# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from . import _utilities
from . import outputs

__all__ = [
    'ApplicationApi',
    'ApplicationApiOauth2PermissionScope',
    'ApplicationAppRole',
    'ApplicationFeatureTag',
    'ApplicationOptionalClaims',
    'ApplicationOptionalClaimsAccessToken',
    'ApplicationOptionalClaimsIdToken',
    'ApplicationOptionalClaimsSaml2Token',
    'ApplicationPublicClient',
    'ApplicationRequiredResourceAccess',
    'ApplicationRequiredResourceAccessResourceAccess',
    'ApplicationSinglePageApplication',
    'ApplicationWeb',
    'ApplicationWebImplicitGrant',
    'ConditionalAccessPolicyConditions',
    'ConditionalAccessPolicyConditionsApplications',
    'ConditionalAccessPolicyConditionsLocations',
    'ConditionalAccessPolicyConditionsPlatforms',
    'ConditionalAccessPolicyConditionsUsers',
    'ConditionalAccessPolicyGrantControls',
    'ConditionalAccessPolicySessionControls',
    'InvitationMessage',
    'NamedLocationCountry',
    'NamedLocationIp',
    'ServicePrincipalAppRole',
    'ServicePrincipalFeature',
    'ServicePrincipalFeatureTag',
    'ServicePrincipalOauth2PermissionScope',
    'ServicePrincipalSamlSingleSignOn',
    'GetApplicationApiResult',
    'GetApplicationApiOauth2PermissionScopeResult',
    'GetApplicationAppRoleResult',
    'GetApplicationFeatureTagResult',
    'GetApplicationOptionalClaimResult',
    'GetApplicationOptionalClaimAccessTokenResult',
    'GetApplicationOptionalClaimIdTokenResult',
    'GetApplicationOptionalClaimSaml2TokenResult',
    'GetApplicationPublicClientResult',
    'GetApplicationRequiredResourceAccessResult',
    'GetApplicationRequiredResourceAccessResourceAccessResult',
    'GetApplicationSinglePageApplicationResult',
    'GetApplicationWebResult',
    'GetApplicationWebImplicitGrantResult',
    'GetDomainsDomainResult',
    'GetServicePrincipalAppRoleResult',
    'GetServicePrincipalFeatureResult',
    'GetServicePrincipalFeatureTagResult',
    'GetServicePrincipalOauth2PermissionScopeResult',
    'GetServicePrincipalSamlSingleSignOnResult',
    'GetServicePrincipalsServicePrincipalResult',
    'GetUsersUserResult',
]

@pulumi.output_type
class ApplicationApi(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "knownClientApplications":
            suggest = "known_client_applications"
        elif key == "mappedClaimsEnabled":
            suggest = "mapped_claims_enabled"
        elif key == "oauth2PermissionScopes":
            suggest = "oauth2_permission_scopes"
        elif key == "requestedAccessTokenVersion":
            suggest = "requested_access_token_version"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationApi. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationApi.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationApi.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 known_client_applications: Optional[Sequence[str]] = None,
                 mapped_claims_enabled: Optional[bool] = None,
                 oauth2_permission_scopes: Optional[Sequence['outputs.ApplicationApiOauth2PermissionScope']] = None,
                 requested_access_token_version: Optional[int] = None):
        """
        :param Sequence[str] known_client_applications: A set of application IDs (client IDs), used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        :param bool mapped_claims_enabled: Allows an application to use claims mapping without specifying a custom signing key. Defaults to `false`.
        :param Sequence['ApplicationApiOauth2PermissionScopeArgs'] oauth2_permission_scopes: One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        :param int requested_access_token_version: The access token version expected by this resource. Must be one of `1` or `2`, and must be `2` when `sign_in_audience` is either `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount` Defaults to `1`.
        """
        if known_client_applications is not None:
            pulumi.set(__self__, "known_client_applications", known_client_applications)
        if mapped_claims_enabled is not None:
            pulumi.set(__self__, "mapped_claims_enabled", mapped_claims_enabled)
        if oauth2_permission_scopes is not None:
            pulumi.set(__self__, "oauth2_permission_scopes", oauth2_permission_scopes)
        if requested_access_token_version is not None:
            pulumi.set(__self__, "requested_access_token_version", requested_access_token_version)

    @property
    @pulumi.getter(name="knownClientApplications")
    def known_client_applications(self) -> Optional[Sequence[str]]:
        """
        A set of application IDs (client IDs), used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        """
        return pulumi.get(self, "known_client_applications")

    @property
    @pulumi.getter(name="mappedClaimsEnabled")
    def mapped_claims_enabled(self) -> Optional[bool]:
        """
        Allows an application to use claims mapping without specifying a custom signing key. Defaults to `false`.
        """
        return pulumi.get(self, "mapped_claims_enabled")

    @property
    @pulumi.getter(name="oauth2PermissionScopes")
    def oauth2_permission_scopes(self) -> Optional[Sequence['outputs.ApplicationApiOauth2PermissionScope']]:
        """
        One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        """
        return pulumi.get(self, "oauth2_permission_scopes")

    @property
    @pulumi.getter(name="requestedAccessTokenVersion")
    def requested_access_token_version(self) -> Optional[int]:
        """
        The access token version expected by this resource. Must be one of `1` or `2`, and must be `2` when `sign_in_audience` is either `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount` Defaults to `1`.
        """
        return pulumi.get(self, "requested_access_token_version")


@pulumi.output_type
class ApplicationApiOauth2PermissionScope(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "adminConsentDescription":
            suggest = "admin_consent_description"
        elif key == "adminConsentDisplayName":
            suggest = "admin_consent_display_name"
        elif key == "userConsentDescription":
            suggest = "user_consent_description"
        elif key == "userConsentDisplayName":
            suggest = "user_consent_display_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationApiOauth2PermissionScope. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationApiOauth2PermissionScope.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationApiOauth2PermissionScope.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 id: str,
                 admin_consent_description: Optional[str] = None,
                 admin_consent_display_name: Optional[str] = None,
                 enabled: Optional[bool] = None,
                 type: Optional[str] = None,
                 user_consent_description: Optional[str] = None,
                 user_consent_display_name: Optional[str] = None,
                 value: Optional[str] = None):
        """
        :param str id: The unique identifier of the delegated permission. Must be a valid UUID.
        :param str admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param str admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param bool enabled: Determines if the permission scope is enabled. Defaults to `true`.
        :param str type: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Defaults to `User`. Possible values are `User` or `Admin`.
        :param str user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param str user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param str value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        pulumi.set(__self__, "id", id)
        if admin_consent_description is not None:
            pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        if admin_consent_display_name is not None:
            pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if type is not None:
            pulumi.set(__self__, "type", type)
        if user_consent_description is not None:
            pulumi.set(__self__, "user_consent_description", user_consent_description)
        if user_consent_display_name is not None:
            pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier of the delegated permission. Must be a valid UUID.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> Optional[str]:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> Optional[str]:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Determines if the permission scope is enabled. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def type(self) -> Optional[str]:
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Defaults to `User`. Possible values are `User` or `Admin`.
        """
        return pulumi.get(self, "type")

