear TPM button in Windows Security. (0: disable feature. 1: enable feature)
Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. (0: disable feature. 1: enable feature)
Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. (0: disable feature. 1: enable feature)
Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. (0: disable feature. 1: enable feature)
Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)
Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. (0: disable feature. 1: enable feature)
Hide the recommendation to update TPM Firmware when a vulnerable firmware is detected. (0: disable feature. 1: enable feature)
Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)
Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center. (0: disable feature. 1: enable feature)
This policy setting hides the Windows Security notification area control. (0: disable feature. 1: enable feature)
Enable this policy to display your company name and contact options in the notifications. (0: disable feature. 1: enable feature)
Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. (0: disable feature. 1: enable feature)
The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization.
The email address that is displayed to users. The default mail application is used to initiate email actions.
The phone number or Skype ID that is displayed to users. Skype is used to initiate the call.
The help portal URL that is displayed to users. The default browser is used to initiate this action.
Allows or disallows scanning of archives. (0: disable feature. 1: enable feature)
Allows or disallows Windows Defender Behavior Monitoring functionality. (0: disable feature. 1: enable feature)
To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. (0: disable feature. 1: enable feature)
Allows or disallows Network Protection to enable datagram processing on Windows Server. (0: disable feature. 1: enable feature)
Allows or disallows scanning of email. (0: disable feature. 1: enable feature)
Allows or disallows a full scan of mapped network drives. (0: disable feature. 1: enable feature)
Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned. (0: disable feature. 1: enable feature)
https://github.com/MicrosoftDocs/memdocs/issues/2250 (0: disable feature. 1: enable feature)
Allows or disallows Windows Defender IOAVP Protection functionality. (0: disable feature. 1: enable feature)
Allows or disallows Network Protection to be configured into block or audit mode on windows downlevel of RS3. (0: disable feature. 1: enable feature)
Allows or disallows Windows Defender real-time Monitoring functionality. (0: disable feature. 1: enable feature)
Allows or disallows a scanning of network files. (0: disable feature. 1: enable feature)
Allows or disallows Windows Defender Script Scanning functionality. (0: disable feature. 1: enable feature)
Allows or disallows user access to the Windows Defender UI. I disallowed, all Windows Defender notifications will also be suppressed. (0: Prevents users from accessing UI. 1: Lets users access UI)
Represents the average CPU load factor for the Windows Defender scan (in percent).
Specify the maximum folder depth to extract from archive files for scanning.
Specify the maximum size, in KB, of archive files to be extracted and scanned.
This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. (0: disable feature. 1: enable feature)
This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer.(0: Default windows defender blocking level, 2: High blocking level, 4:High+ blocking level, 6:Zero tolerance blocking level)
This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50.
Time period (in days) that quarantine items will be stored on the system.
This policy setting allows you to configure catch-up scans for scheduled full scans. (1: disabled, 0: enabled)
This policy setting allows you to configure catch-up scans for scheduled quick scans. (1: disabled, 0: enabled)
Disables or enables DNS over TCP Parsing for Network Protection. (0: enable feature. 1: disable feature)
Disables or enables HTTP Parsing for Network Protection. (0: enable feature. 1: disable feature)
Disable Ssh Parsing (1: SSH parsing is disabled, 0: SSH parsing is enabled)
This policy setting allows you to enable or disable low CPU priority for scheduled scans. (0: disable feature. 1: enable feature)
This policy allows you to turn on network protection (block/audit) or off. (0: disabled, 1: block mode, 2: audit mode)
Allows an administrator to specify a list of file type extensions to ignore during a scan.
Allows an administrator to specify a list of directory paths to ignore during a scan.
Allows an administrator to specify a list of files opened by processes to ignore during a scan.
Specifies the level of detection for potentially unwanted applications (PUAs). (0: disabled, 1: block mode, 2: audit mode)
Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. (0: Not configured, 2: Beta Channel, 3: Current Channel (Preview), 4: Current Channel (Staged), 5: Current Channel (Broad), 6: Critical)
Allow managed devices to update through metered connections. (0: disabled, 1: enabled)
Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. (0: Not configured, 2: Beta Channel, 3: Current Channel (Preview), 4: Current Channel (Staged), 5: Current Channel (Broad), 6: Critical)
Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout. (0: Not configured, 4: Current Channel (Staged), 5: Current Channel (Broad))
Controls which sets of files should be monitored. (0: Monitor all files (bi-directional), 1: Monitor incoming files, 2: Monitor outgoing files)
Selects whether to perform a quick scan or full scan. (1: Quick scan, 2: Full scan)
Selects the time of day that the Windows Defender quick scan should run.
Selects the day that the Windows Defender scan should run. (0: Every day, 1: Sunday, 2: Monday, 3: Tuesday, 4: Wednesday, 5: Thursday, 6: Friday, 7: Saturday, 8: No scheduled scan)
Selects the time of day that the Windows Defender scan should run. Must be between 0 and 1380 minutes.
This setting disables TLS Parsing for Network Protection. (0: enabled, 1: disabled)
Specifies if the start time of the scan is randomized. (0: no randomization, 1: randomized)
This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours.
This policy setting allows you to define the order in which different definition update sources should be contacted.
This policy setting allows you to configure UNC file share sources for downloading definition updates.
Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. Must be between 0 and 24 hours.
Checks for the user consent level in Windows Defender to send data. (0: Always prompt, 1: Send safe samples automatically, 2: Never send, 3: Send all samples automatically)
This policy setting controls whether or not complex list settings configured by a local administrator are merged with managed settings. (0: enable local admin merge, 1: disable local admin merge)
Allows or disallows Windows Defender On Access Protection functionality. (0: disable feature. 1: enable feature)
Allows an administrator to specify low severity threats corresponding action ID to take.
Allows an administrator to specify moderate severity threats corresponding action ID to take.
Allows an administrator to specify high severity threats corresponding action ID to take.
Allows an administrator to specify severe threats corresponding action ID to take.
Template Id of the policy. 0: Windows Security Experience, 1: Defender Update controls, 2: Microsoft Defender Antivirus exclusions, 3: Microsoft Defender Antivirus
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed
This resource configures the Intune App configuration policies.
Display name of the app configuration policy.
Key of the entity. Read-Only.
Description of the app configuration policy.
Assignments of the Intune Policy.
Custom settings for the app configuration policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures a Intune Endpoint Protection Application Control policy for an Windows 10 Device.
Display name of the endpoint protection application control policy for Windows 10.
Description of the endpoint protection application control policy for Windows 10.
Assignments of the Intune Policy.
App locker application control mode
Indicates whether or not SmartScreen will not present an option for the user to disregard the warning and run the app.
Enforce the use of SmartScreen for all users.
Present ensures the site collection exists, absent ensures it is removed
This resource configures an Intune app protection policy for an Android Device.
Display name of the Android App Protection Policy.
Description of the Android App Protection Policy.
The period after which access is checked when the device is not connected to the internet.
The period after which access is checked when the device is connected to the internet.
Sources from which data is allowed to be transferred. Possible values are: allApps, managedApps, none.
Destinations to which data is allowed to be transferred. Possible values are: allApps, managedApps, none.
Indicates whether organizational credentials are required for app use.
The level to which the clipboard may be shared between apps on the managed device. Possible values are: allApps, managedAppsWithPasteIn, managedApps, blocked.
Indicates whether the backup of a managed app's data is blocked.
Indicates whether device compliance is required.
Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for Android) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android).
Indicates whether users may use the Save As menu item to save a copy of protected files.
The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped.
Indicates whether an app-level pin is required.
Indicates whether use of the app pin is required if the device pin is set.
Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped.
Block simple PIN and require complex PIN to be set.
Minimum pin length required for an app-level pin if PinRequired is set to True.
Character set which may be used for an app-level pin if PinRequired is set to True. Possible values are: numeric, alphanumericAndSymbol.
Data storage locations where a user may store managed data.
Indicates whether contacts can be synced to the user's device.
TimePeriod before the all-level pin must be reset if PinRequired is set to True.
Indicates whether printing is allowed from managed apps.
Require user to apply Class 3 Biometrics on their Android device.
A PIN prompt will override biometric prompts if class 3 biometrics are updated on the device.
Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True.
List of IDs representing the Android apps controlled by this protection policy.
List of IDs of the groups assigned to this Android Protection Policy.
List of IDs of the groups that are excluded from this Android Protection Policy.
Present ensures the policy exists, absent ensures it is removed.
Indicates in which managed browser(s) that internet links should be opened. Used in conjunction with CustomBrowserPackageId, CustomBrowserDisplayName and ManagedBrowserToOpenLinksRequired. Possible values are: notConfigured, microsoftEdge.
Versions less than the specified version will block the managed app from accessing company data.
Versions less than the specified version will block the managed app from accessing company data.
Versions less than the specified version will block the managed app from accessing company data.
Versions less than the specified version will result in warning message on the managed app
Versions less than the specified version will result in warning message on the managed app
Versions less than the specified version will result in warning message on the managed app
The apps controlled by this protection policy, overrides any values in Apps unless this value is 'selectedPublicApps'.
Indicates if the policy is deployed to any inclusion groups or not. Inherited from targetedManagedAppProtection.
Indicates whether or not to Block the user from taking Screenshots.
Indicates whether or not the 'Encrypt org data' value is enabled. True = require
Indicates whether or not the 'Encrypt org data on enrolled devices' value is enabled. False = require. Only functions if EncryptAppData is set to True
The application name for browser associated with the 'Unmanaged Browser ID'. This name will be displayed to users if the specified browser is not installed.
The application ID for a single browser. Web content (http/s) from policy managed applications will open in the specified browser.
Id of the Intune policy. To avoid creation of duplicate policies DisplayName will be searched for if the ID is not found
This resource configures an Intune app protection policy for an iOS Device.
Display name of the iOS App Protection Policy.
Identity of the iOS App Protection Policy.
Description of the iOS App Protection Policy.
The period after which access is checked when the device is not connected to the internet.
The period after which access is checked when the device is connected to the internet.
Sources from which data is allowed to be transferred. Possible values are: allApps, managedApps, none.
Destinations to which data is allowed to be transferred. Possible values are: allApps, managedApps, none.
Indicates whether organizational credentials are required for app use.
The level to which the clipboard may be shared between apps on the managed device. Possible values are: allApps, managedAppsWithPasteIn, managedApps, blocked.
Indicates whether the backup of a managed app's data is blocked.
Indicates whether device compliance is required.
Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for iOS) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android).
Indicates whether users may use the Save As menu item to save a copy of protected files.
The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped.
Indicates whether an app-level pin is required.
Indicates whether use of the app pin is required if the device pin is set.
Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped.
Block simple PIN and require complex PIN to be set.
Minimum pin length required for an app-level pin if PinRequired is set to True.
Character set which may be used for an app-level pin if PinRequired is set to True. Possible values are: numeric, alphanumericAndSymbol.
Data storage locations where a user may store managed data.
Indicates whether contacts can be synced to the user's device.
TimePeriod before the all-level pin must be reset if PinRequired is set to True.
Indicates whether printing is allowed from managed apps.
Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True.
Indicates whether use of the FaceID is allowed in place of a pin if PinRequired is set to True.
Indicates in which managed browser(s) that internet links should be opened. When this property is configured, ManagedBrowserToOpenLinksRequired should be true. Possible values are: notConfigured, microsoftEdge.
Versions less than the specified version will block the managed app from accessing company data.
Versions less than the specified version will result in warning message on the managed app from accessing company data.
Versions less than the specified version will block the managed app from accessing company data.
Versions less than the specified version will result in warning message on the managed app from accessing company data.
Versions less than the specified version will block the managed app from accessing company data.
Versions less than or equal to the specified version will wipe the managed app and the associated company data.
Versions less than or equal to the specified version will wipe the managed app and the associated company data.
Defines a managed app behavior, either block or wipe, when the device is either rooted or jailbroken, if DeviceComplianceRequired is set to true.
Defines a managed app behavior, either block or wipe, based on maximum number of incorrect pin retry attempts.
Timeout in minutes for an app pin instead of non biometrics passcode .
Specify the number of characters that may be cut or copied from Org data and accounts to any application. This setting overrides the AllowedOutboundClipboardSharingLevel restriction. Default value of '0' means no exception is allowed.
Specify app notification restriction.
The intended app management levels for this policy.
Require app data to be encrypted.
Apps in this list will be exempt from the policy and will be able to receive data from managed apps.
Versions less than the specified version will block the managed app from accessing company data.
Semicolon separated list of device models allowed, as a string, for the managed app to work.
Defines a managed app behavior, either block or wipe, if the specified device model is not allowed.
Defines if open-in operation is supported from the managed app to the filesharing locations selected. This setting only applies when AllowedOutboundDataTransferDestinations is set to ManagedApps and DisableProtectionOfManagedOutboundOpenInData is set to False.
Disable protection of data transferred to other apps through IOS 'OpenIn' option. This setting is only allowed to be True when AllowedOutboundDataTransferDestinations is set to ManagedApps.
Protect incoming data from unknown source. This setting is only allowed to be True when AllowedInboundDataTransferSources is set to AllApps.
A custom browser protocol to open weblink on iOS.
List of IDs representing the iOS apps controlled by this protection policy.
List of IDs of the groups assigned to this iOS Protection Policy.
List of IDs of the groups that are excluded from this iOS Protection Policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures a Intune Endpoint Protection Attack Surface Reduction rules policy for a Windows 10 Device. This resource returns ASR rules created using deviceConfiguration Graph settings.
Display name of the endpoint protection attack surface protection rules policy for Windows 10.
Identity of the endpoint protection attack surface protection rules policy for Windows 10.
Description of the endpoint protection attack surface protection rules policy for Windows 10.
Assignments of the Intune Policy.
This rule blocks processes created through PsExec and WMI from running.
This rule provides an extra layer of protection against ransomware.
This rule prevents malware from abusing WMI to attain persistence on a device.
This rule detects suspicious properties within an obfuscated script.
This rule prevents VBA macros from calling Win32 APIs.
This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.
This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps.
With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.
Exclude files and paths from attack surface reduction rules
This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.
This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.
This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.
This rule prevents scripts from launching potentially malicious downloaded content.
List of additional folders that need to be protected
This rule prevents attacks by blocking Adobe Reader from creating processes.
This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.
This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).
This rule blocks code injection attempts from Office apps into other processes.
List of apps that have access to protected folders.
Present ensures the site collection exists, absent ensures it is removed
This resource configures an Intune Endpoint Protection Attack Surface Reduction Rules policy for a Windows 10 Device for Configuration Manager. This policy setting enables setting the state (Block/Audit/Off/Warn) for each attack surface reduction (ASR) rule. Each ASR rule listed can be set to one of the following states (Block/Audit/Off/Warn). The ASR rule ID and state should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid ASR rule ID, while the value contains the status ID indicating the status of the rule.
For more information about ASR rule ID and status ID, see Enable Attack Surface Reduction: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.
Display name of the endpoint protection attack surface protection rules policy for Windows 10.
Identity of the endpoint protection attack surface protection rules policy for Windows 10.
Description of the endpoint protection attack surface protection rules policy for Windows 10.
Assignments of the endpoint protection attack surface protection rules policy for Windows 10.
Exclude files and paths from attack surface reduction rules
This rule prevents an application from writing a vulnerable signed driver to disk.
This rule prevents attacks by blocking Adobe Reader from creating processes.
This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.
This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).
This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.
This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.
This rule detects suspicious properties within an obfuscated script.
This rule prevents scripts from launching potentially malicious downloaded content.
This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.
This rule blocks code injection attempts from Office apps into other processes.
This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.
This rule prevents malware from abusing WMI to attain persistence on a device.
This rule blocks processes created through PsExec and WMI from running.
With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.
This rule prevents VBA macros from calling Win32 APIs.
This rule provides an extra layer of protection against ransomware.
List of additional folders that need to be protected
List of apps that have access to protected folders.
This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps.values 0:disable, 1:enable, 2:audit, 3: Block disk modification only, 4: Audit disk modification only
Present ensures the policy exists, absent ensures it is removed
This resource represents the properties of the Intune Assignment Filter. For more information: https://docs.microsoft.com/en-us/graph/api/resources/intune-policyset-deviceandappmanagementassignmentfilter?view=graph-rest-beta
DisplayName of the Assignment Filter.
Key of the Assignment Filter.
Description of the Assignment Filter.
Rule definition of the Assignment Filter.
Present ensures the policy exists, absent ensures it is removed
This resource configures the Intune device categories.
Display name of the device category.
Description of the device category.
Present ensures the category exists, absent ensures it is removed.
This resource configures the Intune device cleanup rule.
Only valid value is 'Yes'.
Indicates whether the cleanup rule is enabled.
Number of days until Intune devices are deleted. Minimum: 30, Maximum: 270.
Present ensures the category exists, absent ensures it is removed.
This resource configures the settings of Android device compliance policies in your cloud-based organization.
Parameters
Microsoft Defender for Endpoint
- Require the device to be at or under the machine risk score
Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices that exceed this score get marked as noncompliant.
- Not configured (default)
- Clear
- Low
- Medium
- High
Device Health
- Devices managed with device administrator
Device administrator capabilities are superseded by Android Enterprise.
- Not configured (default)
- Block - Blocking device administrator will guide users to move to Android Enterprise Personally-Owned and Corporate-Owned Work Profile management to regain access.
Rooted devices
-
Prevent rooted devices from having corporate access. (This compliance check is supported for Android 4.0 and above.)
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Mark rooted (jailbroken) devices as not compliant.
-
Require the device to be at or under the Device Threat Level Use this setting to take the risk assessment from a connected Mobile Threat Defense service as a condition for compliance.
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Secured - This option is the most secure, as the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.
- Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.
- Medium - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.
- High - This option is the least secure, and allows all threat levels. It may be useful if you're using this solution only for reporting purposes.
Google Play Protect
-
Google Play Services is configured Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require that the Google Play services app is installed and enabled.
-
Up-to-date security provider
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.
-
Threat scan on apps
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require that the Android Verify Apps feature is enabled.
-
SafetyNet device attestation Enter the level of SafetyNet attestation that must be met. Your options:
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Check basic integrity
- Check basic integrity & certified devices
Device Properties
-
Operating System Version
- Minimum OS version When a device doesn't meet the minimum OS version requirement, it's reported as noncompliant. A link with information about how to upgrade is shown. The end user can choose to upgrade their device, and then get access to company resources.
By default, no version is configured.
- Maximum OS version When a device is using an OS version later than the version specified in the rule, access to company resources is blocked. The user is asked to contact their IT admin. Until a rule is changed to allow the OS version, this device can't access company resources.
By default, no version is configured.
System Security
-
Encryption Encryption of data storage on a device Supported on Android 4.0 and later, or KNOX 4.0 and later.
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Encrypt data storage on your devices. Devices are encrypted when you choose the Require a password to unlock mobile devices setting.
-
Device Security Block apps from unknown sources Supported on Android 4.0 to Android 7.x. Not supported by Android 8.0 and later
- Not configured (default) - this setting isn't evaluated for compliance or non-compliance.
- Block - Block devices with Security > Unknown Sources enabled sources (supported on Android 4.0 through Android 7.x. Not supported on Android 8.0 and later.).
To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy.
-
Company portal app runtime integrity
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Choose Require to confirm the Company Portal app meets all the following requirements:
- Has the default runtime environment installed
- Is properly signed
- Isn't in debug-mode
-
Block USB debugging on device (Supported on Android 4.2 or later)
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Prevent devices from using the USB debugging feature.
-
Minimum security patch level (Supported on Android 6.0 or later)
Select the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.
By default, no date is configured.
-
Restricted apps Enter the App name and App bundle ID for apps that should be restricted, and then select Add. A device with at least one restricted app installed is marked as non-compliant.
Password
The available settings for passwords vary by the version of Android on the device.
All Android devices
The following settings are supported on Android 4.0 or later, and Knox 4.0 and later.
- Maximum minutes of inactivity before password is required
This setting specifies the length of time without user input after which the mobile device screen is locked. Options range from 1 Minute to 8 Hours. The recommended value is 15 Minutes.
- Not configured (default)
Android 10 and later
The following settings are supported on Android 10 or later, but not on Knox.
-
Password complexity This setting is supported on Android 10 or later, but not on Samsung Knox. On devices that run Android 9 and earlier or Samsung Knox, settings for the password length and type override this setting for complexity.
Specify the required password complexity.
- None (default) - No password required.
- Low - The password satisfies one of the following conditions:
- Pattern
- Numeric PIN has a repeating (4444) or ordered (1234, 4321, 2468) sequence.
- Medium - The password satisfies one of the following conditions:
- Numeric PIN doesn’t have a repeating (4444) or ordered (1234, 4321, 2468) sequence, and has minimum length of 4.
- Alphabetic, with a minimum length of 4.
- Alphanumeric, with a minimum length of 4.
- High - The password satisfies one of the following conditions:
- Numeric PIN doesn’t have a repeating (4444) or ordered (1234, 4321, 2468) sequence, and has minimum length of 8.
- Alphabetic, with a minimum length of 6.
- Alphanumeric, with a minimum length of 6.
Android 9 and earlier or Samsung Knox
The following settings are supported on Android 9.0 and earlier, and any version of Samsung Knox.
- Require a password to unlock mobile devices
This setting specifies whether to require users to enter a password before access is granted to information on their mobile devices. Recommended value: Require
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Users must enter a password before they can access their device.
When set to Require, the following setting can be configured:
-
Required password type Choose if a password should include only numeric characters, or a mix of numerals and other characters.
- Device Default - To evaluate password compliance, be sure to select a password strength other than Device default.
- Low security biometric
- At least numeric
- Numeric complex - Repeated or consecutive numerals, such as 1111 or 1234, aren't allowed.
- At least alphabetic
- At least alphanumeric
- At least alphanumeric with symbols
Based on the configuration of this setting, one or more of the following options are available:
- Minimum password length Enter the minimum number of digits or characters that the user's password must have.
- Maximum minutes of inactivity before password is required Enter the idle time before the user must reenter their password. When you choose Not configured (default), this setting isn't evaluated for compliance or non-compliance.
- Number of days until password expires Select the number of days before the password expires and the user must create a new password.
- Number of previous passwords to prevent reuse Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.
Display name of the Android device compliance policy.
Description of the Android device compliance policy.
Assignments of the Intune Policy.
PasswordRequired of the Android device compliance policy.
PasswordMinimumLength of the Android device compliance policy.
PasswordRequiredType of the Android device compliance policy.
RequiredPasswordComplexity of the Android device compliance policy.
PasswordMinutesOfInactivityBeforeLock of the Android device compliance policy.
PasswordExpirationDays of the Android device compliance policy.
PasswordPreviousPasswordBlockCount of the Android device compliance policy.
PasswordSignInFailureCountBeforeFactoryReset of the Android device compliance policy.
SecurityPreventInstallAppsFromUnknownSources of the Android device compliance policy.
SecurityDisableUsbDebugging of the Android device compliance policy.
SecurityRequireVerifyApps of the Android device compliance policy.
DeviceThreatProtectionEnabled of the Android device compliance policy.
DeviceThreatProtectionRequiredSecurityLevel of the Android device compliance policy.
AdvancedThreatProtectionRequiredSecurityLevel of the Android device compliance policy.
SecurityBlockJailbrokenDevices of the Android device compliance policy.
SecurityBlockDeviceAdministratorManagedDevices of the Android device compliance policy.
OsMinimumVersion of the Android device compliance policy.
OsMaximumVersion of the Android device compliance policy.
MinAndroidSecurityPatchLevel of the Android device compliance policy.
StorageRequireEncryption of the Android device compliance policy.
SecurityRequireSafetyNetAttestationBasicIntegrity of the Android device compliance policy.
SecurityRequireSafetyNetAttestationCertifiedDevice of the Android device compliance policy.
SecurityRequireGooglePlayServices of the Android device compliance policy.
SecurityRequireUpToDateSecurityProviders of the Android device compliance policy.
SecurityRequireCompanyPortalAppIntegrity of the Android device compliance policy.
ConditionStatementId of the Android device compliance policy.
RestrictedApps of the Android device compliance policy.
RoleScopeTagIds of the Android device compliance policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the settings of Android Work Profile device compliance policies in your cloud-based organization.
Parameters
Microsoft Defender for Endpoint - for Personally-Owned Work Profile
- Require the device to be at or under the machine risk score
Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices which exceed this score get marked as noncompliant.
- Not configured (default)
- Clear
- Low
- Medium
- High
Device Health - for Personally-Owned Work Profile
-
Rooted devices
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Mark rooted (jailbroken) devices as not compliant.
-
Require the device to be at or under the Device Threat Level Select the maximum allowed device threat level evaluated by your mobile threat defense service. Devices that exceed this threat level are marked noncompliant. To use this setting, choose the allowed threat level:
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Secured - This option is the most secure, and means that the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.
- Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.
- Medium - The device is evaluated as compliant if the threats that are present on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.
- High - This option is the least secure, as it allows all threat levels. It may be useful if you're using this solution only for reporting purposes.
Google Play Protect - for Personally-Owned Work Profile
-
Google Play Services is configured
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require that the Google Play services app is installed and enabled. Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.
-
Up-to-date security provider
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.
-
SafetyNet device attestation Enter the level of SafetyNet attestation that must be met. Your options:
- Not configured (default) - Setting isn't evaluated for compliance or non-compliance.
- Check basic integrity
- Check basic integrity & certified devices
Note:
- On Android Enterprise devices, Threat scan on apps is a device configuration policy. Using a configuration policy, administrators can enable the setting on a device. See Android Enterprise device restriction settings.
Device Properties - for Personally-Owned Work Profile
-
Operating System Version - for Personally-Owned Work Profile
- Minimum OS version When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The end user can upgrade their device, and then access organization resources.
By default, no version is configured.
-
Maximum OS version When a device is using an OS version later than the version in the rule, access to organization resources is blocked. The user is asked to contact their IT administrator. Until a rule is changed to allow the OS version, this device can't access organization resources.
By default, no version is configured.
