title
Security enum values
description
Microsoft Graph security subnamespace enumeration values.
doc_type
enumPageType
ms.localizationpriority
medium
ms.subservice
security
author
BenAlfasi
ms.date
01/08/2026
Namespace: microsoft.graph.security
antispamDirectionality values
Member
unknown
inbound
outbound
intraOrg
unknownFutureValue
Member
unknown
spam
malware
phish
none
unknownFutureValue
remediationSeverity values
Member
low
medium
high
unknownFutureValue
Member
moveToJunk
moveToInbox
hardDelete
softDelete
moveToDeletedItems
unknownFutureValue
moveToQuarantine
appInfoCsaStarLevel values
Member
selfAssessment
certification
attestation
cStarAssessment
continuousMonitoring
unknown
unknownFutureValue
appInfoDataAtRestEncryptionMethod values
Member
aes
bitLocker
blowfish
des3
des
rc4
rsA
notSupported
unknown
unknownFutureValue
appInfoDataRetentionPolicy values
Member
dataRetained
deletedImmediately
deletedWithinTwoWeeks
deletedWithinOneMonth
deletedWithinThreeMonths
deletedWithinMoreThanThreeMonths
unknown
unknownFutureValue
appInfoFedRampLevel values
Member
high
moderate
low
liSaaS
unknown
unknownFutureValue
notSupported
Member
private
public
unknown
unknownFutureValue
appInfoPciDssVersion values
Member
v1
v2
v3
v3_1
v3_2
v3_2_1
notSupported
unknown
unknownFutureValue
v4
appInfoEncryptionProtocol values
Member
tls1_0
tls1_1
tls1_2
tls1_3
notApplicable
notSupported
unknown
unknownFutureValue
ssl3
appInfoUploadedDataTypes values
Member
documents
mediaFiles
codingFiles
creditCards
databaseFiles
none
unknown
unknownFutureValue
Member
true
false
unknown
unknownFutureValue
Member
userName
ipAddress
machineName
other
unknown
unknownFutureValue
mailboxConfigurationType values
Member
mailForwardingRule
owaSettings
ewsSettings
mailDelegation
userInboxRule
unknownFutureValue
Member
barracuda
bluecoat
checkpoint
ciscoAsa
ciscoIronportProxy
fortigate
paloAlto
squid
zscaler
mcafeeSwg
ciscoScanSafe
juniperSrx
sophosSg
websenseV75
websenseSiemCef
machineZoneMeraki
squidNative
ciscoFwsm
microsoftIsaW3C
sonicwall
sophosCyberoam
clavister
customParser
juniperSsg
zscalerQradar
juniperSrxSd
juniperSrxWelf
microsoftConditionalAppAccess
ciscoAsaFirepower
genericCef
genericLeef
genericW3C
iFilter
checkpointXml
checkpointSmartViewTracker
barracudaNextGenFw
barracudaNextGenFwWeblog
microsoftDefenderForEndpoint
zscalerCef
sophosXg
iboss
forcepoint
fortios
ciscoIronportWsaIi
paloAltoLeef
forcepointLeef
stormshield
contentkeeper
ciscoIronportWsaIii
checkpointCef
corrata
ciscoFirepowerV6
menloSecurityCef
watchguardXtm
openSystemsSecureWebGateway
wandera
unknownFutureValue
Member
ftp
ftps
syslogUdp
syslogTcp
syslogTls
unknownFutureValue
Member
downloadedBytes
uploadedBytes
unknown
unknownFutureValue
auditLogQueryStatus values
Member
notStarted
running
succeeded
failed
cancelled
unknownFutureValue
Member
regular
reserved
admin
dcAdmin
system
application
servicePrincipal
customPolicy
systemPolicy
partnerTechnician
guest
unknownFutureValue
actionAfterRetentionPeriod values
Member
none
delete
startDispositionReview
unknownFutureValue
behaviorDuringRetentionPeriod values
Member
doNotRetain
retain
retainAsRecord
retainAsRegulatoryRecord
unknownFutureValue
Member
text
html
markdown
unknownFutureValue
defaultRecordBehavior values
Member
startLocked
startUnlocked
unknownFutureValue
Member
detected
blocked
prevented
unknownFutureValue
eventPropagationStatus values
Member
none
inProcessing
failed
success
unknownFutureValue
Member
pending
error
success
notAvaliable
unknownFutureValue
Member
tcp
udp
unknownFutureValue
Member
open
filtered
closed
unknownFutureValue
hostReputationClassification values
Member
unknown
neutral
suspicious
malicious
unknownFutureValue
hostReputationRuleSeverity values
Member
unknown
low
medium
high
unknownFutureValue
Member
microsoft
osint
public
unknownFutureValue
intelligenceProfileKind values
Member
actor
tool
unknownFutureValue
Member
files
messages
unknownFutureValue
Member
dateLabeled
dateCreated
dateModified
dateOfEvent
unknownFutureValue
vulnerabilitySeverity values
Member
none
low
medium
high
critical
unknownFutureValue
deviceAssetIdentifier values
Member
deviceId
deviceName
remoteDeviceName
targetDeviceName
destinationDeviceName
unknownFutureValue
deviceIdEntityIdentifier values
Member
deviceId
unknownFutureValue
disableUserEntityIdentifier values
Member
accountSid
initiatingProcessAccountSid
requestAccountSid
onPremSid
unknownFutureValue
emailEntityIdentifier values
Member
networkMessageId
recipientEmailAddress
unknownFutureValue