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> Optional[str]:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> Optional[str]:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class ApplicationAppRole(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "allowedMemberTypes":
            suggest = "allowed_member_types"
        elif key == "displayName":
            suggest = "display_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationAppRole. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationAppRole.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationAppRole.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 allowed_member_types: Sequence[str],
                 description: str,
                 display_name: str,
                 id: str,
                 enabled: Optional[bool] = None,
                 value: Optional[str] = None):
        """
        :param Sequence[str] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups by setting to `User`, or to other applications (that are accessing this application in a standalone scenario) by setting to `Application`, or to both.
        :param str description: Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        :param str display_name: Display name for the app role that appears during app role assignment and in consent experiences.
        :param str id: The unique identifier of the app role. Must be a valid UUID.
        :param bool enabled: Determines if the app role is enabled. Defaults to `true`.
        :param str value: The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "display_name", display_name)
        pulumi.set(__self__, "id", id)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> Sequence[str]:
        """
        Specifies whether this app role definition can be assigned to users and groups by setting to `User`, or to other applications (that are accessing this application in a standalone scenario) by setting to `Application`, or to both.
        """
        return pulumi.get(self, "allowed_member_types")

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> str:
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        return pulumi.get(self, "display_name")

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier of the app role. Must be a valid UUID.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Determines if the app role is enabled. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class ApplicationFeatureTag(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "customSingleSignOn":
            suggest = "custom_single_sign_on"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationFeatureTag. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationFeatureTag.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationFeatureTag.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 custom_single_sign_on: Optional[bool] = None,
                 enterprise: Optional[bool] = None,
                 gallery: Optional[bool] = None,
                 hide: Optional[bool] = None):
        """
        :param bool custom_single_sign_on: Whether this application represents a custom SAML application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        :param bool enterprise: Whether this application represents an Enterprise Application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        :param bool gallery: Whether this application represents a gallery application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        :param bool hide: Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        if custom_single_sign_on is not None:
            pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        if enterprise is not None:
            pulumi.set(__self__, "enterprise", enterprise)
        if gallery is not None:
            pulumi.set(__self__, "gallery", gallery)
        if hide is not None:
            pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> Optional[bool]:
        """
        Whether this application represents a custom SAML application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        return pulumi.get(self, "custom_single_sign_on")

    @property
    @pulumi.getter
    def enterprise(self) -> Optional[bool]:
        """
        Whether this application represents an Enterprise Application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "enterprise")

    @property
    @pulumi.getter
    def gallery(self) -> Optional[bool]:
        """
        Whether this application represents a gallery application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        return pulumi.get(self, "gallery")

    @property
    @pulumi.getter
    def hide(self) -> Optional[bool]:
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "hide")


@pulumi.output_type
class ApplicationOptionalClaims(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "accessTokens":
            suggest = "access_tokens"
        elif key == "idTokens":
            suggest = "id_tokens"
        elif key == "saml2Tokens":
            suggest = "saml2_tokens"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationOptionalClaims. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationOptionalClaims.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationOptionalClaims.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 access_tokens: Optional[Sequence['outputs.ApplicationOptionalClaimsAccessToken']] = None,
                 id_tokens: Optional[Sequence['outputs.ApplicationOptionalClaimsIdToken']] = None,
                 saml2_tokens: Optional[Sequence['outputs.ApplicationOptionalClaimsSaml2Token']] = None):
        """
        :param Sequence['ApplicationOptionalClaimsAccessTokenArgs'] access_tokens: One or more `access_token` blocks as documented below.
        :param Sequence['ApplicationOptionalClaimsIdTokenArgs'] id_tokens: One or more `id_token` blocks as documented below.
        :param Sequence['ApplicationOptionalClaimsSaml2TokenArgs'] saml2_tokens: One or more `saml2_token` blocks as documented below.
        """
        if access_tokens is not None:
            pulumi.set(__self__, "access_tokens", access_tokens)
        if id_tokens is not None:
            pulumi.set(__self__, "id_tokens", id_tokens)
        if saml2_tokens is not None:
            pulumi.set(__self__, "saml2_tokens", saml2_tokens)

    @property
    @pulumi.getter(name="accessTokens")
    def access_tokens(self) -> Optional[Sequence['outputs.ApplicationOptionalClaimsAccessToken']]:
        """
        One or more `access_token` blocks as documented below.
        """
        return pulumi.get(self, "access_tokens")

    @property
    @pulumi.getter(name="idTokens")
    def id_tokens(self) -> Optional[Sequence['outputs.ApplicationOptionalClaimsIdToken']]:
        """
        One or more `id_token` blocks as documented below.
        """
        return pulumi.get(self, "id_tokens")

    @property
    @pulumi.getter(name="saml2Tokens")
    def saml2_tokens(self) -> Optional[Sequence['outputs.ApplicationOptionalClaimsSaml2Token']]:
        """
        One or more `saml2_token` blocks as documented below.
        """
        return pulumi.get(self, "saml2_tokens")


@pulumi.output_type
class ApplicationOptionalClaimsAccessToken(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "additionalProperties":
            suggest = "additional_properties"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationOptionalClaimsAccessToken. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationOptionalClaimsAccessToken.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationOptionalClaimsAccessToken.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 name: str,
                 additional_properties: Optional[Sequence[str]] = None,
                 essential: Optional[bool] = None,
                 source: Optional[str] = None):
        """
        :param str name: The name of the optional claim.
        :param Sequence[str] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param bool essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param str source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[Sequence[str]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @property
    @pulumi.getter
    def essential(self) -> Optional[bool]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @property
    @pulumi.getter
    def source(self) -> Optional[str]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")


@pulumi.output_type
class ApplicationOptionalClaimsIdToken(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "additionalProperties":
            suggest = "additional_properties"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationOptionalClaimsIdToken. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationOptionalClaimsIdToken.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationOptionalClaimsIdToken.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 name: str,
                 additional_properties: Optional[Sequence[str]] = None,
                 essential: Optional[bool] = None,
                 source: Optional[str] = None):
        """
        :param str name: The name of the optional claim.
        :param Sequence[str] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param bool essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param str source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[Sequence[str]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @property
    @pulumi.getter
    def essential(self) -> Optional[bool]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @property
    @pulumi.getter
    def source(self) -> Optional[str]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")