System security - for Personally-Owned Work Profile
-
Require a password to unlock mobile devices
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Users must enter a password before they can access their device.
This setting applies at the device level. If you only need to require a password at the Personally-Owned Work Profile level, then use a configuration policy. See Android Enterprise device configuration settings.
-
Required password type Choose if a password should include only numeric characters, or a mix of numerals and other characters. Your options:
- Device Default
- Low security biometric
- At least numeric (default): Enter the minimum password length a user must enter, between 4 and 16 characters.
- Numeric complex: Enter the minimum password length a user must enter, between 4 and 16 characters.
- At least alphabetic: Enter the minimum password length a user must enter, between 4 and 16 characters.
- At least alphanumeric: Enter the minimum password length a user must enter, between 4 and 16 characters.
- At least alphanumeric with symbols: Enter the minimum password length a user must enter, between 4 and 16 characters.
Depending on the password type you select, the following settings are available:
- Maximum minutes of inactivity before password is required Enter the idle time before the user must reenter their password. Options include the default of Not configured, and from 1 Minute to 8 hours.
- Number of days until password expires Enter the number of days, between 1-365, until the device password must be changed. For example, to change the password after 60 days, enter 60. When the password expires, users are prompted to create a new password.
- Minimum password length Enter the minimum length the password must have, between 4 and 16 characters.
- Number of previous passwords to prevent reuse Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.
Encryption - for Personally-Owned Work Profile
-
Encryption of data storage on device
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Encrypt data storage on your devices.
You don't have to configure this setting because Android Enterprise devices enforce encryption.
Device Security - for Personally-Owned Work Profile
-
Block apps from unknown sources
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Block devices with Security > Unknown Sources enabled sources (supported on Android 4.0 through Android 7.x. Not supported by Android 8.0 and later).
To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy.
-
Company portal app runtime integrity
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Choose Require to confirm the Company Portal app meets all the following requirements:
- Has the default runtime environment installed
- Is properly signed
- Isn't in debug-mode
- Is installed from a known source
-
Block USB debugging on device
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Prevent devices from using the USB debugging feature.
You don't have to configure this setting because USB debugging is already disabled on Android Enterprise devices.
- Minimum security patch level Select the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.
By default, no date is configured.
Display name of the Android Device Owner device compliance policy.
Description of the Android Device Owner device compliance policy.
Assignments of the Intune Policy.
DeviceThreatProtectionEnabled of the Android Device Owner device compliance policy.
DeviceThreatProtectionRequiredSecurityLevel of the Android Device Owner device compliance policy.
AdvancedThreatProtectionRequiredSecurityLevel of the Android Device Owner device compliance policy.
SecurityRequireSafetyNetAttestationBasicIntegrity of the Android Device Owner device compliance policy.
SecurityRequireSafetyNetAttestationCertifiedDevice of the Android Device Owner device compliance policy.
osMinimumVersion of the Android Device Owner device compliance policy.
osMaximumVersion of the Android Device Owner device compliance policy.
PasswordRequired of the Android Device Owner device compliance policy.
PasswordMinimumLength of the Android Device Owner device compliance policy.
PasswordRequiredType of the Android Device Owner device compliance policy.
PasswordMinutesOfInactivityBeforeLock of the Android Device Owner device compliance policy.
PasswordExpirationDays of the Android Device Owner device compliance policy.
PasswordPreviousPasswordCountToBlock of the Android Device Owner device compliance policy.
StorageRequireEncryption of the Android Device Owner device compliance policy.
SecurityRequireIntuneAppIntegrity of the Android Device Owner device compliance policy.
List of Scope Tags for this Entity instance. Inherited from deviceConfiguration
Present ensures the policy exists, absent ensures it is removed
This resource configures the settings of Android Work Profile device compliance policies in your cloud-based organization.
Parameters
Microsoft Defender for Endpoint - for Personally-Owned Work Profile
- Require the device to be at or under the machine risk score
Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices which exceed this score get marked as noncompliant.
- Not configured (default)
- Clear
- Low
- Medium
- High
Device Health - for Personally-Owned Work Profile
-
Rooted devices
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Mark rooted (jailbroken) devices as not compliant.
-
Require the device to be at or under the Device Threat Level Select the maximum allowed device threat level evaluated by your mobile threat defense service. Devices that exceed this threat level are marked noncompliant. To use this setting, choose the allowed threat level:
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Secured - This option is the most secure, and means that the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.
- Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.
- Medium - The device is evaluated as compliant if the threats that are present on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.
- High - This option is the least secure, as it allows all threat levels. It may be useful if you're using this solution only for reporting purposes.
Google Play Protect - for Personally-Owned Work Profile
-
Google Play Services is configured
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require that the Google Play services app is installed and enabled. Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.
-
Up-to-date security provider
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.
-
SafetyNet device attestation Enter the level of SafetyNet attestation that must be met. Your options:
- Not configured (default) - Setting isn't evaluated for compliance or non-compliance.
- Check basic integrity
- Check basic integrity & certified devices
Note:
- On Android Enterprise devices, Threat scan on apps is a device configuration policy. Using a configuration policy, administrators can enable the setting on a device. See Android Enterprise device restriction settings.
Device Properties - for Personally-Owned Work Profile
-
Operating System Version - for Personally-Owned Work Profile
- Minimum OS version When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The end user can upgrade their device, and then access organization resources.
By default, no version is configured.
-
Maximum OS version When a device is using an OS version later than the version in the rule, access to organization resources is blocked. The user is asked to contact their IT administrator. Until a rule is changed to allow the OS version, this device can't access organization resources.
By default, no version is configured.
System security - for Personally-Owned Work Profile
-
Require a password to unlock mobile devices
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Users must enter a password before they can access their device.
This setting applies at the device level. If you only need to require a password at the Personally-Owned Work Profile level, then use a configuration policy. See Android Enterprise device configuration settings.
-
Required password type Choose if a password should include only numeric characters, or a mix of numerals and other characters. Your options:
- Device Default
- Low security biometric
- At least numeric (default): Enter the minimum password length a user must enter, between 4 and 16 characters.
- Numeric complex: Enter the minimum password length a user must enter, between 4 and 16 characters.
- At least alphabetic: Enter the minimum password length a user must enter, between 4 and 16 characters.
- At least alphanumeric: Enter the minimum password length a user must enter, between 4 and 16 characters.
- At least alphanumeric with symbols: Enter the minimum password length a user must enter, between 4 and 16 characters.
Depending on the password type you select, the following settings are available:
- Maximum minutes of inactivity before password is required Enter the idle time before the user must reenter their password. Options include the default of Not configured, and from 1 Minute to 8 hours.
- Number of days until password expires Enter the number of days, between 1-365, until the device password must be changed. For example, to change the password after 60 days, enter 60. When the password expires, users are prompted to create a new password.
- Minimum password length Enter the minimum length the password must have, between 4 and 16 characters.
- Number of previous passwords to prevent reuse Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.
Encryption - for Personally-Owned Work Profile
-
Encryption of data storage on device
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Encrypt data storage on your devices.
You don't have to configure this setting because Android Enterprise devices enforce encryption.
Device Security - for Personally-Owned Work Profile
-
Block apps from unknown sources
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Block devices with Security > Unknown Sources enabled sources (supported on Android 4.0 through Android 7.x. Not supported by Android 8.0 and later).
To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy.
-
Company portal app runtime integrity
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Choose Require to confirm the Company Portal app meets all the following requirements:
- Has the default runtime environment installed
- Is properly signed
- Isn't in debug-mode
- Is installed from a known source
-
Block USB debugging on device
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Block - Prevent devices from using the USB debugging feature.
You don't have to configure this setting because USB debugging is already disabled on Android Enterprise devices.
- Minimum security patch level Select the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.
By default, no date is configured.
Display name of the AndroidWorkProfile device compliance policy.
Description of the AndroidWorkProfile device compliance policy.
Assignments of the Intune Policy.
PasswordRequired of the AndroidWorkProfile device compliance policy.
PasswordMinimumLength of the AndroidWorkProfile device compliance policy.
PasswordRequiredType of the AndroidWorkProfile device compliance policy.
PasswordMinutesOfInactivityBeforeLock of the AndroidWorkProfile device compliance policy.
PasswordExpirationDays of the AndroidWorkProfile device compliance policy.
PasswordPreviousPasswordBlockCount of the AndroidWorkProfile device compliance policy.
PasswordSignInFailureCountBeforeFactoryReset of the AndroidWorkProfile device compliance policy.
SecurityPreventInstallAppsFromUnknownSources of the AndroidWorkProfile device compliance policy.
SecurityDisableUsbDebugging of the AndroidWorkProfile device compliance policy.
SecurityRequireVerifyApps of the AndroidWorkProfile device compliance policy.
DeviceThreatProtectionEnabled of the AndroidWorkProfile device compliance policy.
DeviceThreatProtectionRequiredSecurityLevel of the AndroidWorkProfile device compliance policy.
AdvancedThreatProtectionRequiredSecurityLevel of the AndroidWorkProfile device compliance policy.
SecurityBlockJailbrokenDevices of the AndroidWorkProfile device compliance policy.
OsMinimumVersion of the AndroidWorkProfile device compliance policy.
OsMaximumVersion of the AndroidWorkProfile device compliance policy.
MinAndroidSecurityPatchLevel of the AndroidWorkProfile device compliance policy.
StorageRequireEncryption of the AndroidWorkProfile device compliance policy.
SecurityRequireSafetyNetAttestationBasicIntegrity of the AndroidWorkProfile device compliance policy.
SecurityRequireSafetyNetAttestationCertifiedDevice of the AndroidWorkProfile device compliance policy.
SecurityRequireGooglePlayServices of the AndroidWorkProfile device compliance policy.
SecurityRequireUpToDateSecurityProviders of the AndroidWorkProfile device compliance policy.
SecurityRequireCompanyPortalAppIntegrity of the AndroidWorkProfile device compliance policy.
Require a specific SafetyNet evaluation type for compliance.
RoleScopeTagIds of the AndroidWorkProfile device compliance policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the Intune compliance policies for iOs devices.
Display name of the iOS device compliance policy.
Description of the iOS device compliance policy.
Assignments of the Intune Policy.
PasscodeBlockSimple of the iOS device compliance policy.
PasscodeExpirationDays of the iOS device compliance policy.
PasscodeMinimumLength of the iOS device compliance policy.
PasscodeMinutesOfInactivityBeforeLock of the iOS device compliance policy.
Minutes of inactivity before the screen times out.
PasscodePreviousPasscodeBlockCount of the iOS device compliance policy.
PasscodeMinimumCharacterSetCount of the iOS device compliance policy.
PasscodeRequiredType of the iOS device compliance policy.
PasscodeRequired of the iOS device compliance policy.
OsMinimumVersion of the iOS device compliance policy.
OsMaximumVersion of the iOS device compliance policy.
Minimum IOS build version.
Maximum IOS build version.
SecurityBlockJailbrokenDevices of the iOS device compliance policy.
DeviceThreatProtectionEnabled of the iOS device compliance policy.
Require Mobile Threat Protection minimum risk level to report noncompliance.
MDATP Require Mobile Threat Protection minimum risk level to report noncompliance.
ManagedEmailProfileRequired of the iOS device compliance policy.
Credentials of the Intune Admin
Present ensures the policy exists, absent ensures it is removed.
This resource configures the settings of MacOS compliance policies in your cloud-based organization.
Parameters
Device Health
- Require a system integrity protection
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Require macOS devices to have System Integrity Protection enabled.
Device Properties
-
Minimum OS required When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The device user can choose to upgrade their device. After that, they can access organization resources.
-
Maximum OS version allowed When a device uses an OS version later than the version in the rule, access to organization resources is blocked. The device user is asked to contact their IT administrator. The device can't access organization resources until a rule changes to allow the OS version.
-
Minimum OS build version When Apple publishes security updates, the build number is typically updated, not the OS version. Use this feature to enter a minimum allowed build number on the device.
-
Maximum OS build version When Apple publishes security updates, the build number is typically updated, not the OS version. Use this feature to enter a maximum allowed build number on the device.
System security settings
Password
-
Require a password to unlock mobile devices
- Not configured (default)
- Require Users must enter a password before they can access their device.
-
Simple passwords
- Not configured (default) - Users can create passwords simple like 1234 or 1111.
- Block - Users can't create simple passwords, such as 1234 or 1111.
-
Minimum password length
- Enter the minimum number of digits or characters that the password must have.
-
Password type
- Choose if a password should have only Numeric characters, or if there should be a mix of numbers and other characters (Alphanumeric).
-
Number of non-alphanumeric characters in password
- Enter the minimum number of special characters, such as &, #, %, !, and so on, that must be in the password.
Setting a higher number requires the user to create a password that is more complex.
-
Maximum minutes of inactivity before password is required
- Enter the idle time before the user must reenter their password.
-
Password expiration (days)
- Select the number of days before the password expires, and they must create a new one.
-
Number of previous passwords to prevent reuse
- Enter the number of previously used passwords that can't be used.
Encryption
- Encryption of data storage on device
- Not configured (default)
- Require - Use Require to encrypt data storage on your devices.
Device Security
Firewall protects devices from unauthorized network access. You can use Firewall to control connections on a per-application basis.
-
Firewall
- Not configured (default) - This setting leaves the firewall turned off, and network traffic is allowed (not blocked).
- Enable - Use Enable to help protect devices from unauthorized access. Enabling this feature allows you to handle incoming internet connections, and use stealth mode.
-
Incoming connections
- Not configured (default) - Allows incoming connections and sharing services.
- Block - Block all incoming network connections except the connections required for basic internet services, such as DHCP, Bonjour, and IPSec. This setting also blocks all sharing services, including screen sharing, remote access, iTunes music sharing, and more.
-
Stealth Mode
- Not configured (default) - This setting leaves stealth mode turned off.
- Enable - Turn on stealth mode to prevent devices from responding to probing requests, which can be made my malicious users. When enabled, the device continues to answer incoming requests for authorized apps.
Gatekeeper
For more information, see Gatekeeper on macOS.
- Allow apps downloaded from these locations
Allows supported applications to be installed on your devices from different locations. Your location options:
- Not configured (default) - The gatekeeper option has no impact on compliance or non-compliance.
- Mac App Store - Only install apps for the Mac app store. Apps can't be installed from third parties nor identified developers. If a user selects Gatekeeper to install apps outside the Mac App Store, then the device is considered not compliant.
- Mac App Store and identified developers - Install apps for the Mac app store and from identified developers. macOS checks the identity of developers, and does some other checks to verify app integrity. If a user selects Gatekeeper to install apps outside these options, then the device is considered not compliant.
- Anywhere - Apps can be installed from anywhere, and by any developer. This option is the least secure.
Display name of the MacOS device compliance policy.
Description of the MacOS device compliance policy.
Assignments of the Intune Policy.
PasswordRequired of the MacOS device compliance policy.
PasswordBlockSimple of the MacOS device compliance policy.
PasswordExpirationDays of the MacOS device compliance policy.
PasswordMinimumLength of the MacOS device compliance policy.
PasswordMinutesOfInactivityBeforeLock of the MacOS device compliance policy.
PasswordPreviousPasswordBlockCount of the MacOS device compliance policy.
PasswordMinimumCharacterSetCount of the MacOS device compliance policy.
PasswordRequiredType of the MacOS device compliance policy.
OsMinimumVersion of the MacOS device compliance policy.
OsMaximumVersion of the MacOS device compliance policy.
Minimum MacOS build version.
Maximum MacOS build version.
SystemIntegrityProtectionEnabled of the MacOS device compliance policy.
DeviceThreatProtectionEnabled of the MacOS device compliance policy.
DeviceThreatProtectionRequiredSecurityLevel of the MacOS device compliance policy.
AdvancedThreatProtectionRequiredSecurityLevel of the MacOS device compliance policy.
StorageRequireEncryption of the MacOS device compliance policy.
System and Privacy setting that determines which download locations apps can be run from on a macOS device.
FirewallEnabled of the MacOS device compliance policy.
FirewallBlockAllIncoming of the MacOS device compliance policy.
FirewallEnableStealthMode of the MacOS device compliance policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the settings of Windows 10 compliance policies in your cloud-based organization.
Parameters
Device Health
Windows Health Attestation Service evaluation rules
-
Require BitLocker: Windows BitLocker Drive Encryption encrypts all data stored on the Windows operating system volume. BitLocker uses the Trusted Platform Module (TPM) to help protect the Windows operating system and user data. It also helps confirm that a computer isn't tampered with, even if its left unattended, lost, or stolen. If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys can't be accessed until the TPM verifies the state of the computer.
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - The device can protect data that's stored on the drive from unauthorized access when the system is off, or hibernates.
Device HealthAttestation CSP - BitLockerStatus
-
Require Secure Boot to be enabled on the device:
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - The system is forced to boot to a factory trusted state. The core components that are used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies the signature before it lets the machine start. If any files are tampered with, which breaks their signature, the system doesn't boot.
Device Properties
Operating System Version
To discover build versions for all Windows 10 Feature Updates and Cumulative Updates (to be used in some of the fields below), see Windows 10 release information. Be sure to include the 10.0. prefix before the build numbers, as the following examples illustrate.
-
Minimum OS version: Enter the minimum allowed version in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver. The ver command returns the version in the following format:
Microsoft Windows [Version 10.0.17134.1]
When a device has an earlier version than the OS version you enter, it's reported as noncompliant. A link with information on how to upgrade is shown. The end user can choose to upgrade their device. After they upgrade, they can access company resources.
-
Maximum OS version: Enter the maximum allowed version, in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver. The ver command returns the version in the following format:
Microsoft Windows [Version 10.0.17134.1]
When a device is using an OS version later than the version entered, access to organization resources is blocked. The end user is asked to contact their IT administrator. The device can't access organization resources until the rule is changed to allow the OS version.
-
Minimum OS required for mobile devices: Enter the minimum allowed version, in the major.minor.build number format.
When a device has an earlier version that the OS version you enter, it's reported as noncompliant. A link with information on how to upgrade is shown. The end user can choose to upgrade their device. After they upgrade, they can access company resources.
-
Maximum OS required for mobile devices: Enter the maximum allowed version, in the major.minor.build number.
When a device is using an OS version later than the version entered, access to organization resources is blocked. The end user is asked to contact their IT administrator. The device can't access organization resources until the rule is changed to allow the OS version.
-
Valid operating system builds: Specify a list of minimum and maximum operating system builds. Valid operating system builds provides additional flexibility when compared against minimum and maximum OS versions. Consider a scenario where minimum OS version is set to 10.0.18362.xxx (Windows 10 1903) and maximum OS version is set to 10.0.18363.xxx (Windows 10 1909). This configuration can allow a Windows 10 1903 device that doesn't have recent cumulative updates installed to be identified as compliant. Minimum and maximum OS versions might be suitable if you have standardized on a single Windows 10 release, but might not address your requirements if you need to use multiple builds, each with specific patch levels. In such a case, consider leveraging valid operating system builds instead, which allows multiple builds to be specified as per the following example.
Example: The following table is an example of a range for the acceptable operating systems versions for different Windows 10 releases. In this example, three different Feature Updates have been allowed (1809, 1909 and 2004). Specifically, only those versions of Windows and which have applied cumulative updates from June to September 2020 will be considered to be compliant. This is sample data only. The table includes a first column that includes any text you want to describe the entry, followed by the minimum and maximum OS version for that entry. The second and third columns must adhere to valid OS build versions in the major.minor.build.revision number format. After you define one or more entries, you can Export the list as a comma-separated values (CSV) file.
Description Minimum OS version Maximum OS version Win 10 2004 (Jun-Sept 2020) 10.0.19041.329 10.0.19041.508 Win 10 1909 (Jun-Sept 2020) 10.0.18363.900 10.0.18363.1110 Win 10 1809 (Jun-Sept 2020) 10.0.17763.1282 10.0.17763.1490
Configuration Manager Compliance
Applies only to co-managed devices running Windows 10 and later. Intune-only devices return a not available status.
- Require device compliance from Configuration Manager:
- Not configured (default) - Intune doesn't check for any of the Configuration Manager settings for compliance.
- Require - Require all settings (configuration items) in Configuration Manager to be compliant.
System Security
Password
-
Require a password to unlock mobile devices:
- Not configured (default) - This setting isn't evaluated for compliance or non-compliance.
- Require - Users must enter a password before they can access their device.
-
Simple passwords:
- Not configured (default) - Users can create simple passwords, such as 1234 or 1111.
- Block - Users can't create simple passwords, such as 1234 or 1111.
-
Password type: Choose the type of password or PIN required. Your options:
-
Device (default) - Require a password, numeric PIN, or alphanumeric PIN
-
Numeric - Require a password or numeric PIN
-
Alphanumeric - Require a password, or alphanumeric PIN. When set to Alphanumeric, the following settings are available:
-
Password complexity: Your options:
- Require digits and lowercase letters (default)
- Require digits, lowercase letters, and uppercase letters
- Require digits, lowercase letters, uppercase letters, and special characters
-
-
Minimum password length: Enter the minimum number of digits or characters that the password must have.
-
Maximum minutes of inactivity before password is required: Enter the idle time before the user must reenter their password.
-
Password expiration (days): Enter the number of days before the password expires, and they must create a new one, from 1-730.
-
Number of previous passwords to prevent reuse: Enter the number of previously used passwords that can't be used.
-
Require password when device returns from idle state (Mobile and Holographic):
- Not configured (default)
- Require - Require device users to enter the password every time the device returns from an idle state.
Important When the password requirement is changed on a Windows desktop, users are impacted the next time they sign in, as that's when the device goes from idle to active. Users with passwords that meet the requirement are still prompted to change their passwords.
Encryption
-
Encryption of data storage on a device: This setting applies to all drives on a device.
- Not configured (default)
- Require - Use Require to encrypt data storage on your devices.
Note The Encryption of data storage on a device setting generically checks for the presence of encryption on the device, more specifically at the OS drive level. Currently, Intune supports only the encryption check with BitLocker. For a more robust encryption setting, consider using Require BitLocker, which leverages Windows Device Health Attestation to validate Bitlocker status at the TPM level.
Device Security
-
Firewall:
- Not configured (default) - Intune doesn't control the Microsoft Defender Firewall, nor change existing settings.
- Require - Turn on the Microsoft Defender Firewall, and prevent users from turning it off.
Note If the device immediately syncs after a reboot, or immediately syncs waking from sleep, then this setting may report as an Error. This scenario might not affect the overall device compliance status. To re-evaluate the compliance status, manually sync the device.
-
Trusted Platform Module (TPM):
- Not configured (default) - Intune doesn't check the device for a TPM chip version.
- Require - Intune checks the TPM chip version for compliance. The device is compliant if the TPM chip version is greater than 0 (zero). The device isn't compliant if there isn't a TPM version on the device.
-
Antivirus:
- Not configured (default) - Intune doesn't check for any antivirus solutions installed on the device.
- Require - Check compliance using antivirus solutions that are registered with Windows Security Center, such as Symantec and Microsoft Defender.
-
Antispyware:
- Not configured (default) - Intune doesn't check for any antispyware solutions installed on the device.
- Require - Check compliance using antispyware solutions that are registered with Windows Security Center, such as Symantec and Microsoft Defender.
Defender
The following compliance settings are supported with Windows 10 Desktop.
-
Microsoft Defender Antimalware:
- Not configured (default) - Intune doesn't control the service, nor change existing settings.
- Require - Turn on the Microsoft Defender anti-malware service, and prevent users from turning it off.
-
Microsoft Defender Antimalware minimum version: Enter the minimum allowed version of Microsoft Defender anti-malware service. For example, enter 4.11.0.0. When left blank, any version of the Microsoft Defender anti-malware service can be used.
By (default), no version is configured.
-
Microsoft Defender Antimalware security intelligence up-to-date: Controls the Windows Security virus and threat protection updates on the devices.
- Not configured (default) - Intune doesn't enforce any requirements.
- Require - Force the Microsoft Defender security intelligence be up-to-date.
-
Real-time protection:
- Not configured ((default)) - Intune doesn't control this feature, nor change existing settings.
- Require - Turn on real-time protection, which scans for malware, spyware, and other unwanted software.
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint rules
For additional information on Microsoft Defender for Endpoint integration in conditional access scenarios, see Configure Conditional Access in Microsoft Defender for Endpoint.
- Require the device to be at or under the machine risk score:
Use this setting to take the risk assessment from your defense threat services as a condition for compliance. Choose the maximum allowed threat level:
- Not configured ((default))
- Clear -This option is the most secure, as the device can't have any threats. If the device is detected as having any level of threats, it's evaluated as non-compliant.
- Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a non-compliant status.
- Medium - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be non-compliant.
- High - This option is the least secure, and allows all threat levels. It may be useful if you're using this solution only for reporting purposes.
Windows Holographic for Business
Windows Holographic for Business uses the Windows 10 and later platform. Windows Holographic for Business supports the following setting:
System Security > Encryption > Encryption of data storage on device. To verify device encryption on the Microsoft HoloLens, see Verify device encryption.
Surface Hub
Surface Hub uses the Windows 10 and later platform. Surface Hubs are supported for both compliance and Conditional Access. To enable these features on Surface Hubs, we recommend you enable Windows 10 automatic enrollment in Intune (requires Azure Active Directory (Azure AD)), and target the Surface Hub devices as device groups. Surface Hubs are required to be Azure AD joined for compliance and Conditional Access to work.
For guidance, see set up enrollment for Windows devices.
Special consideration for Surface Hubs running Windows 10 Team OS: Surface Hubs that run Windows 10 Team OS do not support the Microsoft Defender for Endpoint and Password compliance policies at this time. Therefore, for Surface Hubs that run Windows 10 Team OS set the following two settings to their (default) of Not configured:
- In the category Password, set Require a password to unlock mobile devices to the (default) of Not configured.
- In the category Microsoft Defender for Endpoint, set Require the device to be at or under the machine risk score to the (default) of Not configured.
Display name of the Windows 10 device compliance policy.
Description of the Windows 10 device compliance policy.
Represents the assignment to the Intune policy.
