Microsoft Entra policy overview

Namespace: microsoft.graph


APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Microsoft Entra ID uses policies to control Microsoft Entra feature behaviors in your organization. Policies are custom rules that you can enforce on applications, service principals, groups, or on the entire organization they are assigned to.

What policies are available?

Policy type Description Examples
activityBasedTimeoutPolicies Represents a policy that controls automatic sign-out for web sessions after a period of inactivity, for applications that support activity-based timeout functionality. Configure the Azure portal to have an inactivity timeout of 15 minutes.
applicationAuthenticationMethodPolicies Represents a set of policies that restrict app management operations for applications and service principals. Configure applications or service principals to not use password secrets or enforce lifetime on secrets.
authenticationFlowsPolicies Represents a policy that controls whether external users should be able to sign up and gain a guest account via an External Identities self-service sign-up user flow. Enable your applications to support external users signing up via a self-service sign-up user flow.
authorizationPolicy Represents a policy that can control authorization settings of Microsoft Entra ID. Configure Microsoft Entra ID to block MSOL PowerShell in the tenant.
claimsMappingPolicies Represents the claim-mapping policies for WS-Fed, SAML, OAuth 2.0, and OpenID Connect protocols, for tokens issued to a specific application. Create and assign a policy to omit the basic claims from tokens issued to a service principal.
deviceRegistrationPolicy Represents the policy scope that controls quota restrictions, additional authentication, and authorization policies to register device identities to your organization. Limit the number of devices that can be registered to a user in your organization or, specify users or groups that are allowed to register devices using Microsoft Entra join or Microsoft Entra registered.
homeRealmDiscoveryPolicies Represents a policy to control Microsoft Entra authentication behavior for federated users, in particular for auto-acceleration and user authentication restrictions in federated domains. Configure all users to skip home realm discovery and be routed directly to ADFS for authentication.
tokenLifetimePolicies Represents the lifetime duration of access tokens used to access protected resources. Configure a particularly sensitive application with a shorter than default token lifetime.
tokenIssuancePolicy Represents the policy to specify the characteristics of SAML tokens issued by Microsoft Entra ID. Configure the signing algorithm or SAML token version to be used to issue the SAML token.
identitySecurityDefaultsEnforcementPolicy Represents the Microsoft Entra security defaults policy. Configure the Microsoft Entra security defaults policy to protect against common attacks.

Next steps

  • Review the different policy resource types listed above and their various methods.
  • Try the API in the Graph Explorer.