@pulumi.output_type
class ApplicationOptionalClaimsSaml2Token(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "additionalProperties":
            suggest = "additional_properties"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationOptionalClaimsSaml2Token. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationOptionalClaimsSaml2Token.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationOptionalClaimsSaml2Token.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 name: str,
                 additional_properties: Optional[Sequence[str]] = None,
                 essential: Optional[bool] = None,
                 source: Optional[str] = None):
        """
        :param str name: The name of the optional claim.
        :param Sequence[str] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param bool essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param str source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[Sequence[str]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @property
    @pulumi.getter
    def essential(self) -> Optional[bool]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @property
    @pulumi.getter
    def source(self) -> Optional[str]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")


@pulumi.output_type
class ApplicationPublicClient(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "redirectUris":
            suggest = "redirect_uris"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationPublicClient. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationPublicClient.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationPublicClient.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 redirect_uris: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` or `ms-appx-web` URL.
        """
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[Sequence[str]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` or `ms-appx-web` URL.
        """
        return pulumi.get(self, "redirect_uris")


@pulumi.output_type
class ApplicationRequiredResourceAccess(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "resourceAccesses":
            suggest = "resource_accesses"
        elif key == "resourceAppId":
            suggest = "resource_app_id"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationRequiredResourceAccess. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationRequiredResourceAccess.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationRequiredResourceAccess.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 resource_accesses: Sequence['outputs.ApplicationRequiredResourceAccessResourceAccess'],
                 resource_app_id: str):
        """
        :param Sequence['ApplicationRequiredResourceAccessResourceAccessArgs'] resource_accesses: A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        :param str resource_app_id: The unique identifier for the resource that the application requires access to. This should be the Application ID of the target application.
        """
        pulumi.set(__self__, "resource_accesses", resource_accesses)
        pulumi.set(__self__, "resource_app_id", resource_app_id)

    @property
    @pulumi.getter(name="resourceAccesses")
    def resource_accesses(self) -> Sequence['outputs.ApplicationRequiredResourceAccessResourceAccess']:
        """
        A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        """
        return pulumi.get(self, "resource_accesses")

    @property
    @pulumi.getter(name="resourceAppId")
    def resource_app_id(self) -> str:
        """
        The unique identifier for the resource that the application requires access to. This should be the Application ID of the target application.
        """
        return pulumi.get(self, "resource_app_id")


@pulumi.output_type
class ApplicationRequiredResourceAccessResourceAccess(dict):
    def __init__(__self__, *,
                 id: str,
                 type: str):
        """
        :param str id: The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        :param str type: Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "type", type)

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def type(self) -> str:
        """
        Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        return pulumi.get(self, "type")


@pulumi.output_type
class ApplicationSinglePageApplication(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "redirectUris":
            suggest = "redirect_uris"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationSinglePageApplication. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationSinglePageApplication.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationSinglePageApplication.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 redirect_uris: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` URL.
        """
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[Sequence[str]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` URL.
        """
        return pulumi.get(self, "redirect_uris")


@pulumi.output_type
class ApplicationWeb(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "homepageUrl":
            suggest = "homepage_url"
        elif key == "implicitGrant":
            suggest = "implicit_grant"
        elif key == "logoutUrl":
            suggest = "logout_url"
        elif key == "redirectUris":
            suggest = "redirect_uris"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationWeb. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationWeb.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationWeb.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 homepage_url: Optional[str] = None,
                 implicit_grant: Optional['outputs.ApplicationWebImplicitGrant'] = None,
                 logout_url: Optional[str] = None,
                 redirect_uris: Optional[Sequence[str]] = None):
        """
        :param str homepage_url: Home page or landing page of the application.
        :param 'ApplicationWebImplicitGrantArgs' implicit_grant: An `implicit_grant` block as documented above.
        :param str logout_url: The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        :param Sequence[str] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `http` URL or a URN.
        """
        if homepage_url is not None:
            pulumi.set(__self__, "homepage_url", homepage_url)
        if implicit_grant is not None:
            pulumi.set(__self__, "implicit_grant", implicit_grant)
        if logout_url is not None:
            pulumi.set(__self__, "logout_url", logout_url)
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="homepageUrl")
    def homepage_url(self) -> Optional[str]:
        """
        Home page or landing page of the application.
        """
        return pulumi.get(self, "homepage_url")

    @property
    @pulumi.getter(name="implicitGrant")
    def implicit_grant(self) -> Optional['outputs.ApplicationWebImplicitGrant']:
        """
        An `implicit_grant` block as documented above.
        """
        return pulumi.get(self, "implicit_grant")

    @property
    @pulumi.getter(name="logoutUrl")
    def logout_url(self) -> Optional[str]:
        """
        The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        """
        return pulumi.get(self, "logout_url")

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[Sequence[str]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `http` URL or a URN.
        """
        return pulumi.get(self, "redirect_uris")


@pulumi.output_type
class ApplicationWebImplicitGrant(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "accessTokenIssuanceEnabled":
            suggest = "access_token_issuance_enabled"
        elif key == "idTokenIssuanceEnabled":
            suggest = "id_token_issuance_enabled"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ApplicationWebImplicitGrant. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ApplicationWebImplicitGrant.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ApplicationWebImplicitGrant.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 access_token_issuance_enabled: Optional[bool] = None,
                 id_token_issuance_enabled: Optional[bool] = None):
        """
        :param bool access_token_issuance_enabled: Whether this web application can request an access token using OAuth 2.0 implicit flow.
        :param bool id_token_issuance_enabled: Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        if access_token_issuance_enabled is not None:
            pulumi.set(__self__, "access_token_issuance_enabled", access_token_issuance_enabled)
        if id_token_issuance_enabled is not None:
            pulumi.set(__self__, "id_token_issuance_enabled", id_token_issuance_enabled)

    @property
    @pulumi.getter(name="accessTokenIssuanceEnabled")
    def access_token_issuance_enabled(self) -> Optional[bool]:
        """
        Whether this web application can request an access token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "access_token_issuance_enabled")

    @property
    @pulumi.getter(name="idTokenIssuanceEnabled")
    def id_token_issuance_enabled(self) -> Optional[bool]:
        """
        Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "id_token_issuance_enabled")