PasswordRequired of the Windows 10 device compliance policy.
PasswordBlockSimple of the Windows 10 device compliance policy.
PasswordRequiredToUnlockFromIdle of the Windows 10 device compliance policy.
PasswordMinutesOfInactivityBeforeLock of the Windows 10 device compliance policy.
PasswordExpirationDays of the Windows 10 device compliance policy.
PasswordMinimumLength of the Windows 10 device compliance policy.
PasswordMinimumCharacterSetCount of the Windows 10 device compliance policy.
PasswordRequiredType of the Windows 10 device compliance policy.
PasswordPreviousPasswordBlockCount of the Windows 10 device compliance policy.
RequireHealthyDeviceReport of the Windows 10 device compliance policy.
OsMinimumVersion of the Windows 10 device compliance policy.
OsMaximumVersion of the Windows 10 device compliance policy.
MobileOsMinimumVersion of the Windows 10 device compliance policy.
MobileOsMaximumVersion of the Windows 10 device compliance policy.
EarlyLaunchAntiMalwareDriverEnabled of the Windows 10 device compliance policy.
BitLockerEnabled of the Windows 10 device compliance policy.
SecureBootEnabled of the Windows 10 device compliance policy.
CodeIntegrityEnabled of the Windows 10 device compliance policy.
StorageRequireEncryption of the Windows 10 device compliance policy.
ActiveFirewallRequired of the Windows 10 device compliance policy.
DefenderEnabled of the Windows 10 device compliance policy.
DefenderVersion of the Windows 10 device compliance policy.
SignatureOutOfDate of the Windows 10 device compliance policy.
RTPEnabled of the Windows 10 device compliance policy.
AntivirusRequired of the Windows 10 device compliance policy.
AntiSpywareRequired of the Windows 10 device compliance policy.
DeviceThreatProtectionEnabled of the Windows 10 device compliance policy.
DeviceThreatProtectionRequiredSecurityLevel of the Windows 10 device compliance policy.
ConfigurationManagerComplianceRequired of the Windows 10 device compliance policy.
TpmRequired of the Windows 10 device compliance policy.
DeviceCompliancePolicyScript of the Windows 10 device compliance policy.
ValidOperatingSystemBuildRanges of the Windows 10 device compliance policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Administrative Template Policy for Windows10
User provided name for the resource object.
User provided description for the resource object.
Type of definitions configured for this policy. Possible values are: unknown, custom, builtIn, mixed, unknownFutureValue.
The unique identifier for an entity. Read-only.
The list of enabled or disabled group policy definition values for the configuration.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Custom Policy for Windows10
Admin provided name of the device configuration.
OMA settings. This collection can contain a maximum of 1000 elements.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Defender For Endpoint Onboarding Policy for Windows10
Admin provided name of the device configuration.
Auto populate onboarding blob programmatically from Advanced Threat protection service
Windows Defender AdvancedThreatProtection Offboarding Blob.
Name of the file from which AdvancedThreatProtectionOffboardingBlob was obtained.
Windows Defender AdvancedThreatProtection Onboarding Blob.
Name of the file from which AdvancedThreatProtectionOnboardingBlob was obtained.
Windows Defender AdvancedThreatProtection 'Allow Sample Sharing' Rule
Expedite Windows Defender Advanced Threat Protection telemetry reporting frequency.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Delivery Optimization Policy for Windows10
Admin provided name of the device configuration.
Specifies number of seconds to delay an HTTP source in a background download that is allowed to use peer-to-peer. Valid values 0 to 4294967295
Specifies foreground and background bandwidth usage using percentages, absolutes, or hours.
7 nested properties
Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. Valid values 0 to 4294967295
Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization (0-4000000). Valid values 0 to 4000000 The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). Valid values 0 to 4000000
Background download percentage hours.
4 nested properties
Specifies the beginning of business hours using a 24-hour clock (0-23). Valid values 0 to 23
Specifies the end of business hours using a 24-hour clock (0-23). Valid values 0 to 23
Specifies the percentage of bandwidth to limit during business hours (0-100). Valid values 0 to 100
Specifies the percentage of bandwidth to limit outsidse business hours (0-100). Valid values 0 to 100
Foreground download percentage hours.
4 nested properties
Specifies the beginning of business hours using a 24-hour clock (0-23). Valid values 0 to 23
Specifies the end of business hours using a 24-hour clock (0-23). Valid values 0 to 23
Specifies the percentage of bandwidth to limit during business hours (0-100). Valid values 0 to 100
Specifies the percentage of bandwidth to limit outsidse business hours (0-100). Valid values 0 to 100
Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth (0-100). Valid values 0 to 100
Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth (0-100). Valid values 0 to 100 The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. Valid values 0 to 100
The type of the entity.
Specifies number of seconds to delay a fall back from cache servers to an HTTP source for a background download. Valid values 0 to 2592000.
Specifies number of seconds to delay a fall back from cache servers to an HTTP source for a foreground download. Valid values 0 to 2592000.
Specifies cache servers host names.
Specifies the download method that delivery optimization can use to manage network bandwidth consumption for large content distribution scenarios. Possible values are: userDefined, httpOnly, httpWithPeeringNat, httpWithPeeringPrivateGroup, httpWithInternetPeering, simpleDownload, bypassMode.
Specifies number of seconds to delay an HTTP source in a foreground download that is allowed to use peer-to-peer (0-86400). Valid values 0 to 86400 Specifying 0 sets Delivery Optimization to manage this setting using the cloud service. Valid values 0 to 86400
Specifies to restrict peer selection to a specific source. The options set in this policy only apply to Delivery Optimization mode Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID.
3 nested properties
Specifies an arbitrary group ID that the device belongs to
Set this policy to restrict peer selection to a specific source. Possible values are: notConfigured, adSite, authenticatedDomainSid, dhcpUserOption, dnsSuffix.
The type of the entity.
Specifies the maximum time in days that each file is held in the Delivery Optimization cache after downloading successfully (0-3650). Valid values 0 to 3650
Specifies the maximum cache size that Delivery Optimization either as a percentage or in GB.
3 nested properties
Specifies the maximum size in GB of Delivery Optimization cache. Valid values 0 to 4294967295
Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). Valid values 1 to 100
The type of the entity.
Specifies the minimum battery percentage to allow the device to upload data (0-100). Valid values 0 to 100 The default value is 0. The value 0 (zero) means 'not limited' and the cloud service default value will be used. Valid values 0 to 100
Specifies the minimum disk size in GB to use Peer Caching (1-100000). Valid values 1 to 100000 Recommended values: 64 GB to 256 GB. Valid values 1 to 100000
Specifies the minimum content file size in MB enabled to use Peer Caching (1-100000). Valid values 1 to 100000 Recommended values: 1 MB to 100,000 MB. Valid values 1 to 100000
Specifies the minimum RAM size in GB to use Peer Caching (1-100000). Valid values 1 to 100000
Specifies the drive that Delivery Optimization should use for its cache.
Specifies to restrict peer selection via selected option.
Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Domain Join Policy for Windows10
Admin provided name of the device configuration.
Active Directory domain name to join.
Fixed prefix to be used for computer name.
Dynamically generated characters used as suffix for computer name. Valid values 3 to 14
Organizational unit (OU) where the computer account will be created. If this parameter is NULL, the well known computer object container will be used as published in the domain.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Email Profile Policy for Windows10
Admin provided name of the device configuration.
Account name.
Duration of email to sync. Possible values are: userDefined, oneDay, threeDays, oneWeek, twoWeeks, oneMonth, unlimited.
Email attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: userPrincipalName, primarySmtpAddress.
Email sync schedule. Possible values are: userDefined, asMessagesArrive, manual, fifteenMinutes, thirtyMinutes, sixtyMinutes, basedOnMyUsage.
Exchange location that (URL) that the native mail app connects to.
Indicates whether or not to use SSL.
Whether or not to sync the calendar.
Whether or not to sync contacts.
Whether or not to sync tasks.
Custom domain name value used while generating an email profile before installing on the device.
UserDomainname attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: fullDomainName, netBiosDomainName.
Name of the AAD field, that will be used to retrieve UserName for email profile. Possible values are: userPrincipalName, primarySmtpAddress, samAccountName.
Username attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: userPrincipalName, primarySmtpAddress.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Endpoint Protection Policy for Windows10
Admin provided name of the device configuration.
Gets or sets whether applications inside Microsoft Defender Application Guard can access the devices camera and microphone.
Allow users to download files from Edge in the application guard container and save them on the host file system
Allow persisting user generated data inside the App Guard Container (favorites, cookies, web passwords, etc.)
Allow printing to Local Printers from Container
Allow printing to Network Printers from Container
Allow printing to PDF from Container
Allow printing to XPS from Container
Allow application guard to use virtual GPU
Block clipboard to share data from Host to Container, or from Container to Host, or both ways, or neither ways. Possible values are: notConfigured, blockBoth, blockHostToContainer, blockContainerToHost, blockNone.
Block clipboard to transfer image file, text file or neither of them. Possible values are: notConfigured, blockImageAndTextFile, blockImageFile, blockNone, blockTextFile.
Block enterprise sites to load non-enterprise content, such as third party plug-ins
Allows certain device level Root Certificates to be shared with the Microsoft Defender Application Guard container.
Enable Windows Defender Application Guard
Enable Windows Defender Application Guard for newer Windows builds. Possible values are: notConfigured, enabledForEdge, enabledForOffice, enabledForEdgeAndOffice.
Force auditing will persist Windows logs and events to meet security/compliance criteria (sample events are user login-logoff, use of privilege rights, software installation, system changes, etc.)
Enables the Admin to choose what types of app to allow on devices. Possible values are: notConfigured, enforceComponentsAndStoreApps, auditComponentsAndStoreApps, enforceComponentsStoreAppsAndSmartlocker, auditComponentsStoreAppsAndSmartlocker.
Allows the admin to allow standard users to enable encryption during Azure AD Join.
Allows the Admin to disable the warning prompt for other disk encryption on the user machines.
Allows the admin to require encryption to be turned on using BitLocker. This policy is valid only for a mobile SKU.
Allows the admin to require encryption to be turned on using BitLocker.
BitLocker Fixed Drive Policy.
3 nested properties
Select the encryption method for fixed drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.
This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker.
7 nested properties
Indicates whether to block certificate-based data recovery agent.
Indicates whether or not to enable BitLocker until recovery information is stored in AD DS.
Indicates whether or not to allow BitLocker recovery information to store in AD DS.
Indicates whether or not to allow showing recovery options in BitLocker Setup Wizard for fixed or system disk.
Configure what pieces of BitLocker recovery information are stored to AD DS. Possible values are: passwordAndKey, passwordOnly.
Indicates whether users are allowed or required to generate a 256-bit recovery key for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.
Indicates whether users are allowed or required to generate a 48-digit recovery password for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.
This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.
This setting initiates a client-driven recovery password rotation after an OS drive recovery (either by using bootmgr or WinRE). Possible values are: notConfigured, disabled, enabledForAzureAd, enabledForAzureAdAndHybrid.
BitLocker Removable Drive Policy.
3 nested properties
This policy setting determines whether BitLocker protection is required for removable data drives to be writable on a computer.
Select the encryption method for removable drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.
Indicates whether to block write access to devices configured in another organization. If requireEncryptionForWriteAccess is false, this value does not affect.
BitLocker System Drive Policy.
12 nested properties
Select the encryption method for operating system drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.
Indicates the minimum length of startup pin. Valid values 4 to 20
Enable pre-boot recovery message and Url. If requireStartupAuthentication is false, this value does not affect.
Defines a custom recovery message.
Defines a custom recovery URL.
Allows to recover BitLocker encrypted operating system drives in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker.
7 nested properties
Indicates whether to block certificate-based data recovery agent.
Indicates whether or not to enable BitLocker until recovery information is stored in AD DS.
Indicates whether or not to allow BitLocker recovery information to store in AD DS.
Indicates whether or not to allow showing recovery options in BitLocker Setup Wizard for fixed or system disk.
Configure what pieces of BitLocker recovery information are stored to AD DS. Possible values are: passwordAndKey, passwordOnly.
Indicates whether users are allowed or required to generate a 256-bit recovery key for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.
Indicates whether users are allowed or required to generate a 48-digit recovery password for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.
Indicates whether to allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).
Require additional authentication at startup.
Indicates if TPM startup key is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.
Indicates if TPM startup pin key and key are allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.
Indicates if TPM startup pin is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.
Indicates if TPM startup is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.
List of folder paths to be added to the list of protected folders
Value indicating the behavior of Adobe Reader from creating child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating use of advanced protection against ransomeware. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Allows or disallows Windows Defender Behavior Monitoring functionality.
To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.
Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.
Allows or disallows Windows Defender Intrusion Prevention functionality.
Allows or disallows Windows Defender On Access Protection functionality.
Allows or disallows Windows Defender Realtime Monitoring functionality.
Allows or disallows scanning of archives.
Allows or disallows Windows Defender IOAVP Protection functionality.
Allows or disallows a scanning of network files.
Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned.
Allows or disallows Windows Defender Script Scanning functionality.
List of exe files and folders to be excluded from attack surface reduction rules
Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.
Value indicating the behavior ofBlock persistence through WMI event subscription. Possible values are: userDefined, block, auditMode, warn, disable.
This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan.
Added in Windows 10, version 1709. This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. This feature requires the 'Join Microsoft MAPS' setting enabled in order to function. Possible values are: notConfigured, high, highPlus, zeroTolerance.
Added in Windows 10, version 1709. This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. This feature depends on three other MAPS settings the must all be enabled- 'Configure the 'Block at First Sight' feature 'Join Microsoft MAPS' 'Send file samples when further analysis is required'. Valid values 0 to 50
Time period (in days) that quarantine items will be stored on the system. Valid values 0 to 90
Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take.
4 nested properties
Indicates a Defender action to take for high severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
Indicates a Defender action to take for low severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
Indicates a Defender action to take for moderate severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
Indicates a Defender action to take for severe severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
Allows or disallows Windows Defender Behavior Monitoring functionality.
This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.
This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.
To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.
Allows or disallows Windows Defender Intrusion Prevention functionality.
Allows or disallows Windows Defender On Access Protection functionality.
Allows or disallows Windows Defender Realtime Monitoring functionality.
Allows or disallows scanning of archives.
Allows or disallows Windows Defender IOAVP Protection functionality.
Allows or disallows a scanning of network files.
Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned.
Allows or disallows Windows Defender Script Scanning functionality.
Value indicating if execution of executable content (exe, dll, ps, js, vbs, etc) should be dropped from email (webmail/mail-client). Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating if execution of executable content (exe, dll, ps, js, vbs, etc) should be dropped from email (webmail/mail-client). Possible values are: userDefined, block, auditMode, warn, disable.
This policy setting allows you to enable or disable low CPU priority for scheduled scans.
Allows or disallows scanning of email.
Allows or disallows a full scan of mapped network drives.
Xml content containing information regarding exploit protection details.
Name of the file from which DefenderExploitProtectionXml was obtained.
File extensions to exclude from scans and real time protection.
Files and folder to exclude from scans and real time protection.
List of paths to exe that are allowed to access protected folders
Value indicating the behavior of protected folders. Possible values are: userDefined, enable, auditMode, blockDiskModification, auditDiskModification.
Value indicating the behavior of NetworkProtection. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior of Office applications/macros creating or launching executable content. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior of Office applications/macros creating or launching executable content. Possible values are: userDefined, block, auditMode, warn, disable.
Value indicating the behavior of Office application launching child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior of Office application launching child processes. Possible values are: userDefined, block, auditMode, warn, disable.
Value indicating the behavior of Office applications injecting into other processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior ofOffice applications injecting into other processes. Possible values are: userDefined, block, auditMode, warn, disable.
Value indicating the behavior of Office communication applications, including Microsoft Outlook, from creating child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior of Win32 imports from Macro code in Office. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior of Win32 imports from Macro code in Office. Possible values are: userDefined, block, auditMode, warn, disable.
Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating if credential stealing from the Windows local security authority subsystem is permitted. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating response to process creations originating from PSExec and WMI commands. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating response to process creations originating from PSExec and WMI commands. Possible values are: userDefined, block, auditMode, warn, disable.
Processes to exclude from scans and real time protection.
Controls which sets of files should be monitored. Possible values are: monitorAllFiles, monitorIncomingFilesOnly, monitorOutgoingFilesOnly.
Represents the average CPU load factor for the Windows Defender scan (in percent). The default value is 50. Valid values 0 to 100
Selects whether to perform a quick scan or full scan. Possible values are: userDefined, disabled, quick, full.
Selects the time of day that the Windows Defender quick scan should run. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is 120
Selects the day that the Windows Defender scan should run. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.
Selects the time of day that the Windows Defender scan should run.
Value indicating the behavior of js/vbs executing payload downloaded from Internet. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior of js/vbs executing payload downloaded from Internet. Possible values are: userDefined, block, auditMode, warn, disable.
Value indicating the behavior of obfuscated js/vbs/ps/macro code. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating the behavior of obfuscated js/vbs/ps/macro code. Possible values are: userDefined, block, auditMode, warn, disable.
Indicates whether or not to block user from overriding Exploit Protection settings.
Used to disable the display of the account protection area.
Used to disable the display of the app and browser protection area.
Used to disable the display of the Clear TPM button.
Used to disable the display of the family options area.
Used to disable the display of the hardware protection area.
Used to disable the display of the device performance and health area.
Used to disable the display of the firewall and network protection area.
Used to disable the display of the notification area control. The user needs to either sign out and sign in or reboot the computer for this setting to take effect.
Used to disable the display of the ransomware protection area.
Used to disable the display of the secure boot area under Device security.
Used to disable the display of the security process troubleshooting under Device security.
Used to disable the display of the virus and threat protection area.
Used to disable the display of update TPM Firmware when a vulnerable firmware is detected.
The email address that is displayed to users.
The phone number or Skype ID that is displayed to users.
The help portal URL this is displayed to users.
Configure where to display IT contact information to end users. Possible values are: notConfigured, displayInAppAndInNotifications, displayOnlyInApp, displayOnlyInNotifications.
Notifications to show from the displayed areas of app. Possible values are: notConfigured, blockNoncriticalNotifications, blockAllNotifications.
The company name that is displayed to the users.
Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. Valid values 0 to 24
Checks for the user consent level in Windows Defender to send data. Possible values are: sendSafeSamplesAutomatically, alwaysPrompt, neverSend, sendAllSamplesAutomatically.
Value indicating response to executables that don't meet a prevalence, age, or trusted list criteria. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating response to executables that don't meet a prevalence, age, or trusted list criteria. Possible values are: userDefined, block, auditMode, warn, disable.
Value indicating response to untrusted and unsigned processes that run from USB. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Value indicating response to untrusted and unsigned processes that run from USB. Possible values are: userDefined, block, auditMode, warn, disable.
This property will be deprecated in May 2019 and will be replaced with property DeviceGuardSecureBootWithDMA. Specifies whether Platform Security Level is enabled at next reboot.
Turns On Virtualization Based Security(VBS).
Allows the IT admin to configure the launch of System Guard. Possible values are: notConfigured, enabled, disabled.
Turn on Credential Guard when Platform Security Level with Secure Boot and Virtualization Based Security are both enabled. Possible values are: notConfigured, enableWithUEFILock, enableWithoutUEFILock, disable.
Specifies whether Platform Security Level is enabled at next reboot. Possible values are: notConfigured, withoutDMA, withDMA.
This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with DMA Remapping/device memory isolation and sandboxing. This policy only takes effect when Kernel DMA Protection is supported and enabled by the system firmware. Kernel DMA Protection is a platform feature that cannot be controlled via policy or by end user. It has to be supported by the system at the time of manufacturing. To check if the system supports Kernel DMA Protection, please check the Kernel DMA Protection field in the Summary page of MSINFO32.exe. Possible values are: deviceDefault, blockAll, allowAll.
Blocks stateful FTP connections to the device
Specify how the certificate revocation list is to be enforced. Possible values are: deviceDefault, none, attempt, require.
Configures the idle timeout for security associations, in seconds, from 300 to 3600 inclusive. This is the period after which security associations will expire and be deleted. Valid values 300 to 3600
Configures IPSec exemptions to allow both IPv4 and IPv6 DHCP traffic
Configures IPSec exemptions to allow ICMP
Configures IPSec exemptions to allow neighbor discovery IPv6 ICMP type-codes
Configures IPSec exemptions to allow router discovery IPv6 ICMP type-codes
Configures IPSec exemptions to no exemptions
If an authentication set is not fully supported by a keying module, direct the module to ignore only unsupported authentication suites rather than the entire set
Configures how packet queueing should be applied in the tunnel gateway scenario. Possible values are: deviceDefault, disabled, queueInbound, queueOutbound, queueBoth.
Select the preshared key encoding to be used. Possible values are: deviceDefault, none, utF8.
Configures the firewall profile settings for domain networks
23 nested properties
Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.
Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.
Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.
Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.
Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.
Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.
Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.
Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.
Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.
Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.
Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.
Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.
Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.
Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.
Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.
Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.
Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.
Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.
Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.
Configures the firewall profile settings for private networks
23 nested properties
Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.
Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.
Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.
Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.
Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.
Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.
Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.
Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.
Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.
Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.
Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.
Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.
Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.
Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.
Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.
Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.
Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.
Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.
Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.
Configures the firewall profile settings for public networks
23 nested properties
Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.
Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.
Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.
Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.
Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.
Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.
Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.
Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.
Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.
Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.
Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.
Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.
Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.
Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.
Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.
Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.
Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.
Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.
Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.
Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.
Configures the firewall rule settings. This collection can contain a maximum of 150 elements.
This security setting determines which challenge/response authentication protocol is used for network logons. Possible values are: lmAndNltm, lmNtlmAndNtlmV2, lmAndNtlmOnly, lmAndNtlmV2, lmNtlmV2AndNotLm, lmNtlmV2AndNotLmOrNtm.
If enabled,the SMB client will allow insecure guest logons. If not configured, the SMB client will reject insecure guest logons.
Define a different account name to be associated with the security identifier (SID) for the account 'Administrator'.
Define the behavior of the elevation prompt for admins in Admin Approval Mode. Possible values are: notConfigured, elevateWithoutPrompting, promptForCredentialsOnTheSecureDesktop, promptForConsentOnTheSecureDesktop, promptForCredentials, promptForConsent, promptForConsentForNonWindowsBinaries.
This security setting determines whether to allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares.
Block PKU2U authentication requests to this device to use online identities.
Edit the default Security Descriptor Definition Language string to allow or deny users and groups to make remote calls to the SAM.
UI helper boolean for LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManager entity
This security setting determines whether a computer can be shut down without having to log on to Windows.
Allow UIAccess apps to prompt for elevation without using the secure desktop.
Allow UIAccess apps to prompt for elevation without using the secure desktop.Default is enabled
Prevent a portable computer from being undocked without having to log in.
Prevent users from adding new Microsoft accounts to this computer.
Enable Local accounts that are not password protected to log on from locations other than the physical device.Default is enabled
Enabling this settings allows only interactively logged on user to access CD-ROM media.
Restrict installing printer drivers as part of connecting to a shared printer to admins only.
This security setting determines whether the virtual memory pagefile is cleared when the system is shut down.
This security setting determines whether packet signing is required by the SMB client component.
If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication.
App installations requiring elevated privileges will prompt for admin credentials.Default is enabled
Determines whether the Local Administrator account is enabled or disabled.
This security setting determines whether the SMB client attempts to negotiate SMB packet signing.
Determines if the Guest account is enabled or disabled.
This security setting determines whether packet signing is required by the SMB server component.
This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it.
This security setting determines what additional permissions will be granted for anonymous connections to the computer.
Require CTRL+ALT+DEL to be pressed before a user can log on.
This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. Its not stored by default.
Define who is allowed to format and eject removable NTFS media. Possible values are: notConfigured, administrators, administratorsAndPowerUsers, administratorsAndInteractiveUsers.
Define a different account name to be associated with the security identifier (SID) for the account 'Guest'.
Do not display the username of the last person who signed in on this device.
Do not display the username of the person signing in to this device after credentials are entered and before the devices desktop is shown.
Configure the user information that is displayed when the session is locked. If not configured, user display name, domain and username are shown. Possible values are: notConfigured, administrators, administratorsAndPowerUsers, administratorsAndInteractiveUsers.
Configure the user information that is displayed when the session is locked. If not configured, user display name, domain and username are shown. Possible values are: notConfigured, userDisplayNameDomainUser, userDisplayNameOnly, doNotDisplayUser.
Set message text for users attempting to log in.
Set message title for users attempting to log in.
Define maximum minutes of inactivity on the interactive desktops login screen until the screen saver runs. Valid values 0 to 9999
Define maximum minutes of inactivity on the interactive desktops login screen until the screen saver runs. Valid values 0 to 9999
This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. Possible values are: none, requireNtmlV2SessionSecurity, require128BitEncryption, ntlmV2And128BitEncryption.
This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. Possible values are: none, requireNtmlV2SessionSecurity, require128BitEncryption, ntlmV2And128BitEncryption.
Enforce PKI certification path validation for a given executable file before it is permitted to run.
By default, this security setting restricts anonymous access to shares and pipes to the settings for named pipes that can be accessed anonymously and Shares that can be accessed anonymously
This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. Possible values are: noAction, lockWorkstation, forceLogoff, disconnectRemoteDesktopSession.
Define the behavior of the elevation prompt for standard users. Possible values are: notConfigured, automaticallyDenyElevationRequests, promptForCredentialsOnTheSecureDesktop, promptForCredentials.
Enable all elevation requests to go to the interactive user's desktop rather than the secure desktop. Prompt behavior policy settings for admins and standard users are used.
Defines whether the built-in admin account uses Admin Approval Mode or runs all apps with full admin privileges.Default is enabled
Define whether Admin Approval Mode and all UAC policy settings are enabled, default is enabled
Virtualize file and registry write failures to per user locations
Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files.
Allows IT Admins to configure SmartScreen for Windows.