fileEntityIdentifier values
Member
sha1
initiatingProcessSHA1
sha256
initiatingProcessSHA256
unknownFutureValue
forceUserPasswordResetEntityIdentifier values
Member
accountSid
initiatingProcessAccountSid
requestAccountSid
onPremSid
unknownFutureValue
huntingRuleErrorCode values
Member
queryExecutionFailed
queryExecutionThrottling
queryExceededResultSize
queryLimitsExceeded
queryTimeout
alertCreationFailed
alertReportNotFound
partialRowsFailed
unknownFutureValue
noImpactedEntity
huntingRuleRunStatus values
Member
running
completed
failed
partiallyFailed
unknownFutureValue
Member
full
selective
unknownFutureValue
mailboxAssetIdentifier values
Member
accountUpn
fileOwnerUpn
initiatingProcessAccountUpn
lastModifyingAccountUpn
targetAccountUpn
senderFromAddress
senderDisplayName
recipientEmailAddress
senderMailFromAddress
unknownFutureValue
markUserAsCompromisedEntityIdentifier values
Member
accountObjectId
initiatingProcessAccountObjectId
servicePrincipalId
recipientObjectId
unknownFutureValue
Member
deviceGroup
unknownFutureValue
stopAndQuarantineFileEntityIdentifier values
Member
deviceId
sha1
initiatingProcessSHA1
unknownFutureValue
userAssetIdentifier values
Member
accountObjectId
accountSid
accountUpn
accountName
accountDomain
accountId
requestAccountSid
requestAccountName
requestAccountDomain
recipientObjectId
processAccountObjectId
initiatingAccountSid
initiatingProcessAccountUpn
initiatingAccountName
initiatingAccountDomain
servicePrincipalId
servicePrincipalName
targetAccountUpn
unknownFutureValue
submissionResultCategory values
Member
notJunk
spam
phishing
malware
allowedByPolicy
blockedByPolicy
spoof
unknown
noResultAvailable
unknownFutureValue
beingAnalyzed
notSubmittedToMicrosoft
phishingSimulation
allowedDueToOrganizationOverride
blockedDueToOrganizationOverride
allowedDueToUserOverride
blockedDueToUserOverride
itemNotfound
threatsFound
noThreatsFound
domainImpersonation
userImpersonation
brandImpersonation
authenticationFailure
spoofedBlocked
spoofedAllowed
reasonLostInTransit
bulk
antispamTeamsDirection values
Member
unknown
inbound
outbound
intraorg
unknownFutureValue
teamsDeliveryLocation values
Member
unknown
teams
quarantine
failed
unknownFutureValue
teamsMessageDeliveryAction values
Member
unknown
deliveredAsSpam
delivered
blocked
replaced
unknownFutureValue
cloudAttachmentVersion values
Member
latest
recent10
recent100
all
unknownFutureValue
Member
latest
recent10
recent100
all
unknownFutureValue
Member
user
roleGroup
unknownFutureValue
contentProcessingErrorType values
Member
transient
permanent
unknownFutureValue
Member
notifyUser
blockAccess
deviceRestriction
browserRestriction
unknownFutureValue
restrictAccess
generateAlert
generateIncidentReportAction
sPBlockAnonymousAccess
sPRuntimeAccessControl
sPSharingNotifyUser
sPSharingGenerateIncidentReport
restrictWebGrounding
Member
evaluateInline
evaluateOffline
unknownFutureValue
Member
notAllowed
allowFalsePositiveOverride
allowWithJustification
allowWithoutJustification
unknownFutureValue
allowWithAcknowledgement
policyPivotProperty values
Member
none
activity
location
unknownFutureValue
protectionScopeState values
Member
notModified
modified
unknownFutureValue
Member
none
uploadText
uploadFile
downloadText
downloadFile
unknownFutureValue
Member
uploadText
uploadFile
downloadText
downloadFile
unknownFutureValue
Member
manual
automatic
recommended
none
unknownFutureValue
sensitivityLabelTarget values
Member
email
site
unifiedGroup
teamwork
unknownFutureValue
Member
manual
automatic
recommended
Member
disable
enable
forcePasswordReset
revokeAllSessions
requireUserToSignInAgain
markUserAsCompromised
unknownFutureValue
Member
unknown
new
inProgress
resolved
unknownFutureValue
Member
entraID
activeDirectory
okta
unknownFutureValue
sensorCandidateActivationMode values
Member
manual
automated
unknownFutureValue
Member
stopped
starting
running
disabled
onboarding
unknown
unknownFutureValue
Member
unknown
microsoftDefenderForEndpoint
microsoftDefenderForIdentity
microsoftDefenderForCloudApps
microsoftDefenderForOffice365
microsoft365Defender
azureAdIdentityProtection
microsoftAppGovernance
dataLossPrevention
unknownFutureValue
microsoftDefenderForCloud
microsoftSentinel
microsoftThreatIntelligence
Member
azureSubscription
awsOrganization
awsAccount
gcpOrganization
gcpProject
dockersHubOrganization
devOpsConnection
azureDevOpsOrganization
gitHubOrganization
gitLabGroup
jFrogArtifactory
unknownFutureValue
Member
domainController
adfs
adcs
entraConnect
unknownFutureValue