@pulumi.output_type
class ConditionalAccessPolicyConditions(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "clientAppTypes":
            suggest = "client_app_types"
        elif key == "signInRiskLevels":
            suggest = "sign_in_risk_levels"
        elif key == "userRiskLevels":
            suggest = "user_risk_levels"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ConditionalAccessPolicyConditions. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ConditionalAccessPolicyConditions.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ConditionalAccessPolicyConditions.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 applications: 'outputs.ConditionalAccessPolicyConditionsApplications',
                 client_app_types: Sequence[str],
                 locations: 'outputs.ConditionalAccessPolicyConditionsLocations',
                 platforms: 'outputs.ConditionalAccessPolicyConditionsPlatforms',
                 users: 'outputs.ConditionalAccessPolicyConditionsUsers',
                 sign_in_risk_levels: Optional[Sequence[str]] = None,
                 user_risk_levels: Optional[Sequence[str]] = None):
        """
        :param 'ConditionalAccessPolicyConditionsApplicationsArgs' applications: An `applications` block as documented below, which specifies applications and user actions included in and excluded from the policy.
        :param Sequence[str] client_app_types: A list of client application types included in the policy. Possible values are: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported` and `other`.
        :param 'ConditionalAccessPolicyConditionsLocationsArgs' locations: A `locations` block as documented below, which specifies locations included in and excluded from the policy.
        :param 'ConditionalAccessPolicyConditionsPlatformsArgs' platforms: A `platforms` block as documented below, which specifies platforms included in and excluded from the policy.
        :param 'ConditionalAccessPolicyConditionsUsersArgs' users: A `users` block as documented below, which specifies users, groups, and roles included in and excluded from the policy.
        :param Sequence[str] sign_in_risk_levels: A list of sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        :param Sequence[str] user_risk_levels: A list of user risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        pulumi.set(__self__, "applications", applications)
        pulumi.set(__self__, "client_app_types", client_app_types)
        pulumi.set(__self__, "locations", locations)
        pulumi.set(__self__, "platforms", platforms)
        pulumi.set(__self__, "users", users)
        if sign_in_risk_levels is not None:
            pulumi.set(__self__, "sign_in_risk_levels", sign_in_risk_levels)
        if user_risk_levels is not None:
            pulumi.set(__self__, "user_risk_levels", user_risk_levels)

    @property
    @pulumi.getter
    def applications(self) -> 'outputs.ConditionalAccessPolicyConditionsApplications':
        """
        An `applications` block as documented below, which specifies applications and user actions included in and excluded from the policy.
        """
        return pulumi.get(self, "applications")

    @property
    @pulumi.getter(name="clientAppTypes")
    def client_app_types(self) -> Sequence[str]:
        """
        A list of client application types included in the policy. Possible values are: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported` and `other`.
        """
        return pulumi.get(self, "client_app_types")

    @property
    @pulumi.getter
    def locations(self) -> 'outputs.ConditionalAccessPolicyConditionsLocations':
        """
        A `locations` block as documented below, which specifies locations included in and excluded from the policy.
        """
        return pulumi.get(self, "locations")

    @property
    @pulumi.getter
    def platforms(self) -> 'outputs.ConditionalAccessPolicyConditionsPlatforms':
        """
        A `platforms` block as documented below, which specifies platforms included in and excluded from the policy.
        """
        return pulumi.get(self, "platforms")

    @property
    @pulumi.getter
    def users(self) -> 'outputs.ConditionalAccessPolicyConditionsUsers':
        """
        A `users` block as documented below, which specifies users, groups, and roles included in and excluded from the policy.
        """
        return pulumi.get(self, "users")

    @property
    @pulumi.getter(name="signInRiskLevels")
    def sign_in_risk_levels(self) -> Optional[Sequence[str]]:
        """
        A list of sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        return pulumi.get(self, "sign_in_risk_levels")

    @property
    @pulumi.getter(name="userRiskLevels")
    def user_risk_levels(self) -> Optional[Sequence[str]]:
        """
        A list of user risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        return pulumi.get(self, "user_risk_levels")


@pulumi.output_type
class ConditionalAccessPolicyConditionsApplications(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "includedApplications":
            suggest = "included_applications"
        elif key == "excludedApplications":
            suggest = "excluded_applications"
        elif key == "includedUserActions":
            suggest = "included_user_actions"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ConditionalAccessPolicyConditionsApplications. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ConditionalAccessPolicyConditionsApplications.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ConditionalAccessPolicyConditionsApplications.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 included_applications: Sequence[str],
                 excluded_applications: Optional[Sequence[str]] = None,
                 included_user_actions: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] included_applications: A list of application IDs the policy applies to, unless explicitly excluded (in `excluded_applications`). Can also be set to `All`.
        :param Sequence[str] excluded_applications: A list of application IDs explicitly excluded from the policy.
        :param Sequence[str] included_user_actions: A list of user actions to include. Supported values are `urn:user:registersecurityinfo` and `urn:user:registerdevice`.
        """
        pulumi.set(__self__, "included_applications", included_applications)
        if excluded_applications is not None:
            pulumi.set(__self__, "excluded_applications", excluded_applications)
        if included_user_actions is not None:
            pulumi.set(__self__, "included_user_actions", included_user_actions)

    @property
    @pulumi.getter(name="includedApplications")
    def included_applications(self) -> Sequence[str]:
        """
        A list of application IDs the policy applies to, unless explicitly excluded (in `excluded_applications`). Can also be set to `All`.
        """
        return pulumi.get(self, "included_applications")

    @property
    @pulumi.getter(name="excludedApplications")
    def excluded_applications(self) -> Optional[Sequence[str]]:
        """
        A list of application IDs explicitly excluded from the policy.
        """
        return pulumi.get(self, "excluded_applications")

    @property
    @pulumi.getter(name="includedUserActions")
    def included_user_actions(self) -> Optional[Sequence[str]]:
        """
        A list of user actions to include. Supported values are `urn:user:registersecurityinfo` and `urn:user:registerdevice`.
        """
        return pulumi.get(self, "included_user_actions")


@pulumi.output_type
class ConditionalAccessPolicyConditionsLocations(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "includedLocations":
            suggest = "included_locations"
        elif key == "excludedLocations":
            suggest = "excluded_locations"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ConditionalAccessPolicyConditionsLocations. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ConditionalAccessPolicyConditionsLocations.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ConditionalAccessPolicyConditionsLocations.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 included_locations: Sequence[str],
                 excluded_locations: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] included_locations: A list of location IDs in scope of policy unless explicitly excluded. Can also be set to `All`, or `AllTrusted`.
        :param Sequence[str] excluded_locations: A list of location IDs excluded from scope of policy.
        """
        pulumi.set(__self__, "included_locations", included_locations)
        if excluded_locations is not None:
            pulumi.set(__self__, "excluded_locations", excluded_locations)

    @property
    @pulumi.getter(name="includedLocations")
    def included_locations(self) -> Sequence[str]:
        """
        A list of location IDs in scope of policy unless explicitly excluded. Can also be set to `All`, or `AllTrusted`.
        """
        return pulumi.get(self, "included_locations")