This user right is used by Credential Manager during Backup/Restore. Users' saved credentials might be compromised if this privilege is given to other entities. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users and groups are allowed to connect to the computer over the network. State Allowed is supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users and groups are block from connecting to the computer over the network. State Block is supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users and groups can change the time and date on the internal clock of the computer. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This security setting determines whether users can create global objects that are available to all sessions. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users and groups can call an internal API to create and change the size of a page file. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which accounts can be used by processes to create a directory object using the object manager. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines if the user can create a symbolic link from the computer to which they are logged on. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users/groups can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal API to create an access token. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can attach a debugger to any process or to the kernel. Only states NotConfigured and Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can set the Trusted for Delegation setting on a user or computer object. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users cannot log on to the computer. States NotConfigured, Blocked are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can log on to the computer. States NotConfigured, Allowed are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines who can modify firmware environment values. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can use performance monitoring tools to monitor the performance of system processes. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. Only states NotConfigured and Blocked are supported
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Only states NotConfigured and Allowed are supported.
2 nested properties
Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.
Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.
Configure windows defender TamperProtection settings. Possible values are: notConfigured, enable, disable.
This setting determines whether the Accessory management service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.
This setting determines whether xbox game save is enabled (1) or disabled (0).
This setting determines whether Live Auth Manager service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.
This setting determines whether Live Game save service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.
This setting determines whether Networking service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Firmware Interface Policy for Windows10
Admin provided name of the device configuration.
Defines whether a user is allowed to enable Bluetooth. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to boot from built-in network adapters. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to boot from external media. Possible values are: notConfigured, enabled, disabled.
Defines whether built-in cameras are enabled. Possible values are: notConfigured, enabled, disabled.
Defines the permission level granted to users to change UEFI settings. Possible values are: notConfiguredOnly, none.
Defines whether a user is allowed to enable Front Camera. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Infrared camera. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Microphone. Possible values are: notConfigured, enabled, disabled.
Defines whether built-in microphones or speakers are enabled. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Near Field Communication. Possible values are: notConfigured, enabled, disabled.
Defines whether built-in radios e.g. WIFI, NFC, Bluetooth, are enabled. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable rear camera. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable SD Card Port. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Simultaneous MultiThreading. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable USB Type A Port. Possible values are: notConfigured, enabled, disabled.
Defines whether CPU and IO virtualization is enabled. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Wake on LAN. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Wake On Power. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable WiFi. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Windows Platform Binary Table. Possible values are: notConfigured, enabled, disabled.
Defines whether a user is allowed to enable Wireless Wide Area Network. Possible values are: notConfigured, enabled, disabled.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Health Monitoring Configuration Policy for Windows10
Admin provided name of the device configuration.
Enables device health monitoring on the device. Possible values are: notConfigured, enabled, disabled.
Specifies custom set of events collected from the device where health monitoring is enabled
Specifies set of events collected from the device where health monitoring is enabled. Possible values are: undefined, healthMonitoring, bootPerformance, windowsUpdates, privilegeManagement.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Identity Protection Policy for Windows10
Admin provided name of the device configuration.
Boolean value used to enable enhanced anti-spoofing for facial feature recognition on Windows Hello face authentication.
Integer value specifies the period (in days) that a PIN can be used before the system requires the user to change it. Valid values are 0 to 730 inclusive. Valid values 0 to 730
This value configures the use of lowercase characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.
Integer value that sets the maximum number of characters allowed for the work PIN. Valid values are 4 to 127 inclusive and greater than or equal to the value set for the minimum PIN. Valid values 4 to 127
Integer value that sets the minimum number of characters required for the Windows Hello for Business PIN. Valid values are 4 to 127 inclusive and less than or equal to the value set for the maximum PIN. Valid values 4 to 127
Controls the ability to prevent users from using past PINs. This must be set between 0 and 50, inclusive, and the current PIN of the user is included in that count. If set to 0, previous PINs are not stored. PIN history is not preserved through a PIN reset. Valid values 0 to 50
Boolean value that enables a user to change their PIN by using the Windows Hello for Business PIN recovery service.
Controls the ability to use special characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.
This value configures the use of uppercase characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.
Controls whether to require a Trusted Platform Module (TPM) for provisioning Windows Hello for Business. A TPM provides an additional security benefit in that data stored on it cannot be used on other devices. If set to False, all devices can provision Windows Hello for Business even if there is not a usable TPM.
Controls the use of biometric gestures, such as face and fingerprint, as an alternative to the Windows Hello for Business PIN. If set to False, biometric gestures are not allowed. Users must still configure a PIN as a backup in case of failures.
Boolean value that enables Windows Hello for Business to use certificates to authenticate on-premise resources.
Boolean value used to enable the Windows Hello security key as a logon credential.
Boolean value that blocks Windows Hello for Business as a method for signing into Windows.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Imported Pfx Certificate Policy for Windows10
Admin provided name of the device configuration.
Intended Purpose of the Certificate Profile - which could be Unassigned, SmimeEncryption, SmimeSigning etc. Possible values are: unassigned, smimeEncryption, smimeSigning, vpn, wifi.
Scale for the Certificate Validity Period. Possible values are: days, months, years.
Value for the Certificate Validity Period
Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.
Certificate renewal threshold percentage. Valid values 1 to 99
Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.
Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Kiosk Policy for Windows10
Admin provided name of the device configuration.
Enable public browsing kiosk mode for the Microsoft Edge browser. The Default is false.
Specify URLs that the kiosk browser is allowed to navigate to
Specify URLs that the kiosk browsers should not navigate to
Specify the default URL the browser should navigate to on launch.
Enable the kiosk browser's end session button. By default, the end session button is disabled.
Enable the kiosk browser's home button. By default, the home button is disabled.
Enable the kiosk browser's navigation buttons(forward/back). By default, the navigation buttons are disabled.
Specify the number of minutes the session is idle until the kiosk browser restarts in a fresh state. Valid values are 1-1440. Valid values 1 to 1440
This policy setting allows to define a list of Kiosk profiles for a Kiosk configuration. This collection can contain a maximum of 3 elements.
force update schedule for Kiosk devices.
5 nested properties
Day of month. Valid values 1 to 31
Day of week. Possible values are: sunday, monday, tuesday, wednesday, thursday, friday, saturday.
Recurrence schedule. Possible values are: none, daily, weekly, monthly.
If true, runs the task immediately if StartDateTime is in the past, else, runs at the next recurrence.
The start time for the force restart.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Network Boundary Policy for Windows10
Admin provided name of the device configuration.
Windows Network Isolation Policy
8 nested properties
Contains a list of enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy. This collection can contain a maximum of 500 elements.
This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseCloudResources policy to force traffic to the matched cloud resources through these proxies.
Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This collection can contain a maximum of 500 elements.
Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false.
This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. These locations will be considered a safe destination for enterprise data to be shared to.
This is a list of proxy servers. Any server not on this list is considered non-enterprise.
Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false
List of domain names that can used for work or personal resource.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Pkcs Certificate Policy for Windows10
Admin provided name of the device configuration.
Target store certificate. Possible values are: user, machine.
PKCS Certificate Template Name
PKCS Certification Authority
PKCS Certification Authority Name
Custom Subject Alternative Name Settings. This collection can contain a maximum of 500 elements.
Extended Key Usage (EKU) settings. This collection can contain a maximum of 500 elements.
Custom String that defines the AAD Attribute.
Custom format to use with SubjectNameFormat = Custom. Example: CN=EmailAddress}},E=EmailAddress}},OU=Enterprise Users,O=Contoso Corporation,L=Redmond,ST=WA,C=US
Scale for the Certificate Validity Period. Possible values are: days, months, years.
Value for the Certificate Validity Period
Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.
Certificate renewal threshold percentage. Valid values 1 to 99
Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.
Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Block clipboard sharing between apps (Samsung KNOX Standard 4.0+).
Block copy and paste functionality.
Block YouTube (Samsung KNOX Standard 4.0+).
Specify the apps that will be hidden on the device. Users cannot discover or run these apps.
Specify the apps that users can install. Users will not be able to install apps that are not on the list.
Specify the apps that users cannot run on their device.
Block Bluetooth (Samsung KNOX Standard 4.0+).
Block use of camera
Block data roaming over the cellular network (Samsung KNOX Standard 4.0+).
Block SMS/MMS messaging functionality (Samsung KNOX Standard 4.0+).
Block voice roaming over the cellular network (Samsung KNOX Standard 4.0+).
Block Wi-Fi tethering (Samsung KNOX Standard 4.0+).
Device compliance can be viewed in the Restricted Apps Compliance report.
Enter the Google Play Store URL of the app you want. For example, to specify the Microsoft Remote Desktop app for Android, enter https://play.google.com/store/apps/details?id=com.microsoft.rdc.android. To find the URL of an app, use a search engine to locate the store page. For example, to find the Remote Desktop app, you could search Microsoft Remote Desktop Play Store.
Block user from changing date and time on device (Samsung KNOX).
Allow multiple users to log into the Company Portal using their AAD credentials (Samsung KNOX Standard 4.0+).
Block submitting diagnostic data from device.
Block factory reset on device.
Block Google account auto sync functionality on device.
Block Google Play store (Samsung KNOX Standard 4.0+).
Kiosk mode apps
Kiosk mode block sleep button
Kiosk mode block volume buttons
Location services blocked
Block Near Field Communication (NFC) technology (Samsung KNOX Standard 4.0+).
Block using fingerprint to unlock device.
Block Smart Lock or other trust agents from adjusting lock screen settings (Samsung KNOX Standard 5.0+).
Number of days until device password must be changed. (1-365)
Minimum number of digits or characters in password. (4-16)
Maximum minutes of inactivity until screen locks. Ignored by device if new time is longer than what's currently set on device. If set to Immediately, devices will use the minimum possible value per device.
Number of new passwords that must be used until an old one can be reused.
Require password to access device.
Specify the type of password required.
Number of consecutive times an incorrect password can be entered before device is wiped of all data.
Block user from powering off device. If this setting is disabled the setting 'Number of sign-in failures before wiping device' does not function.
Define the password complexity.
Block capturing contents of screen as an image.
Security require verify apps
Block sync with Google backup.
Block removable storage usage (Samsung KNOX Standard 4.0+).
Require encryption on device. Not all devices support encryption.
Storage cards must be encrypted. Not all devices support storage card encryption. For more information, see the device and mobile operating system documentation.
Block voice assistant (Samsung KNOX Standard 4.0+).
Block voice dialing (Samsung KNOX Standard 4.0+).
Block autofill.
Block web browser on device.
Block JavaScript in the browser.
Block pop-ups in web browser.
Allow or block browser cookies
Block Wi-Fi (Samsung KNOX Standard 4.0+).
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Device Configuration Policy Android Device Owner.
The display name of the policy.
The Id of the policy.
The description of the policy.
Block modification of accounts. Only supported on Dedicated devices.
When allowed, users can enable the 'unknown sources' setting to install apps from sources other than the Google Play Store.
Devices check for app updates daily. The default behavior is to let device users decide. They'll be able to set their preferences in the managed Google Play app.
Define the default permission policy for requests for runtime permissions.
Enable a suggestion to apps that they skip their user tutorials and any introductory hints when they first start up, if applicable.
A list of managed apps that will have their data cleared during a global sign-out in AAD shared device mode. This collection can contain a maximum of 500 elements.
Block configuring Bluetooth.
Block access to work contacts from another device such as a car system when an Android device is paired via Bluetooth.
Block all cameras on the device
Block tethering and access to portable hotspots.
Blocks users from making any changes to credentials associated with certificates associated with certificates assigned to them.
Indicates whether or not text copied from one profile (personal or work) can be pasted in the other.
Indicates whether data from one profile (personal or work) can be shared with apps in the other profile.
Indicates whether or not contacts stored in work profile are shown in personal profile contact searches/incoming calls.
Block data roaming.
Block user from manually setting the date and time.
Represents the customized detailed help text provided to users when they attempt to modify managed settings on their device.
2 nested properties
The default message displayed if the user's locale doesn't match with any of the localized messages.
The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.
Represents the customized lock screen message provided to users when they attempt to modify managed settings on their device.
2 nested properties
The default message displayed if the user's locale doesn't match with any of the localized messages.
The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.
Represents the enrollment profile type.
Block factory resetting from settings.
Email addresses of device admins for factory reset protection. When a device is factory reset, it will require that one of these admins log in with their Google account to unlock the device. If none are specified, factory reset protection is not enabled.
Proxy is set up directly with host, port and excluded hosts.
5 nested properties
The type of the global proxy.
The proxy auto-config URL.
The excluded hosts.
The host name.
The port.
Blocking prevents users from adding their personal Google account to their device.
Indicates whether a user can access the device's Settings app while in Kiosk Mode.
Whether the power menu is shown when a user long presses the Power button of a device in Kiosk Mode.
Indicates whether system info and notifications are disabled in Kiosk Mode
Indicates whether system error dialogs for crashed or unresponsive apps are shown in Kiosk Mode.
Indicates which navigation features are enabled in Kiosk Mode.
Whether or not to enable app ordering in Kiosk Mode.
The ordering of items on Kiosk Mode Managed Home Screen. This collection can contain a maximum of 500 elements.
A list of managed apps that will be shown when the device is in Kiosk Mode. This collection can contain a maximum of 500 elements.
Whether or not to alphabetize applications within a folder in Kiosk Mode.
Enable end-users to configure and pair devices over Bluetooth.
Whether or not to allow a user to easy access to the debug menu in Kiosk Mode
The 4-6 digit PIN will be the code an IT administrator enters on a multi-app dedicated device to pause kiosk mode.
Whether or not to allow a user to use the flashlight in Kiosk Mode.
Folder icon configuration for managed home screen in Kiosk Mode.
Number of rows for Managed Home Screen grid with app ordering enabled in Kiosk Mode. Valid values 1 to 9999999.
Number of columns for Managed Home Screen grid with app ordering enabled in Kiosk Mode. Valid values 1 to 9999999.
Icon size configuration for managed home screen in Kiosk Mode.
Whether or not to lock home screen to the end user in Kiosk Mode.
A list of managed folders for a device in Kiosk Mode. This collection can contain a maximum of 500 elements.
Whether or not to automatically sign-out of MHS and Shared device mode applications after inactive for Managed Home Screen.
Number of seconds to give user notice before automatically signing them out for Managed Home Screen. Valid values 0 to 9999999.
Number of seconds device is inactive before automatically signing user out for Managed Home Screen. Valid values 0 to 9999999.
Complexity of PIN for sign-in session for Managed Home Screen.
Whether or not require user to set a PIN for sign-in session for Managed Home Screen.
Whether or not required user to enter session PIN if screensaver has appeared for Managed Home Screen.
Custom URL background for sign-in screen for Managed Home Screen.
Custom URL branding logo for sign-in screen and session pin page for Managed Home Screen.
Whether or not show sign-in screen for Managed Home Screen.
Whether or not to use single app kiosk mode or multi-app kiosk mode.
Whether or not to allow a user to change the media volume in Kiosk Mode.
Screen orientation configuration for managed home screen in Kiosk Mode.
Start screen saver when the device screen times out or locks.
Whether or not the device screen should show the screen saver if audio/video is playing in Kiosk Mode.
The number of seconds that the device will display the screen saver for in Kiosk Mode. Valid values 0 to 9999999
URL for an image that will be the device's screen saver in Kiosk Mode.
The number of seconds the device needs to be inactive for before the screen saver is shown in Kiosk Mode. Valid values 1 to 9999999
Whether or not to display application notification badges in Kiosk Mode.
Whether or not to allow a user to access basic device information.
Whether or not to use single app kiosk mode or multi-app kiosk mode.
Enable IT administrators to temporarily leave multi-app kiosk mode to make changes on the device.
Enable a soft-key button that returns users to the Managed Home Screen. Choose between a persistent, floating button or a button activated by a swipe-up gesture.
Customize the appearance of the screen background for assigned groups.
The restricted set of WIFI SSIDs available for the user to configure in Kiosk Mode. This collection can contain a maximum of 500 elements.
Enable end-users to connect to different Wi-Fi networks.
Block unmuting the microphone and adjusting the microphone volume.
Indicates whether or not to you want configure Microsoft Launcher.
Indicates whether or not the user can modify the wallpaper to personalize their device.
Indicates whether or not to configure the wallpaper on the targeted devices.
Indicates the URL for the image file to use as the wallpaper on the targeted devices.
Indicates whether or not the user can modify the device dock configuration on the device.
Indicates whether or not you want to configure the device dock.
Indicates whether or not the user can modify the launcher feed on the device.
Indicates whether or not the user can modify the launcher feed on the device.
Indicates whether or not you want to configure the device dock.
Whether the network escape hatch is enabled. If a network connection can't be made at boot time, the escape hatch prompts the user to temporarily connect to a network in order to refresh the device policy. After applying policy, the temporary network will be forgotten and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings.
Block usage of NFC to beam data from apps.
Disable lock screen
These features are accessible to users when the device is locked. Users will not be able to see or access disabled features.
Number of days until device password must be changed. (1-365)
Indicates the minimum length of the password required on the device. Valid values 4 to 16
Indicates the minimum number of letter characters required for device password. Valid values 1 to 16
Indicates the minimum number of lower case characters required for device password. Valid values 1 to 16
Indicates the minimum number of non-letter characters required for device password. Valid values 1 to 16
Indicates the minimum number of numeric characters required for device password. Valid values 1 to 16
Indicates the minimum number of symbol characters required for device password. Valid values 1 to 16
Indicates the minimum number of upper case letter characters required for device password. Valid values 1 to 16
Maximum time after which the device will lock. Can disable screen lock as well so that it never times out.
Enter the number of unique passwords required before a user can reuse an old one. (1-24)
Set the password's complexity requirements. Additional password requirements will become available based on your selection.
Indicates the timeout period after which a device must be unlocked using a form of strong authentication.
Number of consecutive times an incorrect password can be entered before device is wiped of all data. (4-11)
Indicates whether the user can install apps from unknown sources on the personal profile.
Indicates whether to disable the use of the camera on the personal profile.
Policy applied to applications in the personal profile. This collection can contain a maximum of 500 elements.
Used together with PersonalProfilePersonalApplications to control how apps in the personal profile are allowed or blocked
Indicates whether to disable the capability to take screenshots on the personal profile.
Users get access to all apps, except the ones you've required uninstall in Client Apps. If you choose 'Not configured' for this setting, users can only access the apps you've listed as available or required in Client Apps.
Block screen capture
Represents the security common criteria mode enabled provided to users when they attempt to modify managed settings on their device.
Indicates whether or not the user is allowed to access developer settings like developer options and safe boot on the device.
Enable Google Play Protect to scan apps before and after they're installed. If it detects a threat, it might warn the user to remove the app from the device. Required by default.
Represents the customized short help text provided to users when they attempt to modify managed settings on their device.
2 nested properties
The default message displayed if the user's locale doesn't match with any of the localized messages.
The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.
Block access to the status bar, including notifications and quick settings.
The battery plugged in modes for which the device stays on. When using this setting, it is recommended to clear the Time to lock screen setting so that the device doesn't lock itself while it stays on.
Allow USB storage.
Block mounting of external media.
Block transfer of files over USB.
Indicates the annually repeating time periods during which system updates are postponed. This collection can contain a maximum of 500 elements.
When over-the-air updates are available for this device, they will be installed based on this policy.?
End of the maintenance window in the device's time zone.?
Beginning of the maintenance window in the device's time zone.?
Disable window notifications such as toasts, incoming calls, outgoing calls, system alerts, and system errors.?
Blocks users from adding and signing in to personal accounts while on the device.
Block removal of users.
Block changes to volume.
Enabling this forces all network traffic through the VPN tunnel. If a connection to the VPN can't be established, no network traffic will be allowed.
Android app package name for app that will handle an always-on VPN connection.
Block user creation or editing of any Wi-Fi configurations.
Block changes to Wi-Fi configurations created by the device owner. Users can create their own Wi-Fi configurations.
Indicates the number of days that a work profile password can be set before it expires and a new password will be required. Valid values 1 to 365
Indicates the minimum length of the work profile password. Valid values 4 to 16
Indicates the minimum number of numeric characters required for the work profile password. Valid values 1 to 16
Indicates the minimum number of non-letter characters required for the work profile password. Valid values 1 to 16
Indicates the minimum number of letter characters required for the work profile password. Valid values 1 to 16
Indicates the minimum number of lower-case characters required for the work profile password. Valid values 1 to 16
Indicates the minimum number of upper-case letter characters required for the work profile password. Valid values 1 to 16
Indicates the minimum number of symbol characters required for the work profile password. Valid values 1 to 16
Indicates the length of the work profile password history, where the user will not be able to enter a new password that is the same as any password in the history. Valid values 0 to 24
Indicates the minimum password quality required on the work profile password.
Indicates the timeout period after which a work profile must be unlocked using a form of strong authentication.
Indicates the number of times a user can enter an incorrect work profile password before the device is wiped. Valid values 4 to 11
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune device configuration profile for an Android Open Source Project Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Prevent applications from unknown sources.
Prevent bluetooth configuration.
Prevents using Bluetooth on devices.
Prevents access to the device camera.
Prevent factory reset.
Minimum number of characters required for the password.
Maximum minutes of inactivity until screen locks.
Set password complexity.
Number of sign-in failures before wiping device.
Prevent screen capture.
Enable debugging features.
Prevent external media.
Prevent USB file transfer.
Prevent Wifi configuration edit.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune device configuration profile for an Android WorkProfile Device.
Display name of the device general configuration policy for Android WorkProfile.
Description of the device general configuration policy for Android WorkProfile
Assignments of the Intune Policy.
Indicates whether or not to block face unlock.
Indicates whether or not to block fingerprint unlock
Indicates whether or not to block iris unlock.
Indicates whether or not to block Smart Lock and other trust agents.
Number of days before the password expires
Minimum length of passwords
Minutes of inactivity before the screen times out
Number of previous passwords to block
Number of sign in failures allowed before factory reset
Type of password that is required
Indicates the required device password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH.
Indicates whether to allow installation of apps from unknown sources.
Type of data sharing that is allowed
Indicates whether or not to block notifications while device locked
Block users from adding/removing accounts in work profile
Allow bluetooth devices to access enterprise contacts
Block screen capture in work profile
Block display work profile caller ID in personal profile
Block work profile camera
Block work profile contacts availability in personal profile
Boolean that indicates if the setting disallow cross profile copy paste is enabled
Type of password that is required
Indicates whether or not to block face unlock in work profile.
Indicates whether or not to block fingerprint unlock in work profile
Indicates whether or not to block iris unlock in work profile.
Indicates whether or not to block Smart Lock and other trust agents for work profile
Number of days before the work profile password expires
Minimum length of work profile password
Minimum count of numeric characters required in work profile password
Minimum count of non-letter characters required in work profile password
Minimum count of letter characters required in work profile password
Minimum count of lower-case characters required in work profile password
Minimum count of upper-case characters required in work profile password
Minimum count of symbols required in work profile password
Minutes of inactivity before the screen times out
Number of previous work profile passwords to block
Number of sign in failures allowed before work profile is removed and all corporate data deleted
Type of work profile password that is required
Indicates the required device password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH in work profile.
Password is required or not for work profile
Require the Android Verify apps feature is turned on
Package identifier for always-on VPN.
Enable lockdown mode for always-on VPN.
Allow widgets from work profile apps.
Prevent app installations from unknown sources in the personal profile.
Present ensures the site collection exists, absent ensures it is removed
This resource configures an Intune Device Configuration Policy for iOS.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Indicates whether or not to allow account modification when the device is in supervised mode.
Activation Lock makes it harder for a lost or stolen device to be reactivated.
Indicates whether or not to allow AirDrop when the device is in supervised mode.
Force AirDrop to be considered an unmanaged drop target.
Force requiring a pairing password for outgoing AirPlay requests.
Blocks keychain storage of username and password for outgoing AirPrint request.
Blocks AirPrint request.
Blocking prevents malicious AirPrint Bluetooth beacons phishing for network traffic.
Forces trusted certificates for TLS printing communication
Block app clips.
Block Apple News
Block Apple PersonalizedAdsBlocked
Indicates whether or not to allow Apple Watch pairing when the device is in supervised mode (iOS 9.0 and later).
Force paired Apple watch to use wrist detection.
Block app removal.
Apps you add to this list and assign to a device can lock the device to run only that app once launched, or lock the device while a certain action is running (for example, taking a test). Once the action is complete, or you remove the restriction, the device returns to its normal state.
Blocks automatic downloading of apps purchased on other devices. Does not affect updates to existing apps.
For supervised devices as of iOS 13.0.
Block AppStore in-app purchases.
Block App Store from Home Screen. Users may continue to use iTunes or Apple Configurator to install or update apps.
Users must enter Apple ID password for each in-app and iTunes purchase.
Enter the iTunes App Store URL of the app you want. For example, to specify the Microsoft Work Folders app for iOS, enter https://itunes.apple.com/us/app/work-folders/id950878067?mt=8. To find the URL of an app, use a search engine to locate the store page. For example, to find the Work Folders app, you could search Microsoft Work Folders ITunes.
Set whether the list is a list of apps to hide or a list of apps to make visible.
Require Touch ID or Face ID before passwords or credit card information can be auto filled in Safari and Apps. Available with iOS 12.0 and later.
Block auto unlock.
Blocking disables the ability to remove system apps from the device.
Block modification of Bluetooth settings. To use this setting, the device must be in supervised mode (iOS 10.0+).
Indicates whether or not to block the user from accessing the camera of the device. Requires a supervised device for iOS 13 and later.
Block data roaming over the cellular network. This won't show in the device's management profile, but a block will be enforced for data roaming every time the device checks in (typically every 8 hours).
Block global background fetch while roaming over the cellular network.
Block changes to app cellular data usage settings.
This value is available only with certain carriers. This won't show in the device's management profile, but a block will be enforced for personal hotspot every time the device checks in (typically every 8 hours). Block modification of personal hotspot in addition to this setting to ensure personal hotspot will always be blocked.
For devices running iOS 12.2 and later. Users can't turn Personal Hotspot on or off. If you block this setting and block Personal Hotspot, Personal Hotspot will be turned off.
Indicates whether or not to allow users to change the settings of the cellular plan on a supervised device.
Block voice roaming over the cellular network.
Block untrusted Transport Layer Security (TLS) certificates.
Block remote screen observation by Classroom app. To use this setting, the device must be in supervised mode (iOS 9.3+).
Student devices enrolled in a class via the Classroom app will automatically give permission to that course's teacher to silently observe the student's screen.
Students can join a class without prompting the teacher.
Requires a student enrolled in an unmanaged course via Classroom to request permission from the teacher when attempting to leave the course. Only available in iOS 11.3+
Teachers can lock an app open or lock the device without first prompting the user.
Device compliance can be viewed in the Restricted Apps Compliance report.
Enter the iTunes App Store URL of the app you want. For example, to specify the Microsoft Work Folders app for iOS, enter https://itunes.apple.com/us/app/work-folders/id950878067?mt=8. To find the URL of an app, use a search engine to locate the store page. For example, to find the Work Folders app, you could search Microsoft Work Folders ITunes.
Indicates whether or not to block the user from installing configuration profiles and certificates interactively when the device is in supervised mode.
Users can sync and add their managed contacts (including business and corporate ones) to an unmanaged app, such as the device's built-in contacts app.
An unmanaged app, such as the device's built-in contacts app, can access contact info in a managed app, such as Outlook.
QuickPath enables continuous input on the device keyboard. Available for iOS/iPadOS 13.0 and later.
Forces device to Set Date & Time Automatically. The device's time zone will only be updated when the device has cellular connections or wifi with location services enabled.
Indicates whether or not to block definition lookup when the device is in supervised mode (iOS 8.1.3 and later ).
On iOS 12.0 and later, this blocks users from setting their own Screen Time settings, which includes device restrictions. On iOS 11.4.1 and earlier, this blocks the user from enabling restrictions in the device settings. The blocking effect is the same on any supervised iOS device.
Block the use of the erase all content and settings option on the device.
Indicates whether or not to allow device name modification when the device is in supervised mode (iOS 9.0 and later).
Block the device from sending diagnostic and usage telemetry data.
Block the modification of the diagnostic submission and app analytics settings in the Diagnostics and Usage pane in Settings. To use this setting, the device must be in supervised mode (iOS 9.3.2+).
Indicates whether or not to block the user from viewing managed documents in unmanaged apps.
Indicates whether or not to block the user from viewing unmanaged documents in managed apps.
Emails that the user sends or receives which don't match the domains you specify here will be marked as untrusted.
Removes the Trust Enterprise Developer button in Settings->General->Profiles & Device Management.
Block the changing of enterprise app trust settings.
Indicates whether or not to backup enterprise book.
Indicates whether or not to sync enterprise book metadata.
Indicates whether or not to allow the addition or removal of cellular plans on the eSIM of a supervised device.
Indicates whether or not to block the user from using FaceTime. Requires a supervised device for iOS 13 and later.
Using the Server Message Block (SMB) protocol, devices can access files or other resources on a network server. Available for devices running iOS and iPadOS, versions 13.0 and later.
Devices with access can connect to and open files on a USB drive. Available for devices running iOS and iPadOS, versions 13.0 and later.
A Find My app feature. Available for iOS/iPadOS 13.0 and later.
Block changes to the Find My Friends app settings.
A Find My app feature. Used to locate family and friends from an Apple device or iCloud.com. Available for iOS/iPadOS 13.0 and later.
Indicates whether or not to block the user from using Game Center when the device is in supervised mode.
Block adding Game Center friends. For supervised devices as of iOS 13.0.
For supervised devices as of iOS 13.0.
Host pairing allows you to control which devices the device can pair with.
Indicates whether or not to block the user from using the iBooks Store when the device is in supervised mode.
User will not be able to download media from the iBook store that has been tagged as erotica.
Handoff lets users start work on one iOS device, and continue it on another MacOS or iOS device.
Block backing up device to iCloud.
Blocks iCloud from syncing documents and data.
Block managed apps from syncing to cloud.
Any photos not fully downloaded from iCloud Photo Library to device will be removed from local storage.
Block photo stream syncing to iCloud.
Block shared photo streaming. Blocking can cause data loss.
Block iCloud private relay.
Require encryption on device backup.
Block iTunes.
Block explicit iTunes music, podcast, and news content from iTunes. For supervised devices as of 13.0.
Block Music service. If true, Music app reverts to classic mode and Music service is disabled.
Indicates whether or not to block the user from using iTunes Radio when the device is in supervised mode (iOS 9.3 and later).
Indicates whether or not to block keyboard auto-correction when the device is in supervised mode (iOS 8.1.3 and later).
Indicates whether or not to block the user from using dictation input when the device is in supervised mode.
Indicates whether or not to block predictive keyboards when device is in supervised mode (iOS 8.1.3 and later).
Indicates whether or not to block keyboard shortcuts when the device is in supervised mode (iOS 9.0 and later).
Indicates whether or not to block keyboard spell-checking when the device is in supervised mode (iOS 8.1.3 and later).
Disables syncing credentials stored in the Keychain to iCloud.
Indicates whether or not to allow assistive speak while in kiosk mode.
Users can turn AssistiveTouch on or off.
Kiosk mode allow auto lock
Users can turn invert colors on or off.
Kiosk mode allow ringer switch
Kiosk mode allow screen rotation
Kiosk mode allow sleep button
Kiosk mode allow touchscreen
Indicates whether or not to allow the user to toggle voice control in kiosk mode.
Users can turn VoiceOver on or off.
Kiosk mode allow volume buttons
Users can turn zoom on or off.
URL of app for kiosk mode, e.g. https://itunes.apple.com/us/app/work-folders/id950878067?mt=8
Indicates type of app in kiosk mode.
Indicates whether or not to block the auto-lock while in Kiosk Mode.
Indicates whether or not to block the ringer switch while in Kiosk Mode.
Indicates whether or not to block the screen rotation while in Kiosk Mode.
Indicates whether or not to block the sleep button while in Kiosk Mode.
Indicates whether or not to block the touchscreen while in Kiosk Mode.
Indicates whether or not to block the volume buttons while in Kiosk Mode.
To see a list of bundle IDs for common built-in iOS apps, see the Intune documentation.
Indicates whether or not to enable the voice control while in Kiosk Mode.
Add managed Intune apps from the Software Node.
Indicates whether or not to enforce assistive touch while in Kiosk Mode.
Indicates whether or not to enforce color inversion while in Kiosk Mode.
Indicates whether or not to enforce mono audio while in Kiosk Mode.
Indicates whether or not to enforce voice control while in Kiosk Mode.
Indicates whether or not to enforce zoom while in Kiosk Mode.
Indicates whether or not to block the user from using control center on the lock screen.
Indicates whether or not to block the user from using the notification view on the lock screen.
Indicates whether or not to block the user from using passbook when the device is locked.
Indicates whether or not to block the user from using the Today View on the lock screen.
Indicates whether or not to enforce managed pasteboard.
Media content rating settings for apps.
Media content rating settings for Australia
2 nested properties
Movies rating selected for Australia
TV rating selected for Australia
Media content rating settings for Canada
2 nested properties
Movies rating selected for Canada
TV rating selected for Canada
Media content rating settings for France
2 nested properties
Movies rating selected for France
TV rating selected for France
Media content rating settings for Germany
2 nested properties
Movies rating selected for Germany
TV rating selected for Germany
Media content rating settings for Ireland
2 nested properties
Movies rating selected for Ireland
TV rating selected for Ireland
Media content rating settings for Japan
2 nested properties
Movies rating selected for Japan
TV rating selected for Japan
Media content rating settings for New Zealand
2 nested properties
Movies rating selected for New Zealand
TV rating selected for New Zealand
Media content rating settings for United Kingdom
2 nested properties
Movies rating selected for UK
TV rating selected for UK
Media content rating settings for United States
2 nested properties
Movies rating selected for USA
TV rating selected for USA
Indicates whether or not to block the user from using the Messages app on the supervised device.
If you don't add any managed apps, the configured settings will apply to all managed apps by default. If you add specific managed apps, the configured settings will apply to only those apps.
Indicates whether or not to block the user from using nfc on the supervised device.
Indicates whether or not to allow notifications settings modification (iOS 9.3 and later).
Indicates whether or not to enforce on device only dictation.
Indicates whether or not to enforce on device only translation.
Block users from adding, changing, or removing fingerprints and faces. Face ID is available in iOS 11.0 and later.
Face ID is available on iOS 11.0 and later.
Block passcode from being added, changed or removed. Changes to passcode restrictions will be ignored on supervised devices after blocking passcode modification.
Block simple password sequences, such as 1234 or 1111.
Number of days until device password must be changed. (1-65535)
Minimum number (0-4) of non-alphanumeric characters, such as #, %, !, etc., required in the password. The default value is 0.
Minimum number of digits or characters in password. (4-14)
Set to 0 to require a password immediately. There is no maximum number of minutes, and this number overrides the number currently set on the device. (This compliance check is supported for devices with OS versions iOS 8.0 and above)
Set to 0 to use the device's minimum possible value. This number (0-60) overrides the number currently set on the device. If set to Immediately, devices will use the minimum possible value per device.
Number of new passwords that must be used until an old one can be reused. (1-24)
In addition to requiring a password on all devices, this setting enforces a non-simple, 6-digit password requirement (regardless of other password settings you configure) on devices that are enrolled with Apple user enrollment.
Type of passcode that is required.
Number of consecutive times an incorrect password can be entered before device is wiped of all data. (2-11)
Indicates whether or not to block AirDrop password sharing
Indicates whether or not to block password autofill.
Indicates whether or not to block password proximity requests.
Allows your users to receive software updates without connecting their devices to a computer
Indicates whether or not to block podcasts.
Disables device advertising identifier
Block user's from using their Apple devices to set up and configure other Apple devices.
Indicates whether or not to block Safari autofill.
Indicates whether or not to block Safari. For supervised devices as of iOS 13.0.
Indicates whether or not to block javascript in Safari.
Indicates whether or not to block popups on Safari.
Cookie settings for Safari.
Documents downloaded from the URLs you specify here will be considered managed (Safari only).
Users can save passwords in Safari only from URLs matching the patterns you specify here. To use this setting, the device must be in supervised mode and not configured for multiple users. (iOS 9.3+)
Indicates whether or not to require fraud warning in Safari.
Indicates whether or not to block the user from taking Screenshots
Indicates whether or not to block temporary sessions on shared devices.
Indicates whether or not to block Siri.
Indicates whether or not to block Siri when locked.
Block Siri from querying user-generated content from the internet.
Prevents Siri from dictating, or speaking profane language.
Delay the user's software update for this many days. The maximum is 90 days. (1-90)
Delay user visibility of Software Updates. This does not impact any scheduled updates. It represents days before software updates are visible to end users after release.
Blocks Spotlight from returning any results from an Internet search.
Allow users to boot devices into recovery mode with unpaired devices. Available for devices running iOS and iPadOS versions 14.5 and later.
Blocks USB Restricted mode. USB Restricted mode blocks USB accessories from exchanging data with a device that has been locked over an hour.
Indicates whether or not to block voice dialing.
Blocks the creation of VPN configurations
Block wallpaper from being changed.
Force the device to use only Wi-Fi networks set up through configuration profiles.
Require devices to use Wi-Fi networks set up via configuration profiles. Available for devices running iOS and iPadOS versions 14.5 and later.
Wi-Fi can't be turned off in the Settings app or in the Control Center, even when the device is in airplane mode. Available for iOS/iPadOS 13.0 and later.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune device configuration profile for an MacOS Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Configures users from adding friends to Game Center. Available for devices running macOS versions 10.13 and later.
Configures whether or not to allow AirDrop.
Blocks users from unlocking their Mac with Apple Watch.
Blocks users from taking photographs and videos.
Blocks AirPlay, screen sharing to other devices, and a Classroom app feature used by teachers to view their students' screens. This setting isn't available if you've blocked screenshots.
Unprompted observation means that teachers can view screens without warning students first. This setting isn't available if you've blocked screenshots.
Students can join a class without prompting the teacher.
Students enrolled in an unmanaged Classroom course must get teacher consent to leave the course.
Teachers can lock a student's device or app without the student's approval.
Device compliance can be viewed in the Restricted Apps Compliance report.
List of apps in the compliance (either allow list or block list, controlled by CompliantAppListType).
Configures whether or not to allow content caching.
Block look up, a feature that looks up the definition of a highlighted word.
Emails that the user sends or receives which don't match the domains you specify here will be marked as untrusted.
Configures the reset option on supervised devices. Available for devices running macOS versions 12.0 and later.
Configured if the Game Center icon is removed from the Home screen. Available for devices running macOS versions 10.13 and later.
Handoff lets users start work on one MacOS device, and continue it on another MacOS or iOS device. Available for macOS 10.15 and later.
Blocks iCloud from syncing contacts.
Blocks iCloud from syncing bookmarks.
Blocks iCloud from syncing calendars.
Blocks iCloud from syncing documents and data.
Blocks iCloud from syncing mail.
Blocks iCloud from syncing notes.
Any photos not fully downloaded from iCloud Photo Library to device will be removed from local storage.
Blocks iCloud from syncing reminders.
Configures if the synchronization of cloud desktop and documents is blocked. Available for devices running macOS 10.12.4 and later.
Configures if iCloud private relay is blocked or not. Available for devices running macOS 12 and later.
Blocks files from being transferred using iTunes.
Configures whether or not to block files from being transferred using iTunes.
Block dictation, which is a feature that converts the user's voice to text.
Disables syncing credentials stored in the Keychain to iCloud
Configures whether multiplayer gaming when using Game Center is blocked. Available for devices running macOS versions 10.13 and later.
Configures whether or not to block sharing passwords with the AirDrop passwords feature.
Configures whether or not to block the AutoFill Passwords feature.
Requires user to set a non-biometric passcode or password to unlock the device.
Blocks user from changing the set passcode.
Configures whether or not to block requesting passwords from nearby devices.
Block simple password sequences, such as 1234 or 1111.
Number of days until device password must be changed. (1-65535)
Configures the number of allowed failed attempts to enter the passcode at the device's lock screen. Valid values 2 to 11
Minimum number (0-4) of non-alphanumeric characters, such as #, %, !, etc., required in the password. The default value is 0.
Minimum number of digits or characters in password (4-16).
Set to 0 to require a password immediately. There is no maximum number of minutes, and this number overrides the number currently set on the device.
Set to 0 to use the device's minimum possible value. This number (0-60 minutes) overrides the number currently set on the device.
Configures the number of minutes before the login is reset after the maximum number of unsuccessful login attempts is reached.
Number of new passwords that must be used until an old one can be reused. (1-24)
Specify the type of password required.
Specify the type of password required.
Configure an app's access to specific data, folders, and apps on a device. These settings apply to devices running macOS Mojave 10.14 and later.
Blocks Safari from remembering what users enter in web forms.
Configures whether or not to block the user from taking Screenshots.
Specify the number of days (1-90) to delay visibility of major OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90
Specify the number of days (1-90) to delay visibility of minor OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90
Specify the number of days (1-90) to delay visibility of non-OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90
Delay the user's software update for this many days. The maximum is 90 days. (1-90)
Blocks Spotlight from returning any results from an Internet search
Configures the maximum hours after which the user must enter their password to unlock the device instead of using Touch ID. Available for devices running macOS 12 and later. Valid values 0 to 2147483647
Configures whether to delay OS and/or app updates for macOS.
Configures whether the wallpaper can be changed. Available for devices running macOS versions 10.13 and later.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Policy for Windows10
Admin provided name of the device configuration.
Indicates whether or not to Block the user from adding email accounts to the device that are not associated with a Microsoft account.
Specifies if Windows apps can be activated by voice. Possible values are: notConfigured, enabled, disabled.
Indicates whether or not to block the user from selecting an AntiTheft mode preference (Windows 10 Mobile only).
This policy setting permits users to change installation options that typically are available only to system administrators.
This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system.
List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are to be launched after logon.
Indicates whether apps from AppX packages signed with a trusted certificate can be side loaded. Possible values are: notConfigured, blocked, allowed.
Indicates whether or not to disable the launch of all apps from Windows Store that came pre-installed or were downloaded.
Allows secondary authentication devices to work with Windows.
Specifies the preferred domain among available domains in the Azure AD tenant.
Indicates whether or not Web Credential Provider will be enabled. Possible values are: notConfigured, enabled, disabled.
Specify a list of allowed Bluetooth services and profiles in hex formatted strings.
Whether or not to Block the user from using bluetooth advertising.
Whether or not to Block the user from using bluetooth discoverable mode.
Whether or not to Block the user from using bluetooth.
Whether or not to block specific bundled Bluetooth peripherals to automatically pair with the host device.
Whether or not to block the users from using Swift Pair and other proximity based scenarios.
Whether or not to Block the user from accessing the camera of the device.
Whether or not to Block the user from using data over cellular while roaming.
Whether or not to Block the user from using VPN over cellular.
Whether or not to Block the user from using VPN when roaming over cellular.
Whether or not to allow the cellular data channel on the device. If not configured, the cellular data channel is allowed and the user can turn it off. Possible values are: blocked, required, allowed, notConfigured.
Whether or not to Block the user from doing manual root certificate installation.
Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone.
Whether or not to block Connected Devices Service which enables discovery and connection to other devices, remote messaging, remote app sessions and other cross-device experiences.
Whether or not to Block the user from using copy paste.
Whether or not to Block the user from using Cortana.
Specify whether to allow or disallow the Federal Information Processing Standard (FIPS) policy.
This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows.
Whether or not to block end user access to Defender.
Allows or disallows Windows Defender On Access Protection functionality.
Specifies the level of cloud-delivered protection. Possible values are: notConfigured, high, highPlus, zeroTolerance.
Timeout extension for file scanning by the cloud. Valid values 0 to 50
Timeout extension for file scanning by the cloud. Valid values 0 to 50
Number of days before deleting quarantined malware. Valid values 0 to 90
Gets or sets Defenders actions to take on detected Malware per threat level.
4 nested properties
Indicates a Defender action to take for high severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
Indicates a Defender action to take for low severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
Indicates a Defender action to take for moderate severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
Indicates a Defender action to take for severe severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.
When blocked, catch-up scans for scheduled full scans will be turned off.
When blocked, catch-up scans for scheduled quick scans will be turned off.
File extensions to exclude from scans and real time protection.
Files and folder to exclude from scans and real time protection.
Value for monitoring file activity. Possible values are: userDefined, disable, monitorAllFiles, monitorIncomingFilesOnly, monitorOutgoingFilesOnly.
Gets or sets Defenders action to take on Potentially Unwanted Application (PUA), which includes software with behaviors of ad-injection, software bundling, persistent solicitation for payment or subscription, etc. Defender alerts user when PUA is being downloaded or attempts to install itself. Added in Windows 10 for desktop. Possible values are: deviceDefault, block, audit.
Gets or sets Defenders action to take on Potentially Unwanted Application (PUA), which includes software with behaviors of ad-injection, software bundling, persistent solicitation for payment or subscription, etc. Defender alerts user when PUA is being downloaded or attempts to install itself. Added in Windows 10 for desktop. Possible values are: userDefined, enable, auditMode, warn, notConfigured.
Processes to exclude from scans and real time protection.
The configuration for how to prompt user for sample submission. Possible values are: userDefined, alwaysPrompt, promptBeforeSendingPersonalData, neverSendData, sendAllDataWithoutPrompting.
Indicates whether or not to require behavior monitoring.
Indicates whether or not to require cloud protection.
Indicates whether or not to require network inspection system.
Indicates whether or not to require real time monitoring.
Indicates whether or not to scan archive files.
Indicates whether or not to scan downloads.
Indicates whether or not to scan incoming mail messages.
Indicates whether or not to scan mapped network drives during full scan.
Max CPU usage percentage during scan. Valid values 0 to 100
Indicates whether or not to scan files opened from a network folder.
Indicates whether or not to scan removable drives during full scan.
Indicates whether or not to scan scripts loaded in Internet Explorer browser.
The defender system scan type. Possible values are: userDefined, disabled, quick, full.
The time to perform a daily quick scan.
The defender time for the system scan.
When enabled, low CPU priority will be used during scheduled scans.
The signature update interval in hours. Specify 0 not to check. Valid values 0 to 24
Checks for the user consent level in Windows Defender to send data. Possible values are: sendSafeSamplesAutomatically, alwaysPrompt, neverSend, sendAllSamplesAutomatically.
Defender day of the week for the system scan. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.
Indicates whether or not to allow developer unlock. Possible values are: notConfigured, blocked, allowed.
Indicates whether or not to Block the user from resetting their phone.
Indicates whether or not to Block the user from doing manual un-enrollment from device management.
Gets or sets a value allowing the device to send diagnostic and usage telemetry data, such as Watson. Possible values are: userDefined, none, basic, enhanced, full.
List of legacy applications that have GDI DPI Scaling turned off.
List of legacy applications that have GDI DPI Scaling turned on.
Allow users to change Start pages on Edge. Use the EdgeHomepageUrls to specify the Start pages that the user would see by default when they open Edge.
Indicates whether or not to prevent access to about flags on Edge browser.
Block the address bar dropdown functionality in Microsoft Edge. Disable this settings to minimize network connections from Microsoft Edge to Microsoft services.
Indicates whether or not to block auto fill.
Block Microsoft compatibility list in Microsoft Edge. This list from Microsoft helps Edge properly display sites with known compatibility issues.
Indicates whether or not to block developer tools in the Edge browser.
Indicates whether or not to Block the user from using the Edge browser.
Indicates whether or not to Block the user from making changes to Favorites.
Indicates whether or not to block extensions in the Edge browser.
Allow or prevent Edge from entering the full screen mode.
Indicates whether or not to block InPrivate browsing on corporate networks, in the Edge browser.
Indicates whether or not to Block the user from using JavaScript.
Block the collection of information by Microsoft for live tile creation when users pin a site to Start from Microsoft Edge.
Indicates whether or not to Block password manager.
Indicates whether or not to block popups.
Decide whether Microsoft Edge is prelaunched at Windows startup.
Configure Edge to allow or block printing.
Configure Edge to allow browsing history to be saved or to never save browsing history.
Indicates whether or not to block the user from adding new search engine or changing the default search engine.
Indicates whether or not to block the user from using the search suggestions in the address bar.
Indicates whether or not to Block the user from sending the do not track header.
Indicates whether or not to switch the intranet traffic from Edge to Internet Explorer. Note: the name of this property is misleading the property is obsolete, use EdgeSendIntranetTrafficToInternetExplorer instead.
Indicates whether the user can sideload extensions.
Configure whether Edge preloads the new tab page at Windows startup.
Configure to load a blank page in Edge instead of the default New tab page and prevent users from changing it.
Clear browsing data on exiting Microsoft Edge.
Indicates which cookies to block in the Edge browser. Possible values are: userDefined, allow, blockThirdParty, blockAll.
Block the Microsoft web page that opens on the first use of Microsoft Edge. This policy allows enterprises, like those enrolled in zero emissions configurations, to block this page.
Indicates the enterprise mode site list location. Could be a local file, local network or http location.
Get or set a value that specifies whether to set the favorites bar to always be visible or hidden on any page. Possible values are: notConfigured, hide, show.
The location of the favorites list to provision. Could be a local file, local network or http location.
The first run URL for when Edge browser is opened for the first time.
Causes the Home button to either hide, load the default Start page, load a New tab page, or a custom URL
2 nested properties
The specific URL to load.
The type of the entity.
Enable the Home button configuration.
The list of URLs for homepages shodwn on MDM-enrolled devices on Edge browser.
Controls how the Microsoft Edge settings are restricted based on the configure kiosk mode. Possible values are: notConfigured, digitalSignage, normalMode, publicBrowsingSingleApp, publicBrowsingMultiApp.
Specifies the time in minutes from the last user activity before Microsoft Edge kiosk resets. Valid values are 0-1440. The default is 5. 0 indicates no reset. Valid values 0 to 1440
Specify the page opened when new tabs are created.
Specify what kind of pages are open at start. Possible values are: notConfigured, startPage, newTabPage, previousPages, specificPages.
Allow or prevent users from overriding certificate errors.
Specify the list of package family names of browser extensions that are required and cannot be turned off by the user.
Indicates whether or not to Require the user to use the smart screen filter.
Allows IT admins to set a default search engine for MDM-Controlled devices. Users can override this and change their default search engine provided the AllowSearchEngineCustomization policy is not set.
3 nested properties
Allows IT admins to set a predefined default search engine for MDM-Controlled devices. Possible values are: default, bing.
Points to a https link containing the OpenSearch xml file that contains, at minimum, the short name and the URL to the search Engine.
The type of the entity.
Indicates whether or not to switch the intranet traffic from Edge to Internet Explorer.
Controls the message displayed by Edge before switching to Internet Explorer. Possible values are: notConfigured, disabled, enabled, keepGoing.
Enable favorites sync between Internet Explorer and Microsoft Edge. Additions, deletions, modifications and order changes to favorites are shared between browsers.
Specifies what type of telemetry data (none, intranet, internet, both) is sent to Microsoft 365 Analytics. Possible values are: notConfigured, intranet, internet, intranetAndInternet.
Allow users with administrative rights to delete all user data and settings using CTRL + Win + R at the device lock screen so that the device can be automatically re-configured and re-enrolled into management.
This setting allows you to specify battery charge level at which Energy Saver is turned on. While on battery, Energy Saver is automatically turned on at (and below) the specified battery charge level. Valid input range (0-100). Valid values 0 to 100
This setting allows you to specify battery charge level at which Energy Saver is turned on. While plugged in, Energy Saver is automatically turned on at (and below) the specified battery charge level. Valid input range (0-100). Valid values 0 to 100
Endpoint for discovering cloud printers.
Maximum number of printers that should be queried from a discovery endpoint. This is a mobile only setting. Valid values 1 to 65535
OAuth resource URI for printer discovery service as configured in Azure portal.
Authentication endpoint for acquiring OAuth tokens.