    @property
    @pulumi.getter(name="excludedLocations")
    def excluded_locations(self) -> Optional[Sequence[str]]:
        """
        A list of location IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_locations")


@pulumi.output_type
class ConditionalAccessPolicyConditionsPlatforms(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "includedPlatforms":
            suggest = "included_platforms"
        elif key == "excludedPlatforms":
            suggest = "excluded_platforms"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ConditionalAccessPolicyConditionsPlatforms. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ConditionalAccessPolicyConditionsPlatforms.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ConditionalAccessPolicyConditionsPlatforms.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 included_platforms: Sequence[str],
                 excluded_platforms: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] included_platforms: A list of platforms the policy applies to, unless explicitly excluded. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        :param Sequence[str] excluded_platforms: A list of platforms explicitly excluded from the policy. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        pulumi.set(__self__, "included_platforms", included_platforms)
        if excluded_platforms is not None:
            pulumi.set(__self__, "excluded_platforms", excluded_platforms)

    @property
    @pulumi.getter(name="includedPlatforms")
    def included_platforms(self) -> Sequence[str]:
        """
        A list of platforms the policy applies to, unless explicitly excluded. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        return pulumi.get(self, "included_platforms")

    @property
    @pulumi.getter(name="excludedPlatforms")
    def excluded_platforms(self) -> Optional[Sequence[str]]:
        """
        A list of platforms explicitly excluded from the policy. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        return pulumi.get(self, "excluded_platforms")


@pulumi.output_type
class ConditionalAccessPolicyConditionsUsers(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "excludedGroups":
            suggest = "excluded_groups"
        elif key == "excludedRoles":
            suggest = "excluded_roles"
        elif key == "excludedUsers":
            suggest = "excluded_users"
        elif key == "includedGroups":
            suggest = "included_groups"
        elif key == "includedRoles":
            suggest = "included_roles"
        elif key == "includedUsers":
            suggest = "included_users"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ConditionalAccessPolicyConditionsUsers. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ConditionalAccessPolicyConditionsUsers.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ConditionalAccessPolicyConditionsUsers.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 excluded_groups: Optional[Sequence[str]] = None,
                 excluded_roles: Optional[Sequence[str]] = None,
                 excluded_users: Optional[Sequence[str]] = None,
                 included_groups: Optional[Sequence[str]] = None,
                 included_roles: Optional[Sequence[str]] = None,
                 included_users: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] excluded_groups: A list of group IDs excluded from scope of policy.
        :param Sequence[str] excluded_roles: A list of role IDs excluded from scope of policy.
        :param Sequence[str] excluded_users: A list of user IDs excluded from scope of policy and/or `GuestsOrExternalUsers`.
        :param Sequence[str] included_groups: A list of group IDs in scope of policy unless explicitly excluded, or `All`.
        :param Sequence[str] included_roles: A list of role IDs in scope of policy unless explicitly excluded, or `All`.
        :param Sequence[str] included_users: A list of user IDs in scope of policy unless explicitly excluded, or `None` or `All` or `GuestsOrExternalUsers`.
        """
        if excluded_groups is not None:
            pulumi.set(__self__, "excluded_groups", excluded_groups)
        if excluded_roles is not None:
            pulumi.set(__self__, "excluded_roles", excluded_roles)
        if excluded_users is not None:
            pulumi.set(__self__, "excluded_users", excluded_users)
        if included_groups is not None:
            pulumi.set(__self__, "included_groups", included_groups)
        if included_roles is not None:
            pulumi.set(__self__, "included_roles", included_roles)
        if included_users is not None:
            pulumi.set(__self__, "included_users", included_users)

    @property
    @pulumi.getter(name="excludedGroups")
    def excluded_groups(self) -> Optional[Sequence[str]]:
        """
        A list of group IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_groups")

    @property
    @pulumi.getter(name="excludedRoles")
    def excluded_roles(self) -> Optional[Sequence[str]]:
        """
        A list of role IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_roles")

    @property
    @pulumi.getter(name="excludedUsers")
    def excluded_users(self) -> Optional[Sequence[str]]:
        """
        A list of user IDs excluded from scope of policy and/or `GuestsOrExternalUsers`.
        """
        return pulumi.get(self, "excluded_users")

    @property
    @pulumi.getter(name="includedGroups")
    def included_groups(self) -> Optional[Sequence[str]]:
        """
        A list of group IDs in scope of policy unless explicitly excluded, or `All`.
        """
        return pulumi.get(self, "included_groups")

    @property
    @pulumi.getter(name="includedRoles")
    def included_roles(self) -> Optional[Sequence[str]]:
        """
        A list of role IDs in scope of policy unless explicitly excluded, or `All`.
        """
        return pulumi.get(self, "included_roles")

    @property
    @pulumi.getter(name="includedUsers")
    def included_users(self) -> Optional[Sequence[str]]:
        """
        A list of user IDs in scope of policy unless explicitly excluded, or `None` or `All` or `GuestsOrExternalUsers`.
        """
        return pulumi.get(self, "included_users")


@pulumi.output_type
class ConditionalAccessPolicyGrantControls(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "builtInControls":
            suggest = "built_in_controls"
        elif key == "customAuthenticationFactors":
            suggest = "custom_authentication_factors"
        elif key == "termsOfUses":
            suggest = "terms_of_uses"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ConditionalAccessPolicyGrantControls. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ConditionalAccessPolicyGrantControls.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ConditionalAccessPolicyGrantControls.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 built_in_controls: Sequence[str],
                 operator: str,
                 custom_authentication_factors: Optional[Sequence[str]] = None,
                 terms_of_uses: Optional[Sequence[str]] = None):
        """
        :param Sequence[str] built_in_controls: List of built-in controls required by the policy. Possible values are: `block`, `mfa`, `approvedApplication`, `compliantApplication`, `compliantDevice`, `domainJoinedDevice`, `passwordChange` or `unknownFutureValue`.
        :param str operator: Defines the relationship of the grant controls. Possible values are: `AND`, `OR`.
        :param Sequence[str] custom_authentication_factors: List of custom controls IDs required by the policy.
        :param Sequence[str] terms_of_uses: List of terms of use IDs required by the policy.
        """
        pulumi.set(__self__, "built_in_controls", built_in_controls)
        pulumi.set(__self__, "operator", operator)
        if custom_authentication_factors is not None:
            pulumi.set(__self__, "custom_authentication_factors", custom_authentication_factors)
        if terms_of_uses is not None:
            pulumi.set(__self__, "terms_of_uses", terms_of_uses)

    @property
    @pulumi.getter(name="builtInControls")
    def built_in_controls(self) -> Sequence[str]:
        """
        List of built-in controls required by the policy. Possible values are: `block`, `mfa`, `approvedApplication`, `compliantApplication`, `compliantDevice`, `domainJoinedDevice`, `passwordChange` or `unknownFutureValue`.
        """
        return pulumi.get(self, "built_in_controls")

    @property
    @pulumi.getter
    def operator(self) -> str:
        """
        Defines the relationship of the grant controls. Possible values are: `AND`, `OR`.
        """
        return pulumi.get(self, "operator")

    @property
    @pulumi.getter(name="customAuthenticationFactors")
    def custom_authentication_factors(self) -> Optional[Sequence[str]]:
        """
        List of custom controls IDs required by the policy.
        """
        return pulumi.get(self, "custom_authentication_factors")

    @property
    @pulumi.getter(name="termsOfUses")
    def terms_of_uses(self) -> Optional[Sequence[str]]:
        """
        List of terms of use IDs required by the policy.
        """
        return pulumi.get(self, "terms_of_uses")


@pulumi.output_type
class ConditionalAccessPolicySessionControls(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "applicationEnforcedRestrictionsEnabled":
            suggest = "application_enforced_restrictions_enabled"
        elif key == "cloudAppSecurityPolicy":
            suggest = "cloud_app_security_policy"
        elif key == "signInFrequency":
            suggest = "sign_in_frequency"
        elif key == "signInFrequencyPeriod":
            suggest = "sign_in_frequency_period"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ConditionalAccessPolicySessionControls. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ConditionalAccessPolicySessionControls.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ConditionalAccessPolicySessionControls.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 application_enforced_restrictions_enabled: Optional[bool] = None,
                 cloud_app_security_policy: Optional[str] = None,
                 sign_in_frequency: Optional[int] = None,
                 sign_in_frequency_period: Optional[str] = None):
        """
        :param bool application_enforced_restrictions_enabled: Whether or not application enforced restrictions are enabled. Defaults to `false`.
        :param str cloud_app_security_policy: Enables cloud app security and specifies the cloud app security policy to use. Possible values are: `blockDownloads`, `mcasConfigured`, `monitorOnly` or `unknownFutureValue`.
        :param int sign_in_frequency: Number of days or hours to enforce sign-in frequency. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        :param str sign_in_frequency_period: The time period to enforce sign-in frequency. Possible values are: `hours` or `days`. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        """
        if application_enforced_restrictions_enabled is not None:
            pulumi.set(__self__, "application_enforced_restrictions_enabled", application_enforced_restrictions_enabled)
        if cloud_app_security_policy is not None:
            pulumi.set(__self__, "cloud_app_security_policy", cloud_app_security_policy)
        if sign_in_frequency is not None:
            pulumi.set(__self__, "sign_in_frequency", sign_in_frequency)
        if sign_in_frequency_period is not None:
            pulumi.set(__self__, "sign_in_frequency_period", sign_in_frequency_period)

    @property
    @pulumi.getter(name="applicationEnforcedRestrictionsEnabled")
    def application_enforced_restrictions_enabled(self) -> Optional[bool]:
        """
        Whether or not application enforced restrictions are enabled. Defaults to `false`.
        """
        return pulumi.get(self, "application_enforced_restrictions_enabled")

    @property
    @pulumi.getter(name="cloudAppSecurityPolicy")
    def cloud_app_security_policy(self) -> Optional[str]:
        """
        Enables cloud app security and specifies the cloud app security policy to use. Possible values are: `blockDownloads`, `mcasConfigured`, `monitorOnly` or `unknownFutureValue`.
        """
        return pulumi.get(self, "cloud_app_security_policy")

    @property
    @pulumi.getter(name="signInFrequency")
    def sign_in_frequency(self) -> Optional[int]:
        """
        Number of days or hours to enforce sign-in frequency. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        """
        return pulumi.get(self, "sign_in_frequency")

    @property
    @pulumi.getter(name="signInFrequencyPeriod")
    def sign_in_frequency_period(self) -> Optional[str]:
        """
        The time period to enforce sign-in frequency. Possible values are: `hours` or `days`. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        """
        return pulumi.get(self, "sign_in_frequency_period")


@pulumi.output_type
class InvitationMessage(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "additionalRecipients":
            suggest = "additional_recipients"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in InvitationMessage. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        InvitationMessage.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        InvitationMessage.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 additional_recipients: Optional[str] = None,
                 body: Optional[str] = None,
                 language: Optional[str] = None):
        """
        :param str additional_recipients: Email addresses of additional recipients the invitation message should be sent to. Only 1 additional recipient is currently supported by Azure.
        :param str body: Customized message body you want to send if you don't want to send the default message. Cannot be specified with `language`.
        :param str language: The language you want to send the default message in. The value specified must be in ISO 639 format. Defaults to `en-US`. Cannot be specified with `body`.
        """
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)
        if body is not None:
            pulumi.set(__self__, "body", body)
        if language is not None:
            pulumi.set(__self__, "language", language)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[str]:
        """
        Email addresses of additional recipients the invitation message should be sent to. Only 1 additional recipient is currently supported by Azure.
        """
        return pulumi.get(self, "additional_recipients")

    @property
    @pulumi.getter
    def body(self) -> Optional[str]:
        """
        Customized message body you want to send if you don't want to send the default message. Cannot be specified with `language`.
        """
        return pulumi.get(self, "body")

    @property
    @pulumi.getter
    def language(self) -> Optional[str]:
        """
        The language you want to send the default message in. The value specified must be in ISO 639 format. Defaults to `en-US`. Cannot be specified with `body`.
        """
        return pulumi.get(self, "language")


@pulumi.output_type
class NamedLocationCountry(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "countriesAndRegions":
            suggest = "countries_and_regions"
        elif key == "includeUnknownCountriesAndRegions":
            suggest = "include_unknown_countries_and_regions"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in NamedLocationCountry. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        NamedLocationCountry.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        NamedLocationCountry.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 countries_and_regions: Sequence[str],
                 include_unknown_countries_and_regions: Optional[bool] = None):
        """
        :param Sequence[str] countries_and_regions: List of countries and/or regions in two-letter format specified by ISO 3166-2.
        :param bool include_unknown_countries_and_regions: Whether IP addresses that don't map to a country or region should be included in the named location. Defaults to `false`.
        """
        pulumi.set(__self__, "countries_and_regions", countries_and_regions)
        if include_unknown_countries_and_regions is not None:
            pulumi.set(__self__, "include_unknown_countries_and_regions", include_unknown_countries_and_regions)

    @property
    @pulumi.getter(name="countriesAndRegions")
    def countries_and_regions(self) -> Sequence[str]:
        """
        List of countries and/or regions in two-letter format specified by ISO 3166-2.
        """
        return pulumi.get(self, "countries_and_regions")