GUID of a client application authorized to retrieve OAuth tokens from the OAuth Authority.
OAuth resource URI for print service as configured in the Azure portal.
Indicates whether or not to enable device discovery UX.
Indicates whether or not to allow the error dialog from displaying if no SIM card is detected.
Indicates whether or not to enable task switching on the device.
Allow or prevent the syncing of Microsoft Edge Browser settings. Option for IT admins to prevent syncing across devices, but allow user override. Possible values are: notConfigured, blockedWithUserOverride, blocked.
Controls if the user can configure search to Find My Files mode, which searches files in secondary hard drives and also outside of the user profile. Find My Files does not allow users to search files or locations to which they do not have access. Possible values are: notConfigured, enabled, disabled.
Indicates whether or not to block DVR and broadcasting.
Controls the user access to the ink workspace, from the desktop and from above the lock screen. Possible values are: notConfigured, enabled, disabled.
Controls the user access to the ink workspace, from the desktop and from above the lock screen. Possible values are: notConfigured, blocked, allowed.
Specify whether to show recommended app suggestions in the ink workspace.
Indicates whether or not to Block the user from using internet sharing.
Indicates whether or not to Block the user from location services.
This policy setting specifies whether Windows apps can be activated by voice while the system is locked. Possible values are: notConfigured, enabled, disabled.
Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. If this policy is set to Allow, the value set by lockScreenTimeoutInSeconds is ignored.
Indicates whether or not to block action center notifications over lock screen.
Indicates whether or not the user can interact with Cortana using speech while the system is locked.
Indicates whether to allow toast notifications above the device lock screen.
Set the duration (in seconds) from the screen locking to the screen turning off for Windows 10 Mobile devices. Supported values are 11-1800. Valid values 11 to 1800
Disables the ability to quickly switch between users that are logged on simultaneously without logging off.
Indicates whether or not to block the MMS send/receive functionality on the device.
Indicates whether or not to block the RCS send/receive functionality on the device.
Indicates whether or not to block text message back up and restore and Messaging Everywhere.
Indicates whether or not to Block a Microsoft account.
Indicates whether or not to Block Microsoft account settings sync.
Controls the Microsoft Account Sign-In Assistant (wlidsvc) NT service. Possible values are: notConfigured, disabled.
If set, proxy settings will be applied to all processes and accounts in the device. Otherwise, it will be applied to the user account that's enrolled into MDM.
Address to the proxy auto-config (PAC) script you want to use.
Disable automatic detection of settings. If enabled, the system will try to find the path to a proxy auto-config (PAC) script.
Specifies manual proxy server settings.
3 nested properties
Address to the proxy server. Specify an address in the format ':'
Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node.
Specifies whether the proxy server should be used for local (intranet) addresses.
Indicates whether or not to Block the user from using near field communication.
Gets or sets a value allowing IT admins to prevent apps and features from working with files on OneDrive.
Specify whether PINs or passwords such as '1111' or '1234' are allowed. For Windows 10 desktops, it also controls the use of picture passwords.
The password expiration in days. Valid values 0 to 730
This security setting determines the period of time (in days) that a password must be used before the user can change it. Valid values 0 to 998
The number of character sets required in the password.
The minimum password length. Valid values 4 to 16
The minutes of inactivity before the screen times out.
The number of previous passwords to prevent reuse of. Valid values 0 to 50
Indicates whether or not to require the user to have a password.
The required password type. Possible values are: deviceDefault, alphanumeric, numeric.
Indicates whether or not to require a password upon resuming from an idle state.
The number of sign in failures before factory reset. Valid values 0 to 999
A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Desktop Image or a file Url to a local image on the file system that needs to used as the Desktop Image.
A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.
This setting specifies the action that Windows takes when a user presses the Power button while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.
This setting specifies the action that Windows takes when a user presses the Power button while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.
This setting allows you to turn off hybrid sleep while on battery. If you set this setting to disable, a hiberfile is not generated when the system transitions to sleep (Stand By). If you set this setting to enable or do not configure this policy setting, users control this setting. Possible values are: notConfigured, enabled, disabled.
This setting allows you to turn off hybrid sleep while plugged in. If you set this setting to disable, a hiberfile is not generated when the system transitions to sleep (Stand By). If you set this setting to enable or do not configure this policy setting, users control this setting. Possible values are: notConfigured, enabled, disabled.
This setting specifies the action that Windows takes when a user closes the lid on a mobile PC while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.
This setting specifies the action that Windows takes when a user closes the lid on a mobile PC while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.
This setting specifies the action that Windows takes when a user presses the Sleep button while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.
This setting specifies the action that Windows takes when a user presses the Sleep button while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.
Prevent user installation of additional printers from printers settings.
Name (network host name) of an installed printer.
Automatically provision printers based on their names (network host names).
Enables or disables the use of advertising ID. Added in Windows 10, version 1607. Possible values are: notConfigured, blocked, allowed.
Indicates whether or not to allow the automatic acceptance of the pairing and privacy user consent dialog when launching apps.
Blocks the usage of cloud based speech services for Cortana, Dictation, or Store applications.
Indicates whether or not to block the usage of cloud based speech services for Cortana, Dictation, or Store applications.
Blocks the shared experiences/discovery of recently used resources in task switcher etc.
This policy prevents the privacy experience from launching during user logon for new and upgraded users.
Indicates whether or not to Block the user from reset protection mode.
Specifies what filter level of safe search is required. Possible values are: userDefined, strict, moderate.
Indicates whether or not to Block the user from taking Screenshots.
Specifies if search can use diacritics.
Indicates whether or not to block the web search.
Specifies whether to use automatic language detection when indexing content and properties.
Indicates whether or not to disable the search indexer backoff feature.
Indicates whether or not to block indexing of WIP-protected items to prevent them from appearing in search results for Cortana or Explorer.
Indicates whether or not to allow users to add locations on removable drives to libraries and to be indexed.
Specifies if search can use location information.
Specifies if search can use location information.
Specifies minimum amount of hard drive space on the same drive as the index location before indexing stops.
Indicates whether or not to block remote queries of this computers index.
Specify whether to allow automatic device encryption during OOBE when the device is Azure AD joined (desktop only).
Indicates whether or not to block access to Accounts in Settings app.
Indicates whether or not to block the user from installing provisioning packages.
Indicates whether or not to block access to Apps in Settings app.
Indicates whether or not to block the user from changing the language settings.
Indicates whether or not to block the user from changing power and sleep settings.
Indicates whether or not to block the user from changing the region settings.
Indicates whether or not to block the user from changing date and time settings.
Indicates whether or not to block access to Devices in Settings app.
Indicates whether or not to block access to Ease of Access in Settings app.
Indicates whether or not to block the user from editing the device name.
Indicates whether or not to block access to Gaming in Settings app.
Indicates whether or not to block access to Network & Internet in Settings app.
Indicates whether or not to block access to Personalization in Settings app.
Indicates whether or not to block access to Privacy in Settings app.
Indicates whether or not to block the runtime configuration agent from removing provisioning packages.
Indicates whether or not to block access to Settings app.
Indicates whether or not to block access to System in Settings app.
Indicates whether or not to block access to Time & Language in Settings app.
Indicates whether or not to block access to Update & Security in Settings app.
Indicates whether or not to block multiple users of the same app to share data.
Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. Possible values are: notConfigured, anywhere, storeOnly, recommendations, preferStore.
Indicates whether or not users can override SmartScreen Filter warnings about potentially malicious websites.
Indicates whether or not users can override the SmartScreen Filter warnings about downloading unverified files
This property will be deprecated in July 2019 and will be replaced by property SmartScreenAppInstallControl. Allows IT Admins to control whether users are allowed to install apps from places other than the Store.
Indicates whether or not to block the user from unpinning apps from taskbar.
Setting the value of this collapses the app list, removes the app list entirely, or disables the corresponding toggle in the Settings app. Possible values are: userDefined, collapse, remove, disableSettingsApp.
Enabling this policy hides the change account setting from appearing in the user tile in the start menu.
Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app.
Enabling this policy hides hibernate from appearing in the power button in the start menu.
Enabling this policy hides lock from appearing in the user tile in the start menu.
Enabling this policy hides the power button from appearing in the start menu.
Enabling this policy hides recent jump lists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app.
Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app.
Enabling this policy hides 'Restart/Update and Restart' from appearing in the power button in the start menu.
Enabling this policy hides shut down/update and shut down from appearing in the power button in the start menu.
Enabling this policy hides sign out from appearing in the user tile in the start menu.
Enabling this policy hides sleep from appearing in the power button in the start menu.
Enabling this policy hides switch account from appearing in the user tile in the start menu.
Enabling this policy hides the user tile from appearing in the start menu.
This policy setting allows you to import Edge assets to be used with startMenuLayoutXml policy. Start layout can contain secondary tile from Edge app which looks for Edge local asset file. Edge local asset would not exist and cause Edge secondary tile to appear empty in this case. This policy only gets applied when startMenuLayoutXml policy is modified. The value should be a UTF-8 Base64 encoded byte array.
Allows admins to override the default Start menu layout and prevents the user from changing it. The layout is modified by specifying an XML file based on a layout modification schema. XML needs to be in a UTF8 encoded byte array format.
Allows admins to decide how the Start menu is displayed. Possible values are: userDefined, fullScreen, nonFullScreen.
Enforces the visibility (Show/Hide) of the Documents folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the Downloads folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the FileExplorer shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the HomeGroup folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the Music folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the Network folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the PersonalFolder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the Pictures folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the Settings folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Enforces the visibility (Show/Hide) of the Videos folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.
Indicates whether or not to Block the user from using removable storage.
Indicating whether or not to require encryption on a mobile device.
Indicates whether application data is restricted to the system drive.
Indicates whether the installation of applications is restricted to the system drive.
Gets or sets the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests.
Specify whether non-administrators can use Task Manager to end tasks.
Whether the device is required to connect to the network.
Indicates whether or not to uninstall a fixed list of built-in Windows apps.
Indicates whether or not to Block the user from USB connection.
Indicates whether or not to Block the user from voice recording.
Indicates whether or not user's localhost IP address is displayed while making phone calls using the WebRTC
Indicating whether or not to block automatically connecting to Wi-Fi hotspots. Has no impact if Wi-Fi is blocked.
Indicates whether or not to Block the user from using Wi-Fi.
Indicates whether or not to Block the user from using Wi-Fi manual configuration.
Specify how often devices scan for Wi-Fi networks. Supported values are 1-500, where 100 = default, and 500 = low frequency. Valid values 1 to 500
Windows 10 force update schedule for Apps.
3 nested properties
Recurrence schedule. Possible values are: none, daily, weekly, monthly.
If true, runs the task immediately if StartDateTime is in the past, else, runs at the next recurrence.
The start time for the force restart.
Allows IT admins to block experiences that are typically for consumers only, such as Start suggestions, Membership notifications, Post-OOBE app install and redirect tiles.
Allows IT admins to turn off all Windows Spotlight features
Block suggestions from Microsoft that show after each OS clean install, upgrade or in an on-going basis to introduce users to what is new or changed
Block personalized content in Windows spotlight based on users device usage.
Block third party content delivered via Windows Spotlight
Block Windows Spotlight Windows welcome experience
Allows IT admins to turn off the popup of Windows Tips.
Specifies the type of Spotlight. Possible values are: notConfigured, disabled, enabled.
Indicates whether or not to block automatic update of apps from Windows Store.
Indicates whether or not to Block the user from using the Windows store.
Indicates whether or not to enable Private Store Only.
Indicates whether or not to allow other devices from discovering this PC for projection.
Indicates whether or not to allow user input from wireless display receiver.
Indicates whether or not to require a PIN for new devices to initiate pairing.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Scep Certificate Policy for Windows10
Admin provided name of the device configuration.
Target store certificate. Possible values are: user, machine.
SCEP Hash Algorithm. Possible values are: sha1, sha2.
SCEP Key Size. Possible values are: size1024, size2048, size4096.
SCEP Key Usage. Possible values are: keyEncipherment, digitalSignature.
SCEP Server Url(s).
Custom String that defines the AAD Attribute.
Custom format to use with SubjectNameFormat = Custom. Example: CN={{UserName}},E={{EmailAddress}},OU=Enterprise Users,O=Contoso Corporation,L=Redmond,ST=WA,C=US
Custom Subject Alternative Name Settings. This collection can contain a maximum of 500 elements.
Extended Key Usage (EKU) settings. This collection can contain a maximum of 500 elements.
Scale for the Certificate Validity Period. Possible values are: days, months, years.
Value for the Certificate Validity Period
Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.
Certificate renewal threshold percentage. Valid values 1 to 99
Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.
Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.
Trusted Root Certificate DisplayName
Trusted Root Certificate Id
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Secure Assessment Policy for Windows10
Admin provided name of the device configuration.
Indicates whether or not to allow the app from printing during the test.
Indicates whether or not to allow screen capture capability during a test.
Indicates whether or not to allow text suggestions during the test.
Specifies the application user model ID of the assessment app launched when a user signs in to a secure assessment with a local guest account. Important notice: this property must be set with localGuestAccountName in order to make the local guest account sign-in experience work properly for secure assessments.
The account used to configure the Windows device for taking the test. The user can be a domain account (domain/user), an AAD account (usernametenant.com) or a local account (username).
The account type used to by ConfigurationAccount. Possible values are: azureADAccount, domainAccount, localAccount, localGuestAccount.
Url link to an assessment that's automatically loaded when the secure assessment browser is launched. It has to be a valid Url (https://msdn.microsoft.com/).
Specifies the display text for the local guest account shown on the sign-in screen. Typically is the name of an assessment. When the user clicks the local guest account on the sign-in screen, an assessment app is launched with a specified assessment URL. Secure assessments can only be configured with local guest account sign-in on devices running Windows 10, version 1903 or later. Important notice: this property must be set with assessmentAppUserModelID in order to make the local guest account sign-in experience work properly for secure assessments.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Trusted Certificate Policy for Windows10
Admin provided name of the device configuration.
File name to display in UI.
Destination store location for the Trusted Root Certificate. Possible values are: computerCertStoreRoot, computerCertStoreIntermediate, userCertStoreIntermediate.
Trusted Root Certificate
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Vpn Policy for Windows10
Admin provided name of the device configuration.
Associated Apps. This collection can contain a maximum of 10000 elements.
Authentication method. Possible values are: certificate, usernameAndPassword, customEapXml, derivedCredential.
Connection type. Possible values are: pulseSecure, f5EdgeClient, dellSonicWallMobileConnect, checkPointCapsuleVpn, automatic, ikEv2, l2tp, pptp, citrix, paloAltoGlobalProtect, ciscoAnyConnect, unknownFutureValue, microsoftTunnel.
Cryptography Suite security settings for IKEv2 VPN in Windows10 and above
6 nested properties
Authentication Transform Constants. Possible values are: md5_96, sha1_96, sha_256_128, aes128Gcm, aes192Gcm, aes256Gcm.
Cipher Transform Constants. Possible values are: aes256, des, tripleDes, aes128, aes128Gcm, aes256Gcm, aes192, aes192Gcm, chaCha20Poly1305.
Diffie Hellman Group. Possible values are: group1, group2, group14, ecp256, ecp384, group24.
Encryption Method. Possible values are: aes256, des, tripleDes, aes128, aes128Gcm, aes256Gcm, aes192, aes192Gcm, chaCha20Poly1305.
Integrity Check Method. Possible values are: sha2_256, sha1_96, sha1_160, sha2_384, sha2_512, md5.
Perfect Forward Secrecy Group. Possible values are: pfs1, pfs2, pfs2048, ecp256, ecp384, pfsMM, pfs24.
DNS rules. This collection can contain a maximum of 1000 elements.
Specify DNS suffixes to add to the DNS search list to properly route short names.
Extensible Authentication Protocol (EAP) XML. (UTF8 encoded byte array)
Enable Always On mode.
Enable conditional access.
Enable device tunnel.
Enable IP address registration with internal DNS.
Enable single sign-on (SSO) with alternate certificate.
Enable split tunneling.
ID of the Microsoft Tunnel site associated with the VPN profile.
Only associated Apps can use connection (per-app VPN).
Profile target type. Possible values are: user, device, autoPilotDevice.
Proxy Server.
6 nested properties
Bypass proxy server for local address.
Address.
Proxy's automatic configuration script url.
Port. Valid values 0 to 65535
Automatically detect proxy settings.
The type of the entity.
Remember user credentials.
Routes (optional for third-party providers). This collection can contain a maximum of 1000 elements.
Single sign-on Extended Key Usage (EKU).
2 nested properties
Extended Key Usage Name
Extended Key Usage Object Identifier
Single sign-on issuer hash.
Traffic rules. This collection can contain a maximum of 1000 elements.
Trusted Network Domains
Windows Information Protection (WIP) domain to associate with this connection.
Connection name displayed to the user.
Custom XML commands that configures the VPN connection. (UTF8 encoded byte array)
List of VPN Servers on the network. Make sure end users can access these network locations. This collection can contain a maximum of 500 elements.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Windows Team Policy for Windows10
Admin provided name of the device configuration.
Indicates whether or not to Block Azure Operational Insights.
The Azure Operational Insights workspace id.
The Azure Operational Insights Workspace key.
Specifies whether to automatically launch the Connect app whenever a projection is initiated.
Indicates whether or not to Block setting a maintenance window for device updates.
Maintenance window duration for device updates. Valid values 0 to 5
Maintenance window start time for device updates.
Indicates whether or not to Block wireless projection.
The channel. Possible values are: userDefined, one, two, three, four, five, six, seven, eight, nine, ten, eleven, thirtySix, forty, fortyFour, fortyEight, oneHundredFortyNine, oneHundredFiftyThree, oneHundredFiftySeven, oneHundredSixtyOne, oneHundredSixtyFive.
Indicates whether or not to require a pin for wireless projection.
Specifies whether to disable the 'My meetings and files' feature in the Start menu, which shows the signed-in user's meetings and files from Office 365.
Specifies whether to allow the ability to resume a session when the session times out.
Specifies whether to disable auto-populating of the sign-in dialog with invitees from scheduled meetings.
Specifies the default volume value for a new session. Permitted values are 0-100. The default is 45. Valid values 0 to 100
Specifies the number of minutes until the Hub screen turns off.
Specifies the number of minutes until the session times out.
Specifies the number of minutes until the Hub enters sleep mode.
The welcome screen background image URL. The URL must use the HTTPS protocol and return a PNG image.
Indicates whether or not to Block the welcome screen from waking up automatically when someone enters the room.
The welcome screen meeting information shown. Possible values are: userDefined, showOrganizerAndTimeOnly, showOrganizerAndTimeAndSubject.
Admin provided description of the Device Configuration.
Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Configuration Wired Network Policy for Windows10
Admin provided name of the device configuration.
Specify the duration for which automatic authentication attempts will be blocked from occurring after a failed authentication attempt.
Specify the authentication method. Possible values are: certificate, usernameAndPassword, derivedCredential. Possible values are: certificate, usernameAndPassword, derivedCredential, unknownFutureValue.
Specify the number of seconds for the client to wait after an authentication attempt before failing. Valid range 1-3600.
Specify the number of seconds between a failed authentication and the next authentication attempt. Valid range 1-3600.
Specify whether to authenticate the user, the device, either, or to use guest authentication (none). If you're using certificate authentication, make sure the certificate type matches the authentication type. Possible values are: none, user, machine, machineOrUser, guest. Possible values are: none, user, machine, machineOrUser, guest, unknownFutureValue.
When TRUE, caches user credentials on the device so that users don't need to keep entering them each time they connect. When FALSE, do not cache credentials. Default value is FALSE.
When TRUE, prevents the user from being prompted to authorize new servers for trusted certification authorities when EAP type is selected as PEAP. When FALSE, does not prevent the user from being prompted. Default value is FALSE.
Specify the number of seconds to wait before sending an EAPOL (Extensible Authentication Protocol over LAN) Start message. Valid range 1-3600.
Extensible Authentication Protocol (EAP). Indicates the type of EAP protocol set on the Wi-Fi endpoint (router). Possible values are: eapTls, leap, eapSim, eapTtls, peap, eapFast, teap. Possible values are: eapTls, leap, eapSim, eapTtls, peap, eapFast, teap.
When TRUE, the automatic configuration service for wired networks requires the use of 802.1X for port authentication. When FALSE, 802.1X is not required. Default value is FALSE.
When TRUE, forces FIPS compliance. When FALSE, does not enable FIPS compliance. Default value is FALSE.
Specify inner authentication protocol for EAP TTLS. Possible values are: unencryptedPassword, challengeHandshakeAuthenticationProtocol, microsoftChap, microsoftChapVersionTwo. Possible values are: unencryptedPassword, challengeHandshakeAuthenticationProtocol, microsoftChap, microsoftChapVersionTwo.
Specify the maximum authentication failures allowed for a set of credentials. Valid range 1-100.
Specify the maximum number of EAPOL (Extensible Authentication Protocol over LAN) Start messages to be sent before returning failure. Valid range 1-100.
Specify the string to replace usernames for privacy when using EAP TTLS or PEAP.
When TRUE, enables verification of server's identity by validating the certificate when EAP type is selected as PEAP. When FALSE, the certificate is not validated. Default value is TRUE.
When TRUE, enables cryptographic binding when EAP type is selected as PEAP. When FALSE, does not enable cryptogrpahic binding. Default value is TRUE.
Specify the secondary authentication method. Possible values are: certificate, usernameAndPassword, derivedCredential. Possible values are: certificate, usernameAndPassword, derivedCredential, unknownFutureValue.
Specify trusted server certificate names.
Specify root certificates for server validation. This collection can contain a maximum of 500 elements.
Specify root certificate display names for server validation. This collection can contain a maximum of 500 elements.
Specify identity certificate for client authentication.
Specify identity certificate display name for client authentication.
Specify root certificate for client validation
Specify root certificate display name for client validation
Specify root certificate for client validation.
Specify root certificate display name for client validation.
Specify secondary root certificate for client validation.
Specify secondary root certificate display name for client validation.
Admin provided description of the Device Configuration.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures the Intune device enrollment limit restrictions.
Display name of the device enrollment limit restriction.
Description of the device enrollment limit restriction.
Specifies the maximum number of devices a user can enroll
Present ensures the restriction exists, absent ensures it is removed.
This resource configures the Intune device platform enrollment restrictions.
Be aware: To deploy a Android platform restriction policy, two individual configurations must exist:
- The first one contains the key for
AndroidRestriction - The second one contains the key for
AndroidForWorkRestriction
Identity of the device enrollment platform restriction.
Display name of the device enrollment platform restriction.
Description of the device enrollment platform restriction.
Android for work restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Android restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Ios restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Mac restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Mac restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Windows Home Sku restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Windows mobile restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Windows restrictions based on platform, platform operating system version, and device ownership.
6 nested properties
Block the platform from enrolling.
Block personally owned devices from enrolling.
Min OS version supported.
Max OS version supported.
Collection of blocked Manufacturers.
Collection of blocked Skus.
Support for Enrollment Configuration Type
Priority is used when a user exists in multiple groups that are assigned enrollment configuration. Users are subject only to the configuration with the lowest priority value.
Assignments of the policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Device Enrollment Status Page Configuration for Windows10
The display name of the device enrollment configuration
The unique identifier for an entity. Read-only.
The description of the device enrollment configuration
Allow or block device reset on installation failure
Allow the user to continue using the device on installation failure
Allow or block log collection on installation failure
Install all required apps as non blocking apps during white glove
Allow the user to retry the setup on installation failure
Set custom error message to show upon installation failure
Only show installation progress for first user post enrollment
Set installation progress timeout in minutes
Allows quality updates installation during OOBE
Ids of selected applications to track the installation status. When this parameter is used, SelectedMobileAppNames is ignored
Names of selected applications to track the installation status. This parameter is ignored when SelectedMobileAppIds is also specified
Show or hide installation progress to user
Only show installation progress for Autopilot enrollment scenarios
Priority is used when a user exists in multiple groups that are assigned enrollment configuration. Users are subject only to the configuration with the lowest priority value.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Endpoint Detection and Response Policy for Windows 10.
Display name of the endpoint detection and response policy for Windows 10.
Identity of the endpoint detection and response policy for Windows 10.
Description of the endpoint detection and response policy for Windows 10.
Assignments of the endpoint detection and response policy for Windows 10.
Return or set Windows Defender Advanced Threat Protection Sample Sharing configuration parameter: 0 - none, 1 - All
Microsoft Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.
Set Windows Defender Advanced Threat Protection Onboarding blob and initiate onboarding to Windows Defender Advanced Threat Protection
Present ensures the policy exists, absent ensures it is removed
This resource configures an Intune Endpoint Protection Exploit Protection policy for a Windows 10 Device. Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see
- Enable Exploit Protection on Devices and Import: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-exploit-protection,
- Export, and deploy Exploit Protection configurations: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml
Display name of the endpoint protection policy.
Identity of the endpoint protection policy.
Description of the endpoint protection.
Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML.
Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center.values 0:disable, 1:enable
Assignments of the endpoint protection.
Present ensures the policy exists, absent ensures it is removed
Intune Policy Sets
DisplayName of the PolicySet.
Description of the PolicySet.
Tags of the guided deployment
RoleScopeTags of the PolicySet
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Role Assignment.
The display or friendly name of the role Assignment.
The unique identifier for an entity. Read-only.
Description of the Role Assignment.
List of ids of role scope member security groups. These are IDs from Azure Active Directory. Ignored if ScopeType is not 'ResourceScope'
List of DisplayName of role scope member security groups. These are Displayname from Azure Active Directory. Ignored if ScopeType is not 'ResourceScope'
Specifies the type of scope for a Role Assignment. Default type 'ResourceScope' allows assignment of ResourceScopes. Possible values are: resourceScope, allDevices, allLicensedUsers, allDevicesAndLicensedUsers.
The list of ids of role member security groups. These are IDs from Azure Active Directory.
The list of Displaynames of role member security groups. These are Displaynamnes from Azure Active Directory.