    @property
    @pulumi.getter(name="includeUnknownCountriesAndRegions")
    def include_unknown_countries_and_regions(self) -> Optional[bool]:
        """
        Whether IP addresses that don't map to a country or region should be included in the named location. Defaults to `false`.
        """
        return pulumi.get(self, "include_unknown_countries_and_regions")


@pulumi.output_type
class NamedLocationIp(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "ipRanges":
            suggest = "ip_ranges"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in NamedLocationIp. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        NamedLocationIp.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        NamedLocationIp.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 ip_ranges: Sequence[str],
                 trusted: Optional[bool] = None):
        """
        :param Sequence[str] ip_ranges: List of IP address ranges in IPv4 CIDR format (e.g. 1.2.3.4/32) or any allowable IPv6 format from IETF RFC596.
        :param bool trusted: Whether the named location is trusted. Defaults to `false`.
        """
        pulumi.set(__self__, "ip_ranges", ip_ranges)
        if trusted is not None:
            pulumi.set(__self__, "trusted", trusted)

    @property
    @pulumi.getter(name="ipRanges")
    def ip_ranges(self) -> Sequence[str]:
        """
        List of IP address ranges in IPv4 CIDR format (e.g. 1.2.3.4/32) or any allowable IPv6 format from IETF RFC596.
        """
        return pulumi.get(self, "ip_ranges")

    @property
    @pulumi.getter
    def trusted(self) -> Optional[bool]:
        """
        Whether the named location is trusted. Defaults to `false`.
        """
        return pulumi.get(self, "trusted")


@pulumi.output_type
class ServicePrincipalAppRole(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "allowedMemberTypes":
            suggest = "allowed_member_types"
        elif key == "displayName":
            suggest = "display_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ServicePrincipalAppRole. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ServicePrincipalAppRole.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ServicePrincipalAppRole.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 allowed_member_types: Optional[Sequence[str]] = None,
                 description: Optional[str] = None,
                 display_name: Optional[str] = None,
                 enabled: Optional[bool] = None,
                 id: Optional[str] = None,
                 value: Optional[str] = None):
        """
        :param Sequence[str] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are: `User` and `Application`, or both.
        :param str description: A description of the service principal provided for internal end-users.
        :param str display_name: Display name for the app role that appears during app role assignment and in consent experiences.
        :param bool enabled: Specifies whether the permission scope is enabled.
        :param str id: The unique identifier of the delegated permission.
        :param str value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        if allowed_member_types is not None:
            pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if display_name is not None:
            pulumi.set(__self__, "display_name", display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> Optional[Sequence[str]]:
        """
        Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are: `User` and `Application`, or both.
        """
        return pulumi.get(self, "allowed_member_types")

    @property
    @pulumi.getter
    def description(self) -> Optional[str]:
        """
        A description of the service principal provided for internal end-users.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> Optional[str]:
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        return pulumi.get(self, "display_name")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Specifies whether the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def id(self) -> Optional[str]:
        """
        The unique identifier of the delegated permission.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class ServicePrincipalFeature(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "customSingleSignOnApp":
            suggest = "custom_single_sign_on_app"
        elif key == "enterpriseApplication":
            suggest = "enterprise_application"
        elif key == "galleryApplication":
            suggest = "gallery_application"
        elif key == "visibleToUsers":
            suggest = "visible_to_users"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ServicePrincipalFeature. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ServicePrincipalFeature.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ServicePrincipalFeature.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 custom_single_sign_on_app: Optional[bool] = None,
                 enterprise_application: Optional[bool] = None,
                 gallery_application: Optional[bool] = None,
                 visible_to_users: Optional[bool] = None):
        if custom_single_sign_on_app is not None:
            pulumi.set(__self__, "custom_single_sign_on_app", custom_single_sign_on_app)
        if enterprise_application is not None:
            pulumi.set(__self__, "enterprise_application", enterprise_application)
        if gallery_application is not None:
            pulumi.set(__self__, "gallery_application", gallery_application)
        if visible_to_users is not None:
            pulumi.set(__self__, "visible_to_users", visible_to_users)

    @property
    @pulumi.getter(name="customSingleSignOnApp")
    def custom_single_sign_on_app(self) -> Optional[bool]:
        return pulumi.get(self, "custom_single_sign_on_app")

    @property
    @pulumi.getter(name="enterpriseApplication")
    def enterprise_application(self) -> Optional[bool]:
        return pulumi.get(self, "enterprise_application")

    @property
    @pulumi.getter(name="galleryApplication")
    def gallery_application(self) -> Optional[bool]:
        return pulumi.get(self, "gallery_application")

    @property
    @pulumi.getter(name="visibleToUsers")
    def visible_to_users(self) -> Optional[bool]:
        return pulumi.get(self, "visible_to_users")


@pulumi.output_type
class ServicePrincipalFeatureTag(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "customSingleSignOn":
            suggest = "custom_single_sign_on"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ServicePrincipalFeatureTag. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ServicePrincipalFeatureTag.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ServicePrincipalFeatureTag.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 custom_single_sign_on: Optional[bool] = None,
                 enterprise: Optional[bool] = None,
                 gallery: Optional[bool] = None,
                 hide: Optional[bool] = None):
        """
        :param bool custom_single_sign_on: Whether this service principal represents a custom SAML application. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        :param bool enterprise: Whether this service principal represents an Enterprise Application. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        :param bool gallery: Whether this service principal represents a gallery application. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        :param bool hide: Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        if custom_single_sign_on is not None:
            pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        if enterprise is not None:
            pulumi.set(__self__, "enterprise", enterprise)
        if gallery is not None:
            pulumi.set(__self__, "gallery", gallery)
        if hide is not None:
            pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> Optional[bool]:
        """
        Whether this service principal represents a custom SAML application. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        return pulumi.get(self, "custom_single_sign_on")

    @property
    @pulumi.getter
    def enterprise(self) -> Optional[bool]:
        """
        Whether this service principal represents an Enterprise Application. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "enterprise")

    @property
    @pulumi.getter
    def gallery(self) -> Optional[bool]:
        """
        Whether this service principal represents a gallery application. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        return pulumi.get(self, "gallery")

    @property
    @pulumi.getter
    def hide(self) -> Optional[bool]:
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "hide")