The Role Definition Id.
The Role Definition Displayname.
Present ensures the Role exists, absent ensures it is removed.
This resource configures an Intune Role Definition.
Display Name of the Role definition.
The unique identifier for an entity. Read-only.
Description of the Role definition.
Type of Role. Set to True if it is built-in, or set to False if it is a custom role definition.
List of allowed resource actions
List of not allowed resource actions
Id of the Scope Tags to assign
Present ensures the Role exists, absent ensures it is removed.
This resource configures a Intune Endpoint Protection Attack Surface Reduction rules policy for a Windows 10 Device. This resource returns ASR rules created using settings catalog settings.
Display name of the endpoint protection attack surface protection rules policy for Windows 10.
Identity of the endpoint protection attack surface protection rules policy for Windows 10.
Description of the endpoint protection attack surface protection rules policy for Windows 10.
Assignments of the endpoint protection.
Exclude files and paths from attack surface reduction rules
This rule prevents an application from writing a vulnerable signed driver to disk.
ASR Only Per Rule Exclusions
This rule prevents attacks by blocking Adobe Reader from creating processes.
ASR Only Per Rule Exclusions
This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.
ASR Only Per Rule Exclusions (off: Off, block: Block, audit: Audit, warn: Warn)
This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).
ASR Only Per Rule Exclusions
This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.
ASR Only Per Rule Exclusions
This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.
ASR Only Per Rule Exclusions
This rule detects suspicious properties within an obfuscated script.
ASR Only Per Rule Exclusions
This rule prevents scripts from launching potentially malicious downloaded content.
ASR Only Per Rule Exclusions
This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.
ASR Only Per Rule Exclusions
This rule blocks code injection attempts from Office apps into other processes.
ASR Only Per Rule Exclusions
This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.
ASR Only Per Rule Exclusions
This rule prevents malware from abusing WMI to attain persistence on a device.
This rule blocks processes created through PsExec and WMI from running.
ASR Only Per Rule Exclusions
This rule prevents the execution of commands to restart machines in Safe Mode.
ASR Only Per Rule Exclusions
With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.
ASR Only Per Rule Exclusions
This rule blocks the use of executable files that are identified as copies of Windows system tools. These files are either duplicates or impostors of the original system tools.
ASR Only Per Rule Exclusions
This rule blocks webshell creation for servers.
ASR Only Per Rule Exclusions
This rule prevents VBA macros from calling Win32 APIs.
ASR Only Per Rule Exclusions
This rule provides an extra layer of protection against ransomware.
ASR Only Per Rule Exclusions
List of additional folders that need to be protected
List of apps that have access to protected folders.
This rule enables Controlled folder access which protects your data by checking apps against a list of known, trusted apps.values 0:disable, 1:enable, 2:audit
Present ensures the policy exists, absent ensures it is removed
This resource configures an Intune Wifi Configuration Policy Android Device Administrator Device.
Display name of the Intune Policy.
Id of the Intune Policy.
Description of the Intune Policy.
Connect automatically.
Connect when network name is hidden.
Network name.
SSID.
Wi-Fi security type.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Wifi Configuration Policy Android Enterprise Device Owner Device.
Disaply name of the Intune policy
Id of the Intune policy
Description of the Intune policy
If the network is in range, automatically connect.
Don't show this Wi-Fi network on an end-user's device in the list of available networks. The SSID will not be broadcasted.
Network name.
Pre shared key.
Pre shared key is set.
URL of the automatic proxy.
Exclusion list of the proxy.
Address of the proxy.
Port of the proxy.
Proxy setting type.
Service Set Identifier. The name of the Wi-Fi connection.
Type of Wi-Fi profile.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Wifi Configuration Policy Android Enterprise Work Profile Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Connect automatically.
Connect when network name is hidden.
Network name.
SSID.
Wi-Fi security.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Wifi Configuration Policy Android For Work Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Connect automatically
Connect when network name is hidden
Network name
SSID
Wi-Fi security
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Wifi Configuration Policy Android Open Source Project Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Connect automatically to the network.
Define if the network should be connected if hidden.
Define the network name.
Define the pre-shared key.
Define if the pre-shared key is set.
Define the SSID.
Define the Wifi security type.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Wifi Configuration Policy for iOS Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Connect automatically
Connect when network name is hidden
Disable the MAC address randomization.
Network name
Pre shared key
Proxy automatic configuration url
Proxy manual address
Proxy manual port
Proxy settings
SSID
Wi-Fi security
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Wifi Configuration Policy for MacOS Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Connect automatically
Connect when network name is hidden
Network name
Pre shared key
Proxy automatic configuration url
Proxy manual address
Proxy manual port
Proxy settings
SSID
Wi-Fi security
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Intune Wifi Configuration Policy for Windows10 Device.
Display name of the Intune policy.
Id of the Intune policy.
Description of the Intune policy.
Connect automatically
Connect to preferred network
Connect when network name is hidden
Force FIPS compliance
Metered connection limit
Network name
Pre shared key
Proxy automatic configuration url
Proxy manual address
Proxy manual port
Proxy setting
SSID
Wi-Fi security
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Windows Autopilot Deployment Profile Azure AD Hybrid Joined
Name of the profile
The Autopilot Hybrid Azure AD join flow will continue even if it does not establish domain controller connectivity during OOBE.
Description of the profile
The template used to name the AutoPilot Device. This can be a custom text and can also contain either the serial number of the device, or a randomly generated number. The total length of the text generated by the template can be no more than 15 characters.
The AutoPilot device type that this profile is applicable to. Possible values are: windowsPc, surfaceHub2.
Enable Autopilot White Glove for the profile.
Enrollment status screen setting
7 nested properties
Allow or block user to use device before profile and app installation complete
Allow the user to continue using the device on installation failure
Allow or block log collection on installation failure
Allow the user to retry the setup on installation failure
Set custom error message to show upon installation failure
Show or hide installation progress to user
Set installation progress timeout in minutes
HardwareHash Extraction for the profile
Language configured on the device
AzureAD management app ID used during client device-based enrollment discovery
Out of box experience setting
6 nested properties
AAD join authentication type. Possible values are: singleUser, shared.
If set to true, then the user can't start over with different account, on company sign-in
Show or hide EULA to user
Show or hide privacy settings to user
If set, then skip the keyboard selection page if Language and Region are set
Type of user. Possible values are: administrator, standard.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Windows Autopilot Deployment Profile Azure AD Joined
Name of the profile
Description of the profile
The template used to name the AutoPilot Device. This can be a custom text and can also contain either the serial number of the device, or a randomly generated number. The total length of the text generated by the template can be no more than 15 characters.
The AutoPilot device type that this profile is applicable to. Possible values are: windowsPc, surfaceHub2.
Enable Autopilot White Glove for the profile.
Enrollment status screen setting
7 nested properties
Allow or block user to use device before profile and app installation complete
Allow the user to continue using the device on installation failure
Allow or block log collection on installation failure
Allow the user to retry the setup on installation failure
Set custom error message to show upon installation failure
Show or hide installation progress to user
Set installation progress timeout in minutes
HardwareHash Extraction for the profile
Language configured on the device
AzureAD management app ID used during client device-based enrollment discovery
Out of box experience setting
6 nested properties
AAD join authentication type. Possible values are: singleUser, shared.
If set to true, then the user can't start over with different account, on company sign-in
Show or hide EULA to user
Show or hide privacy settings to user
If set, then skip the keyboard selection page if Language and Region are set
Type of user. Possible values are: administrator, standard.
The unique identifier for an entity. Read-only.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Windows Information Protection Policy for Windows10 Mdm Enrolled
Policy display name.
The unique identifier for an entity. Read-only.
Specifies whether to allow Azure RMS encryption for WIP
Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent(DRA) certificate for encrypting file system(EFS)
4 nested properties
Data recovery Certificate
Data recovery Certificate description
Data recovery Certificate expiration datetime
Data recovery Certificate subject name
WIP enforcement level.See the Enum definition for supported values. Possible values are: noProtection, encryptAndAuditOnly, encryptAuditAndPrompt, encryptAuditAndBlock.
Primary enterprise domain
This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseProxiedDomains policy to force traffic to the matched domains through these proxies
Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to
Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false
This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to
List of enterprise domains to be protected
Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy
This is a list of proxy servers. Any server not on this list is considered non-enterprise
Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false
Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems with encrypted data.
Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app
This switch is for the Windows Search Indexer, to allow or disallow indexing of items
List of domain names that can used for work or personal resource
Protected applications can access enterprise data and the data handled by those applications are protected with encryption
Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured
This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 1 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently.
TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access
Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary
The policy's description.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Windows Update For Business Feature Update Profile for Windows10
RolloutSettings
The RolloutSettings for this resource have the following constraints and notes:
- When creating a policy:
- If only a start date is specified, then the start date must be at least today.
- If the desired state date is before the current date, it will be adjusted to the current date.
- If a start and end date is specified, the start date must be the current date + 2 days, and
the end date must be at least one day after the start date.- If the start date is before the current date + 2 days, it will be adjusted to this date.
- If only a start date is specified, then the start date must be at least today.
- When updating a policy:
- If only a start date is specified, then the start date must either be the date from the current
configuration or the current date (or later).- If the desired state date is before the current date, it will be adjusted to the current date.
- If a start and end date is specified, the start date must be the current date + 2 days, and
the end date must be at least one day after the start date.- If the start date is before the current date + 2 days, it will be adjusted to this date.
- If only a start date is specified, then the start date must either be the date from the current
- When testing a policy:
- If the policy is missing and the start and end date are before the current date, it will return true.
- If the start date is different but before the current start date or time, it will return true.
The display name of the profile.
The unique identifier for an entity. Read-only.
The description of the profile which is specified by the user.
The feature update version that will be deployed to the devices targeted by this profile. The version could be any supported version for example 1709, 1803 or 1809 and so on.
If true, the Windows 11 update will become optional
If true, the latest Microsoft Windows 10 update will be installed on devices ineligible for Microsoft Windows 11. Cannot be changed after creation of the policy.
The windows update rollout settings, including offer start date time, offer end date time, and days between each set of offers. For 'as soon as possible' installation, set this setting to $null or do not configure it.
3 nested properties
The feature update's ending of release date and time to be set, update, and displayed for a feature Update profile for example: 2020-06-09T10:00:00Z.
The number of day(s) between each set of offers to be set, updated, and displayed for a feature update profile, for example: if OfferStartDateTimeInUTC is 2020-06-09T10:00:00Z, and OfferIntervalInDays is 1, then the next two sets of offers will be made consecutively on 2020-06-10T10:00:00Z (next day at the same specified time) and 2020-06-11T10:00:00Z (next next day at the same specified time) with 1 day in between each set of offers.
The feature update's starting date and time to be set, update, and displayed for a feature Update profile for example: 2020-06-09T10:00:00Z.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
Intune Windows Update For Business Ring Update Profile for Windows 10
Admin provided name of the device configuration.
The unique identifier for an entity. Read-only.
When TRUE, allows eligible Windows 10 devices to upgrade to Windows 11. When FALSE, implies the device stays on the existing operating system. Returned by default. Query parameters are not supported.
The Automatic Update Mode. Possible values are: UserDefined, NotifyDownload, AutoInstallAtMaintenanceTime, AutoInstallAndRebootAtMaintenanceTime, AutoInstallAndRebootAtScheduledTime, AutoInstallAndRebootWithoutEndUserControl, WindowsDefault. UserDefined is the default value, no intent. Returned by default. Query parameters are not supported. Possible values are: userDefined, notifyDownload, autoInstallAtMaintenanceTime, autoInstallAndRebootAtMaintenanceTime, autoInstallAndRebootAtScheduledTime, autoInstallAndRebootWithoutEndUserControl, windowsDefault.
Specify the method by which the auto-restart required notification is dismissed. Possible values are: NotConfigured, Automatic, User. Returned by default. Query parameters are not supported. Possible values are: notConfigured, automatic, user, unknownFutureValue.
Determines which branch devices will receive their updates from. Possible values are: UserDefined, All, BusinessReadyOnly, WindowsInsiderBuildFast, WindowsInsiderBuildSlow, WindowsInsiderBuildRelease. Returned by default. Query parameters are not supported. Possible values are: userDefined, all, businessReadyOnly, windowsInsiderBuildFast, windowsInsiderBuildSlow, windowsInsiderBuildRelease.
Number of days before feature updates are installed automatically with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.
Number of days before quality updates are installed automatically with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.
Number of days after deadline until restarts occur automatically with valid range from 0 to 7 days. Returned by default. Query parameters are not supported.
The Delivery Optimization Mode. Possible values are: UserDefined, HttpOnly, HttpWithPeeringNat, HttpWithPeeringPrivateGroup, HttpWithInternetPeering, SimpleDownload, BypassMode. UserDefined allows the user to set. Returned by default. Query parameters are not supported. Possible values are: userDefined, httpOnly, httpWithPeeringNat, httpWithPeeringPrivateGroup, httpWithInternetPeering, simpleDownload, bypassMode.
When TRUE, excludes Windows update Drivers. When FALSE, does not exclude Windows update Drivers. Returned by default. Query parameters are not supported.
Deadline in days before automatically scheduling and executing a pending restart outside of active hours, with valid range from 2 to 30 days. Returned by default. Query parameters are not supported.
Number of days a user can snooze Engaged Restart reminder notifications with valid range from 1 to 3 days. Returned by default. Query parameters are not supported.
Number of days before transitioning from Auto Restarts scheduled outside of active hours to Engaged Restart, which requires the user to schedule, with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.
Defer Feature Updates by these many days with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.
When TRUE, assigned devices are paused from receiving feature updates for up to 35 days from the time you pause the ring. When FALSE, does not pause Feature Updates. Returned by default. Query parameters are not supported.s
The Feature Updates Pause Expiry datetime. This value is 35 days from the time admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported.
The Feature Updates Pause start date. This value is the time when the admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported. This property is read-only.
The Feature Updates Rollback Start datetime.This value is the time when the admin rolled back the Feature update for the ring.Returned by default.Query parameters are not supported.
The number of days after a Feature Update for which a rollback is valid with valid range from 2 to 60 days. Returned by default. Query parameters are not supported.
The Installation Schedule. Possible values are: ActiveHoursStart, ActiveHoursEnd, ScheduledInstallDay, ScheduledInstallTime. Returned by default. Query parameters are not supported.
5 nested properties
Active Hours End
Active Hours Start
Scheduled Install Day in week. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.
Scheduled Install Time during day
The type of the entity.
When TRUE, allows Microsoft Update Service. When FALSE, does not allow Microsoft Update Service. Returned by default. Query parameters are not supported.
When TRUE the device should wait until deadline for rebooting outside of active hours. When FALSE the device should not wait until deadline for rebooting outside of active hours. Returned by default. Query parameters are not supported.
The Pre-Release Features. Possible values are: UserDefined, SettingsOnly, SettingsAndExperimentations, NotAllowed. UserDefined is the default value, no intent. Returned by default. Query parameters are not supported. Possible values are: userDefined, settingsOnly, settingsAndExperimentations, notAllowed.
Defer Quality Updates by these many days with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.
When TRUE, assigned devices are paused from receiving quality updates for up to 35 days from the time you pause the ring. When FALSE, does not pause Quality Updates. Returned by default. Query parameters are not supported.
The Quality Updates Pause Expiry datetime. This value is 35 days from the time admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported.
The Quality Updates Pause start date. This value is the time when the admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported. This property is read-only.
The Quality Updates Rollback Start datetime. This value is the time when the admin rolled back the Quality update for the ring. Returned by default. Query parameters are not supported.
Specify the period for auto-restart imminent warning notifications. Supported values: 15, 30 or 60 (minutes). Returned by default. Query parameters are not supported.
Specify the period for auto-restart warning reminder notifications. Supported values: 2, 4, 8, 12 or 24 (hours). Returned by default. Query parameters are not supported.
When TRUE, skips all checks before restart: Battery level = 40%, User presence, Display Needed, Presentation mode, Full screen mode, phone call state, game mode etc. When FALSE, does not skip all checks before restart. Returned by default. Query parameters are not supported.
Specifies what Windows Update notifications users see. Possible values are: NotConfigured, DefaultNotifications, RestartWarningsOnly, DisableAllNotifications. Returned by default. Query parameters are not supported. Possible values are: notConfigured, defaultNotifications, restartWarningsOnly, disableAllNotifications, unknownFutureValue.
Schedule the update installation on the weeks of the month. Possible values are: UserDefined, FirstWeek, SecondWeek, ThirdWeek, FourthWeek, EveryWeek. Returned by default. Query parameters are not supported. Possible values are: userDefined, firstWeek, secondWeek, thirdWeek, fourthWeek, everyWeek, unknownFutureValue.
Specifies whether to enable end user's access to pause software updates. Possible values are: NotConfigured, Enabled, Disabled. Returned by default. Query parameters are not supported. Possible values are: notConfigured, enabled, disabled.
Specifies whether to disable user's access to scan Windows Update. Possible values are: NotConfigured, Enabled, Disabled. Returned by default. Query parameters are not supported. Possible values are: notConfigured, enabled, disabled.
Admin provided description of the Device Configuration.
Represents the assignment to the Intune policy.
Present ensures the policy exists, absent ensures it is removed.
This resource configures an Audit ConfigurationPolicy in Security and Compliance Center.
Workload associated with the policy.
Specify if this policy should exist or not.
This resource configures a Auto Sensitivity label policy in Security and Compliance.
The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.
Specify if this label policy should exist or not.
The Comment parameter specifies an optional comment.
The ApplySensitivityLabel parameter specifies the label to use for the auto label policy.
The ExchangeSender parameter specifies which senders to include in the policy.
The ExchangeSenderException parameter specifies which senders to exclude in the policy.
The ExchangeSenderMemberOf parameter specifies the distribution groups, mail-enabled security groups, or dynamic distribution groups to include in the auto-labeling policy.
he ExchangeSenderMemberOf parameter specifies the distribution groups, mail-enabled security groups, or dynamic distribution groups to exclude from the auto-labeling policy.
The ExchangeSender parameter specifies which senders to include in the policy.
This AddExchangeLocation parameter specifies new Exchange locations to be added to the policy without affecting the existing ones.
The RemoveExchangeLocation parameter removes locations on Exchange from the policy.
The Mode parameter specifies the action and notification level of the auto-labeling policy.
The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value.
The AddOneDriveLocation parameter specifies the OneDrive for Business sites to add to the list of included sites when you aren't using the value All for the OneDriveLocation parameter.
The RemoveOneDriveLocation parameter specifies the OneDrive for Business sites to remove from the list of included sites when you aren't using the value All for the OneDriveLocation parameter.
This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter.
This RemoveOneDriveLocationException parameter specifies the OneDrive for Business sites to remove from the list of excluded sites when you use the value All for the OneDriveLocation parameter.
The AddOneDriveLocationException parameter specifies the OneDrive for Business sites to add to the list of excluded sites when you use the value All for the OneDriveLocation parameter.
The Priority parameter specifies the priority of the policy. The highest priority policy will take action over lower priority policies if two policies are applicable for a file.
The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter.
The AddSharePointLocation parameter specifies the SharePoint Online sites to add to the list of included sites when you aren't using the value All for the SharePointLocation parameter.
The RemoveSharePointLocationException parameter specifies the SharePoint Online sites to remove from the list of excluded sites when you use the value All for the SharePointLocation parameter.
The AddSharePointLocation parameter specifies the SharePoint Online sites to add to the list of included sites when you aren't using the value All for the SharePointLocation parameter.
The RemoveSharePointLocation parameter specifies the SharePoint Online sites to remove from the list of included sites when you aren't using the value All for the SharePointLocation parameter.
This resource configures a Auto Sensitivity Label Rule in Security and Compliance Center.
Name of the Rule.
Name of the associated Policy.
Workload the rule is associated with. Value can be: Exchange, SharePoint, OneDriveForBusiness
The AccessScope parameter specifies a condition for the auto-labeling policy rule that's based on the access scope of the content. The rule is applied to content that matches the specified access scope. Valid values are: InOrganization, NotInOrganization, None
The AnyOfRecipientAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words or phrases separated by commas.
The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions.
The Comment parameter specifies an optional comment.
The ContentContainsSensitiveInformation parameter specifies a condition for the rule that's based on a sensitive information type match in content. The rule is applied to content that contains the specified sensitive information type.
3 nested properties
Sensitive Information Content Types
Groups of sensitive information types.
Operator
The ContentExtensionMatchesWords parameter specifies a condition for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas.
The Disabled parameter specifies whether the auto-labeling policy rule is enabled or disabled.
The DocumentIsPasswordProtected parameter specifies a condition for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.
The DocumentIsUnsupported parameter specifies a condition for the auto-labeling policy rule that looks for files that can't be scanned.
The ExceptIfAccessScopeAccessScope parameter specifies an exception for the auto-labeling policy rule that's based on the access scope of the content. The rule isn't applied to content that matches the specified access scope. Valid values are: InOrganization, NotInOrganization, None
The ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words separated by commas.
The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions.
The ExceptIfContentContainsSensitiveInformation parameter specifies an exception for the auto-labeling policy rule that's based on a sensitive information type match in content. The rule isn't applied to content that contains the specified sensitive information type.
3 nested properties
Sensitive Information Content Types
Groups of sensitive information types.
Operator
The ExceptIfContentExtensionMatchesWords parameter specifies an exception for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas.
The ExceptIfDocumentIsPasswordProtected parameter specifies an exception for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.
The ExceptIfDocumentIsUnsupported parameter specifies an exception for the auto-labeling policy rule that looks for files that can't be scanned.
The ExceptIfFrom parameter specifies an exception for the auto-labeling policy rule that looks for messages from specific senders. You can use any value that uniquely identifies the sender.
The ExceptIfFromAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases separated by commas.
The ExceptIfFromAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions.
The ExceptIfFromMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent by group members. You identify the group members by their email addresses. You can enter multiple values separated by commas.
The HeaderMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions.
The ExceptIfProcessingLimitExceeded parameter specifies an exception for the auto-labeling policy rule that looks for files where scanning couldn't complete.
The ExceptIfRecipientDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The ExceptIfSenderDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains. You can specify multiple values separated by commas.
The ExceptIfSenderIpRanges parameter specifies an exception for the auto-labeling policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.
The ExceptIfSentTo parameter specifies an exception for the auto-labeling policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The ExceptIfSentToMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You identify the groups by email address. You can specify multiple values separated by commas.
The ExceptIfSubjectMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions.
The FromAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases separated by commas.
The FromAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions.
The HeaderMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions.
2 nested properties
Name of the header pattern
Regular expressions for the pattern
The ProcessingLimitExceeded parameter specifies a condition for the auto-labeling policy rule that looks for files where scanning couldn't complete. You can use this condition to create rules that work together to identify and process messages where the content couldn't be fully scanned.
The RecipientDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.
The ReportSeverityLevel parameter specifies the severity level of the incident report for content detections based on the rule. Valid values are: None, Low, Medium, High
The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule. Valid values are: Ignore, RetryThenBlock, blank
The SenderDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains.
The SenderIpRanges parameter specifies a condition for the auto-sensitivity policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.
The SentTo parameter specifies a condition for the auto-sensitivity policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient.
The SentToMemberOf parameter specifies a condition for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You identify the groups by email address.
The SubjectMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions.
Specify if this rule should exist or not.
This resource configures a eDiscovery Case Policy in Security and Compliance Center.
The Name parameter specifies the unique name of the case hold policy.
The Case parameter specifies the eDiscovery case that you want to associate with the case hold policy.
The Comment parameter specifies an optional comment.
The Enabled parameter specifies whether the policy is enabled or disabled.
The ExchangeLocation parameter specifies the mailboxes to include in the policy.
The PublicFolderLocation parameter specifies that you want to include all public folders in the case hold policy. You use the value All for this parameter.
The SharePointLocation parameter specifies the SharePoint Online and OneDrive for Business sites to include. You identify a site by its URL value.
Specify if this policy should exist or not.
This resource configures an eDiscovery Case Hold Rule in Security and Compliance.
The Name parameter specifies a unique name for the case hold rule.
The Policy parameter specifies the case hold policy that contains the rule. You can use any value that uniquely identifies the policy.
The Comment parameter specifies an optional comment.
The ContentMatchQuery parameter specifies a content search filter. Use this parameter to create a query-based hold so only the content that matches the specified search query is placed on hold. This parameter uses a text search string or a query that's formatted by using the Keyword Query Language (KQL).
The Disabled parameter specifies whether the case hold rule is enabled or disabled.
Present ensures the rule exists, absent ensures it is removed
This resource configures an eDiscovery Case in Security and Compliance.
The Name parameter specifies the unique name of the compliance case.
The description of the case.
Specify if this case should exist or not.
Status for the case. Can either be 'Active' or 'Closed'
This resource configures an Compliance Search (eDiscovery) in Security and Compliance.
The Name parameter specifies the unique name of the complaiance tag.
Compliance Case (eDiscovery) that this Search is associated with
The AllowNotFoundExchangeLocationsEnabled parameter specifies whether to include mailboxes other than regular user mailboxes in the compliance search.
The ContentMatchQuery parameter specifies a content search filter. This parameter uses a text search string or a query that's formatted by using the Keyword Query Language (KQL).
The Description parameter specifies an optional description for the compliance search. If the value contains spaces, enclose the value in quotation marks.
The ExchangeLocation parameter specifies the mailboxes to include.
This parameter specifies the mailboxes to exclude when you use the value All for the ExchangeLocation parameter.
The HoldNames parameter specifies that the content locations that have been placed on hold in the specified eDiscovery case will be searched. You use the value All for this parameter. You also need to specify the name of an eDiscovery case by using the Case parameter.
The IncludeUserAppContent parameter specifies that you want to search the cloud-based storage location for users who don't have a regular Office 365 user account in your organization. These types of users include users without an Exchange Online license who use Office applications, Office 365 guest users, and on-premises users whose identity is synchronized with your Office 365 organization.
The Language parameter specifies the language for the compliance search. Valid input for this parameter is a supported culture code value from the Microsoft .NET Framework CultureInfo class. For example, da-DK for Danish or ja-JP for Japanese.
The PublicFolderLocation parameter specifies that you want to include all public folders in the search. You use the value All for this parameter.
The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.
Specify if this search should exist or not.
This resource configures a Compliance Search Action in Security and Compliance.
The Action parameter specifies what type of action to define. Accepted values are Export, Retention and Purge.
The SearchName parameter specifies the name of the existing content search to associate with the content search action. You can specify multiple content searches separated by commas.
The FileTypeExclusionsForUnindexedItems specifies the file types to exclude because they can't be indexed. You can specify multiple values separated by commas.
The EnableDedupe parameter eliminates duplication of messages when you export content search results.
The IncludeCredential switch specifies whether to include the credential in the results.
The IncludeSharePointDocumentVersions parameter specifies whether to export previous versions of the document when you use the Export switch.
The PurgeType parameter specifies how to remove items when the action is Purge.
The RetryOnError switch specifies whether to retry the action on any items that failed without re-running the entire action all over again.
The ActionScope parameter specifies the items to include when the action is Export.
Specify if this action should exist or not.
This resource configures a Compliance Tag in Security and Compliance.
The Name parameter specifies the unique name of the complaiance tag.
Specify if this rule should exist or not.
The Comment parameter specifies an optional comment.
The EventType parameter specifies the retention rule that's associated with the label.
The IsRecordLabel parameter specifies whether the label is a record label.
The Notes parameter specifies an optional note. If you specify a value that contains spaces, enclose the value in quotation marks, for example: 'This is a user note'
Regulatory description
The FilePlanProperty parameter specifies the file plan properties to include in the label.
6 nested properties
File plan department. Can get list by running Get-FilePlanPropertyDepartment.
File plan Authority. Can get list by running Get-FilePlanPropertyAuthority.
File plan category. Can get a list by running Get-FilePlanPropertyCategory.
File plan citation. Can get a list by running Get-FilePlanPropertyCitation.
File plan reference id. Can get a list by running Get-FilePlanPropertyReferenceId.
File plan subcategory. Can get a list by running Get-FilePlanPropertySubCategory.
The ReviewerEmail parameter specifies the email address of a reviewer for Delete and KeepAndDelete retention actions. You can specify multiple email addresses separated by commas.
The RetentionDuration parameter specifies the hold duration for the retention rule. Valid values are: An integer - The hold duration in days, Unlimited - The content is held indefinitely.
The RetentionAction parameter specifies the action for the label. Valid values are: Delete, Keep or KeepAndDelete.
The RetentionType parameter specifies whether the retention duration is calculated from the content creation date, tagged date, or last modification date. Valid values are: CreationAgeInDays, EventAgeInDays,ModificationAgeInDays, or TaggedAgeInDays.
This resource configures a Device Conditional Access Policy in Security and Compliance.
The name of the Device Conditional Access Policy.
Specify if this policy should exist or not.
The Comment parameter specifies an optional comment.
The Enabled parameter specifies whether the policy is enabled.
This resource configures a Device Configuration Policy in Security and Compliance.
The name of the Device Configuration Policy.
Specify if this policy should exist or not.
The Comment parameter specifies an optional comment.
The Enabled parameter specifies whether the policy is enabled.
This resource configures a Data Loss Prevention Compliance Policy in Security and Compliance Center.
The Name parameter specifies the unique name of the DLP policy. If the value contains spaces, enclose the value in quotation marks.
The Comment parameter specifies an optional comment.
The EndpointDLPLocation parameter specifies the user accounts to include in the DLP policy for Endpoint DLP when they are logged on to an onboarded device. You identify the account by name or email address. You can use the value All to include all user accounts.
The EndpointDlpLocationException parameter specifies the user accounts to exclude from Endpoint DLP when you use the value All for the EndpointDlpLocation parameter. You identify the account by name or email address.
The OnPremisesScannerDlpLocation parameter specifies the on-premises file shares and SharePoint document libraries and folders to include in the DLP policy. You can use the value All to include all on-premises file shares and SharePoint document libraries and folders.
The OnPremisesScannerDlpLocationException parameter specifies the on-premises file shares and SharePoint document libraries and folders to exclude from the DLP policy if you use the value All for the OnPremisesScannerDlpLocation parameter.
The PowerBIDlpLocation parameter specifies the Power BI workspace IDs to include in the DLP policy. Only workspaces hosted in Premium Gen2 capacities are permitted. You can use the value All to include all supported workspaces.
The PowerBIDlpLocationException parameter specifies the Power BI workspace IDs to exclude from the DLP policy when you use the value All for the PowerBIDlpLocation parameter. Only workspaces hosted in Premium Gen2 capacities are permitted.
The ThirdPartyAppDlpLocation parameter specifies the non-Microsoft cloud apps to include in the DLP policy. You can use the value All to include all connected apps.
The ThirdPartyAppDlpLocationException parameter specifies the non-Microsoft cloud apps to exclude from the DLP policy when you use the value All for the ThirdPartyAppDlpLocation parameter.
The ExchangeLocation parameter specifies Exchange Online mailboxes to include in the DLP policy. You can only use the value All for this parameter to include all mailboxes.
Exchange members to include.
Exchange members to exclude.
The Mode parameter specifies the action and notification level of the DLP policy. Valid values are: Enable, TestWithNotifications, TestWithoutNotifications, Disable and PendingDeletion.
The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.
Priority for the Policy.
The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.
Teams locations to include
Teams locations to exclude.
Specify if this policy should exist or not.
This resource configures a Data Loss Prevention Compliance Rule in Security and Compliance Center.
Name of the Rule.
Name of the associated DLP Compliance Policy.
The AccessScope parameter specifies a condition for the DLP rule that's based on the access scope of the content. The rule is applied to content that matches the specified access scope.
The BlockAccess parameter specifies an action for the DLP rule that blocks access to the source item when the conditions of the rule are met. $true: Blocks further access to the source item that matched the rule. The owner, author, and site owner can still access the item. $false: Allows access to the source item that matched the rule. This is the default value.
The BlockAccessScope parameter specifies the scope of the block access action.
The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks.
The AdvancedRule parameter uses complex rule syntax that supports multiple AND, OR, and NOT operators and nested groups
The ContentContainsSensitiveInformation parameter specifies a condition for the rule that's based on a sensitive information type match in content. The rule is applied to content that contains the specified sensitive information type.
3 nested properties
Sensitive Information Content Types
Groups of sensitive information types.
Operator
The ExceptIfContentContainsSensitiveInformation parameter specifies an exception for the rule that's based on a sensitive information type match in content. The rule isn't applied to content that contains the specified sensitive information type.
3 nested properties
Sensitive Information Content Types
Groups of sensitive information types.
Operator
The ContentPropertyContainsWords parameter specifies a condition for the DLP rule that's based on a property match in content. The rule is applied to content that contains the specified property.
The Disabled parameter specifies whether the DLP rule is disabled.
The GenerateAlert parameter specifies an action for the DLP rule that notifies the specified users when the conditions of the rule are met.
The GenerateIncidentReport parameter specifies an action for the DLP rule that sends an incident report to the specified users when the conditions of the rule are met.
The IncidentReportContent parameter specifies the content to include in the report when you use the GenerateIncidentReport parameter.
The NotifyAllowOverride parameter specifies the notification override options when the conditions of the rule are met.
The NotifyEmailCustomText parameter specifies the custom text in the email notification message that's sent to recipients when the conditions of the rule are met.
The NotifyPolicyTipCustomText parameter specifies the custom text in the Policy Tip notification message that's shown to recipients when the conditions of the rule are met. The maximum length is 256 characters. HTML tags and tokens (variables) aren't supported.
The NotifyUser parameter specifies an action for the DLP rule that notifies the specified users when the conditions of the rule are met.
The ReportSeverityLevel parameter specifies the severity level of the incident report for content detections based on the rule.
The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule.
Specify if this rule should exist or not.
The AnyOfRecipientAddressContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in recipient email addresses.
The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in recipient email addresses by using regular expressions.
The RemoveRMSTemplate parameter specifies an action for the DLP rule that removes Office 365 Message Encryption from messages and their attachments.
The StopPolicyProcessing parameter specifies an action that stops processing more DLP policy rules.
The DocumentIsUnsupported parameter specifies a condition for the DLP rule that looks for files that can't be scanned.
The ExceptIfDocumentIsUnsupported parameter specifies an exception for the DLP rule that looks for files that can't be scanned.
The SenderOverride parameter specifies a condition for the rule that looks for messages where the sender chose to override a DLP policy.
The ExceptIfHasSenderOverride parameter specifies an exception for the rule that looks for messages where the sender chose to override a DLP policy.
The ProcessingLimitExceeded parameter specifies a condition for the DLP rule that looks for files where scanning couldn't complete.
The ExceptIfProcessingLimitExceeded parameter specifies an exception for the DLP rule that looks for files where scanning couldn't complete.
The DocumentIsPasswordProtected parameter specifies a condition for the DLP rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.
The ExceptIfDocumentIsPasswordProtected parameter specifies an exception for the DLP rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.
The MessageTypeMatches parameter specifies a condition for the DLP rule that looks for types of SMIME message patterns.
The FromScope parameter specifies whether messages from inside or outside the organisation are in scope for the DLP rule.
The ExceptIfFromScope parameter specifies whether messages from inside or outside the organisation are in scope for the DLP rule.
The SubjectContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in the Subject field of messages. You can specify multiple words or phrases separated by commas.
The SubjectMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the Subject field of messages by using regular expressions.
The SubjectOrBodyContainsWords parameter specifies a condition for the rule that looks for words in the Subject field or body of messages.
The SubjectOrBodyMatchesPatterns parameter specifies a condition for the rule that looks for text patterns in the Subject field or body of messages.
The ContentCharacterSetContainsWords parameter specifies a condition for the rule that looks for character set names in messages. You can specify multiple values separated by commas.
The DocumentNameMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the name of message attachments by using regular expressions.
The DocumentNameMatchesWords parameter specifies a condition for the DLP rule that looks for words or phrases in the name of message attachments.
he ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in recipient email addresses.
The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in recipient email addresses by using regular expressions.
The ExceptIfContentCharacterSetContainsWords parameter specifies an exception for the rule that looks for character set names in messages.
The ExceptIfContentPropertyContainsWords parameter specifies an exception for the DLP rule that's based on a property match in content.
The ExceptIfDocumentNameMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the name of message attachments by using regular expressions.
The ExceptIfDocumentNameMatchesWords parameter specifies an exception for the DLP rule that looks for words or phrases in the name of message attachments.
The ExceptIfFromAddressContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in the sender's email address.
The ExceptIfFromAddressMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the sender's email address by using regular expressions.
The FromAddressContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in the sender's email address.
The FromAddressMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the sender's email address by using regular expressions.
The ExceptIfMessageTypeMatches parameter specifies an exception for the rule that looks for messages of the specified type.
The RecipientDomainIs parameter specifies a condition for the DLP rule that looks for recipients with email addresses in the specified domains.
The ExceptIfRecipientDomainIs parameter specifies an exception for the DLP rule that looks for recipients with email addresses in the specified domains.
The ExceptIfSenderDomainIs parameter specifies an exception for the DLP rule that looks for messages from senders with email address in the specified domains.
The ExceptIfSenderIpRanges parameter specifies an exception for the DLP rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.
The ExceptIfSentTo parameter specifies an exception for the DLP rule that looks for recipients in messages. You identify the recipients by email address.
The ExceptIfSubjectContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in the Subject field of messages.
The ExceptIfSubjectMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the Subject field of messages by using regular expressions.
The ExceptIfSubjectOrBodyContainsWords parameter specifies an exception for the rule that looks for words in the Subject field or body of messages.
The ExceptIfSubjectOrBodyMatchesPatterns parameter specifies an exception for the rule that looks for text patterns in the Subject field or body of messages.
The DocumentContainsWords parameter specifies a condition for the DLP rule that looks for words in message attachments. Only supported attachment types are checked.
The SentToMemberOf parameter specifies a condition for the DLP rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups.
The ContentIsNotLabeled parameter specifies if the content is labeled. A True or False condition.
The SetHeader The SetHeader parameter specifies an action for the DLP rule that adds or modifies a header field and value in the message header. You can specify multiple header name and value pairs separated by commas
The ContentExtensionMatchesWords parameter specifies a condition for the DLP rule that looks for words in file name extensions. You can specify multiple words separated by commas.
The ExceptIfContentExtensionMatchesWords parameter specifies an exception for the DLP rule that looks for words in file name extensions. You can specify multiple words separated by commas.
This resource configures an authority entry for Security and Compliance File Plans.
The Name parameter specifies the unique name of the Authority.
Specify if this authority should exist or not.
This resource configures a category entry for Security and Compliance File Plans.
The Name parameter specifies the unique name of the category.
Specify if this category should exist or not.
This resource configures a citation entry for Security and Compliance File Plans.
The Name parameter specifies the unique name of the citation.
URL of the citation.
Jurisdiction of the citation.
Specify if this citation should exist or not.
This resource configures a department entry for Security and Compliance File Plans.
The Name parameter specifies the unique name of the department.
Specify if this department should exist or not.
This resource configures a reference ID entry for Security and Compliance File Plans.
The Name parameter specifies the unique name of the reference id.
Specify if this reference id should exist or not.
This resource configures a sub-category entry for Security and Compliance File Plans.
The Name parameter specifies the unique name of the sub-category.
The Category parameter specifies the name of the parent category associated with the sub-category.
Specify if this category should exist or not.
This resource configures a Sensitivity label policy in Security and Compliance.
The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.
Specify if this label policy should exist or not.
The Comment parameter specifies an optional comment.
The AdvancedSettings parameter enables client-specific features and capabilities on the sensitivity label. The settings that you configure with this parameter only affect apps that are designed for the setting.
The ExchangeLocation parameter specifies the mailboxes to include in the policy.
The ExchangeLocationException parameter specifies the mailboxes to exclude when you use the value All for the ExchangeLocation parameter.
The ModernGroupLocation parameter specifies the Microsoft 365 Groups to include in the policy.
The ModernGroupLocationException parameter specifies the Microsoft 365 Groups to exclude when you're using the value All for the ModernGroupLocation parameter.
The Labels parameter specifies the sensitivity labels that are associated with the policy. You can use any value that uniquely identifies the label.
The AddExchangeLocation parameter specifies the mailboxes to add in the existing policy.
The AddExchangeLocationException parameter specifies the mailboxes to add to exclusions when you use the value All for the ExchangeLocation parameter.
The AddModernGroupLocation parameter specifies the Microsoft 365 Groups to add to include the policy.
The AddModernGroupLocationException parameter specifies the Microsoft 365 Groups to add to exclusions when you're using the value All for the ModernGroupLocation parameter.
The AddLabels parameter specifies the sensitivity labels to add to the policy. You can use any value that uniquely identifies the label.
The RemoveExchangeLocation parameter specifies the mailboxes to remove from the policy.
The RemoveExchangeLocationException parameter specifies the mailboxes to remove when you use the value All for the ExchangeLocation parameter.
The RemoveModernGroupLocation parameter specifies the Microsoft 365 Groups to remove from the policy.
The RemoveModernGroupLocationException parameter specifies the Microsoft 365 Groups to remove from excluded values when you're using the value All for the ModernGroupLocation parameter.
The RemoveLabels parameter specifies the sensitivity labels that are removed from the policy. You can use any value that uniquely identifies the label.
This resource configures a Protection Alert in Security and Compliance Center.
Specifies the unique name for the alert policy
Specifies the scope for aggregated alert policies
This parameter is reserved for internal Microsoft use
Specifies how the alert policy triggers alerts for multiple occurrences of monitored activity
Specifies a category for the alert policy
Specifies an optional comment
Enables or disables the alert policy
Specify if this alert should exist or not.
The Filter parameter uses OPATH syntax to filter the results by the specified properties and values
Specifies the language or locale that's used for notifications. For example, da-DK for Danish
NotificationEnabled true or false
Specifies whether to trigger an alert for a single event when the alert policy is configured for aggregated activity
Specifies whether to temporarily suspend notifications for the alert policy. Until the specified date-time, no notifications are sent for detected activities.
Specifies the maximum number of notifications for the alert policy within the time period specified by the NotifyUserThrottleWindow parameter. Once the maximum number of notifications has been reached in the time period, no more notifications are sent for the alert.
Specifies the time interval in minutes that's used by the NotifyUserThrottleThreshold parameter
Specifies the SMTP address of the user who receives notification messages for the alert policy. You can specify multiple values separated by commas
Specifies the activities that are monitored by the alert policy
PrivacyManagementScopedSensitiveInformationTypes
PrivacyManagementScopedSensitiveInformationTypesForCounting
PrivacyManagementScopedSensitiveInformationTypesThreshold
specifies the severity of the detection
Specifies the type of activities that are monitored by the alert policy
Specifies the number of detections that trigger the alert policy within the time period specified by the TimeWindow parameter. A valid value is an integer that's greater than or equal to 3.
Specifies the time interval in minutes for number of detections specified by the Threshold parameter. A valid value is an integer that's greater than 60 (one hour).
Volume Threshold
This resource configures a Retention Compliance Policy in Security and Compliance.
The Name parameter specifies the unique name of the retention policy.
Specify if this policy should exist or not.
The Comment parameter specifies an optional comment.
Location of the dynamic scope for this policy.
Determines if the policy is enabled or not.
The ExchangeLocation parameter specifies the mailboxes to include.
This parameter specifies the mailboxes to remove from the list of excluded mailboxes when you use the value All for the ExchangeLocation parameter
The ModernGroupLocation parameter specifies the Office 365 groups to include in the policy.
The ModernGroupLocationException parameter specifies the Office 365 groups to exclude when you're using the value All for the ModernGroupLocation parameter.
The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.
The PublicFolderLocation parameter specifies that you want to include all public folders in the retention policy. You use the value All for this parameter.
The RestrictiveRetention parameter specifies whether Preservation Lock is enabled for the policy.
The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.
This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.
The SkypeLocation parameter specifies the Skype for Business Online users to include in the policy.
This parameter is reserved for internal Microsoft use.
The TeamsChannelLocation parameter specifies the Teams Channel to include in the policy.
This parameter specifies the SharePoint Online sites to exclude when you use the value All for the TeamsChannelLocation parameter. You identify the site by its URL value.
The TeamsChatLocation parameter specifies the Teams Chat to include in the policy.
This parameter specifies the SharePoint Online sites to exclude when you use the value All for the TeamsChatLocation parameter. You identify the site by its URL value.
This resource configures a Retention Compliance Rule in Security and Compliance.
The Name parameter specifies the unique name of the retention rule.
The Policy parameter specifies the policy to contain the rule.
Specify if this rule should exist or not.
The Comment parameter specifies an optional comment.
The ExpirationDateOption parameter specifies whether the expiration date is calculated from the content creation date or last modification date. Valid values are: CreationAgeInDays and ModificationAgeInDays.
The ExcludedItemClasses parameter specifies the types of messages to exclude from the rule. You can use this parameter only to exclude items from a hold policy, which excludes the specified item class from being held. Using this parameter won't exclude items from deletion policies. Typically, you use this parameter to exclude voicemail messages, IM conversations, and other Skype for Business Online content from being held by a hold policy.
The ContentMatchQuery parameter specifies a content search filter.
The RetentionComplianceAction parameter specifies the retention action for the rule. Valid values are: Delete, Keep and KeepAndDelete.
The RetentionDuration parameter specifies the hold duration for the retention rule. Valid values are: An integer - The hold duration in days, Unlimited - The content is held indefinitely.
The RetentionDurationDisplayHint parameter specifies the units that are used to display the retention duration in the Security and Compliance Center. Valid values are: Days, Months or Years.
This resource configures a Retention Event Type in Security and Compliance.
The Name parameter specifies the unique name of the retention event type.
Specify if this rule should exist or not.
The Comment parameter specifies an optional comment.
This resource configures a Security Filter in Security and Compliance.
The FilterName parameter specifies the name of the compliance security filter that you want to view. If the value contains spaces, enclose the value in quotation marks (").
The Action parameter filters the results by the type of search action that a filter is applied to.
The User parameter filters the results by the user who gets a filter applied to their searches. Acceptable values are : The alias or email address of a user, All or The name of a role group
The Description parameter specifies a description for the compliance security filter. The maximum length is 256 characters. If the value contains spaces, enclose the value in quotation marks (").
The Filters parameter specifies the search criteria for the compliance security filter. The filters are applied to the users specified by the Users parameter. You can create three different types of filters: Mailbox filter, Mailbox content filter or Site and site content filter
The Region parameter specifies the satellite location for multi-geo tenants to conduct eDiscovery searches in.
Specify if this label policy should exist or not.
This resource configures Sensitivity labels in Security and Compliance.
The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.
Specify if this rule should exist or not.
The Comment parameter specifies an optional comment.
The AdvancedSettings parameter enables client-specific features and capabilities on the sensitivity label. The settings that you configure with this parameter only affect apps that are designed for the setting.
The DisplayName parameter specifies the display name for the sensitivity label. The display name appears in the Microsoft Office and is used by Outlook users to select the appropriate sensitivity label before they send a message.
The LocaleSettings parameter specifies one or more localized label name or label Tooltips in different languages. Regions include all region codes supported in Office Client applications.
The ParentId parameter specifies the parent label that you want this label to be under (a sublabel). You can use any value that uniquely identifies the parent sensitivity label for example name.
The Priority parameter specifies a priority value for the sensitivity label that determines the order of label processing. A lower integer value indicates a higher priority.
The ToolTip parameter specifies the default tooltip and sensitivity label description that's seen by users. It the value contains spaces, enclose the value in quotation marks.
The ApplyContentMarkingFooterAlignment parameter specifies the footer alignment.
The ApplyContentMarkingFooterEnabled parameter specifies whether to enable or disable the sensitivity label.
The ApplyContentMarkingFooterFontColor parameter specifies the color of the footer text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000.
The ApplyContentMarkingFooterFontSize parameter specifies the font size (in points) of the footer text.
The ApplyContentMarkingFooterMargin parameter specifies the size (in points) of the footer margin.
The ApplyContentMarkingFooterText parameter specifies the footer text. If the value contains spaces, enclose the value in quotation marks.
The ApplyContentMarkingHeaderAlignment parameter specifies the header alignment.
The ApplyContentMarkingHeaderEnabled parameter enables or disables the Apply Content Marking Header action for the label.
The ApplyContentMarkingHeaderFontColor parameter specifies the color of the header text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000.
The ApplyContentMarkingHeaderFontSize parameter specifies the font size (in points) of the header text.
The ApplyContentMarkingHeaderMargin parameter specifies the size (in points) of the header margin.
The ApplyContentMarkingHeaderText parameter specifies the header text. If the value contains spaces, enclose the value in quotation marks.
The ApplyWaterMarkingEnabled parameter enables or disables the Apply Watermarking Header action for the label.
The ApplyWaterMarkingFontColor parameter specifies the color of the watermark text. This parameter accepts a hexadecimal color code value in the format #xxxxxx.
The ApplyWaterMarkingFontSize parameter specifies the font size (in points) of the watermark text.
The ApplyWaterMarkingAlignment parameter specifies the watermark alignment.
The ApplyWaterMarkingText parameter specifies the watermark text. If the value contains spaces, enclose the value in quotation marks.
The ContentType parameter specifies where the sensitivity label can be applied.
The EncryptionContentExpiredOnDateInDaysOrNever parameter specifies when the encrypted content expires. Valid values are integer or never.
The EncryptionDoNotForward parameter specifies whether the Do Not Forward template is applied.
The EncryptionEncryptOnly parameter specifies whether the encrypt-only template is applied.
The EncryptionEnabled parameter specifies whether encryption in enabled.
The EncryptionOfflineAccessDays parameter specifies the number of days that offline access is allowed.
The EncryptionPromptUser parameter specifies whether to set the label with user defined permission in Word, Excel, and PowerPoint.
The EncryptionProtectionType parameter specifies the protection type for encryption.
The EncryptionRightsDefinitions parameter specifies the rights users have when accessing protected. This parameter uses the syntax Identity1:Rights1,Rights2;Identity2:Rights3,Rights4. For example, john@contoso.com:VIEW,EDIT;microsoft.com:VIEW.
The EncryptionRightsUrl parameter specifies the URL for hold your own key (HYOK) protection.
The SiteAndGroupProtectionAllowAccessToGuestUsers parameter enables or disables access to guest users.
The SiteAndGroupProtectionAllowEmailFromGuestUsers parameter enables or disables email from guest users.
The SiteAndGroupProtectionAllowFullAccess parameter enables or disables full access.
The SiteAndGroupProtectionAllowLimitedAccess parameter enables or disables limited access.
The SiteAndGroupProtectionBlockAccess parameter blocks access.
The SiteAndGroupProtectionEnabled parameter enables or disables the Site and Group Protection action for the labels.
The SiteAndGroupProtectionPrivacy parameter specifies the privacy level for the label.
The SiteAndGroupExternalSharingControlType parameter specifies the external user sharing setting for the label.
This resource configures a Supervision Policy in Security and Compliance.
The Name parameter specifies the unique name for the supervisory review policy. The name can't exceed 64 characters. If the value contains spaces, enclose the value in quotation marks.
The Reviewers parameter specifies the SMTP addresses of the reviewers for the supervisory review policy. You can specify multiple email addresses separated by commas.
The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks.
Specify if this rule should exist or not.
This resource configures a Supervision Review Rule in Security and Compliance.
The Name parameter specifies the unique name for the supervisory review policy. The name can't exceed 64 characters. If the value contains spaces, enclose the value in quotation marks.
The Policy parameter specifies the supervisory review policy that's assigned to the rule. You can use any value that uniquely identifies the policy.
The Condition parameter specifies the conditions and exceptions for the rule.
The SamplingRate parameter specifies the percentage of communications for review. If you want reviewers to review all detected items, use the value 100.
Specify if this rule should exist or not.