@pulumi.output_type
class ServicePrincipalOauth2PermissionScope(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "adminConsentDescription":
            suggest = "admin_consent_description"
        elif key == "adminConsentDisplayName":
            suggest = "admin_consent_display_name"
        elif key == "userConsentDescription":
            suggest = "user_consent_description"
        elif key == "userConsentDisplayName":
            suggest = "user_consent_display_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ServicePrincipalOauth2PermissionScope. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ServicePrincipalOauth2PermissionScope.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ServicePrincipalOauth2PermissionScope.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 admin_consent_description: Optional[str] = None,
                 admin_consent_display_name: Optional[str] = None,
                 enabled: Optional[bool] = None,
                 id: Optional[str] = None,
                 type: Optional[str] = None,
                 user_consent_description: Optional[str] = None,
                 user_consent_display_name: Optional[str] = None,
                 value: Optional[str] = None):
        """
        :param str admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param str admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param bool enabled: Specifies whether the permission scope is enabled.
        :param str id: The unique identifier of the delegated permission.
        :param str type: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        :param str user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param str user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param str value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        if admin_consent_description is not None:
            pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        if admin_consent_display_name is not None:
            pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if type is not None:
            pulumi.set(__self__, "type", type)
        if user_consent_description is not None:
            pulumi.set(__self__, "user_consent_description", user_consent_description)
        if user_consent_display_name is not None:
            pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> Optional[str]:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> Optional[str]:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        """
        Specifies whether the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def id(self) -> Optional[str]:
        """
        The unique identifier of the delegated permission.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def type(self) -> Optional[str]:
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        """
        return pulumi.get(self, "type")

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> Optional[str]:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> Optional[str]:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class ServicePrincipalSamlSingleSignOn(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "relayState":
            suggest = "relay_state"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ServicePrincipalSamlSingleSignOn. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ServicePrincipalSamlSingleSignOn.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ServicePrincipalSamlSingleSignOn.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 relay_state: Optional[str] = None):
        """
        :param str relay_state: The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        if relay_state is not None:
            pulumi.set(__self__, "relay_state", relay_state)

    @property
    @pulumi.getter(name="relayState")
    def relay_state(self) -> Optional[str]:
        """
        The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        return pulumi.get(self, "relay_state")


@pulumi.output_type
class GetApplicationApiResult(dict):
    def __init__(__self__, *,
                 known_client_applications: Sequence[str],
                 mapped_claims_enabled: bool,
                 oauth2_permission_scopes: Sequence['outputs.GetApplicationApiOauth2PermissionScopeResult'],
                 requested_access_token_version: int):
        """
        :param Sequence[str] known_client_applications: A set of application IDs (client IDs), used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        :param bool mapped_claims_enabled: Allows an application to use claims mapping without specifying a custom signing key.
        :param Sequence['GetApplicationApiOauth2PermissionScopeArgs'] oauth2_permission_scopes: One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        :param int requested_access_token_version: The access token version expected by this resource. Possible values are `1` or `2`.
        """
        pulumi.set(__self__, "known_client_applications", known_client_applications)
        pulumi.set(__self__, "mapped_claims_enabled", mapped_claims_enabled)
        pulumi.set(__self__, "oauth2_permission_scopes", oauth2_permission_scopes)
        pulumi.set(__self__, "requested_access_token_version", requested_access_token_version)

    @property
    @pulumi.getter(name="knownClientApplications")
    def known_client_applications(self) -> Sequence[str]:
        """
        A set of application IDs (client IDs), used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        """
        return pulumi.get(self, "known_client_applications")

    @property
    @pulumi.getter(name="mappedClaimsEnabled")
    def mapped_claims_enabled(self) -> bool:
        """
        Allows an application to use claims mapping without specifying a custom signing key.
        """
        return pulumi.get(self, "mapped_claims_enabled")

    @property
    @pulumi.getter(name="oauth2PermissionScopes")
    def oauth2_permission_scopes(self) -> Sequence['outputs.GetApplicationApiOauth2PermissionScopeResult']:
        """
        One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        """
        return pulumi.get(self, "oauth2_permission_scopes")

    @property
    @pulumi.getter(name="requestedAccessTokenVersion")
    def requested_access_token_version(self) -> int:
        """
        The access token version expected by this resource. Possible values are `1` or `2`.
        """
        return pulumi.get(self, "requested_access_token_version")


@pulumi.output_type
class GetApplicationApiOauth2PermissionScopeResult(dict):
    def __init__(__self__, *,
                 admin_consent_description: str,
                 admin_consent_display_name: str,
                 enabled: bool,
                 id: str,
                 type: str,
                 user_consent_description: str,
                 user_consent_display_name: str,
                 value: str):
        """
        :param str admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param str admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param bool enabled: Determines if the app role is enabled.
        :param str id: The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        :param str type: Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        :param str user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param str user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param str value: The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "type", type)
        pulumi.set(__self__, "user_consent_description", user_consent_description)
        pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> str:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> str:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @property
    @pulumi.getter
    def enabled(self) -> bool:
        """
        Determines if the app role is enabled.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def type(self) -> str:
        """
        Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        return pulumi.get(self, "type")

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> str:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> str:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class GetApplicationAppRoleResult(dict):
    def __init__(__self__, *,
                 allowed_member_types: Sequence[str],
                 description: str,
                 display_name: str,
                 enabled: bool,
                 id: str,
                 value: str):
        """
        :param Sequence[str] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are `User` or `Application`, or both.
        :param str description: Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        :param str display_name: Specifies the display name of the application.
        :param bool enabled: Determines if the app role is enabled.
        :param str id: The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        :param str value: The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "display_name", display_name)
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> Sequence[str]:
        """
        Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are `User` or `Application`, or both.
        """
        return pulumi.get(self, "allowed_member_types")

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> str:
        """
        Specifies the display name of the application.
        """
        return pulumi.get(self, "display_name")

    @property
    @pulumi.getter
    def enabled(self) -> bool:
        """
        Determines if the app role is enabled.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class GetApplicationFeatureTagResult(dict):
    def __init__(__self__, *,
                 custom_single_sign_on: Optional[bool] = None,
                 enterprise: Optional[bool] = None,
                 gallery: Optional[bool] = None,
                 hide: Optional[bool] = None):
        """
        :param bool custom_single_sign_on: Whether this application represents a custom SAML application for linked service principals.
        :param bool enterprise: Whether this application represents an Enterprise Application for linked service principals.
        :param bool gallery: Whether this application represents a gallery application for linked service principals.
        :param bool hide: Whether this app is visible to users in My Apps and Office 365 Launcher.
        """
        if custom_single_sign_on is not None:
            pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        if enterprise is not None:
            pulumi.set(__self__, "enterprise", enterprise)
        if gallery is not None:
            pulumi.set(__self__, "gallery", gallery)
        if hide is not None:
            pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> Optional[bool]:
        """
        Whether this application represents a custom SAML application for linked service principals.
        """
        return pulumi.get(self, "custom_single_sign_on")

    @property
    @pulumi.getter
    def enterprise(self) -> Optional[bool]:
        """
        Whether this application represents an Enterprise Application for linked service principals.
        """
        return pulumi.get(self, "enterprise")

    @property
    @pulumi.getter
    def gallery(self) -> Optional[bool]:
        """
        Whether this application represents a gallery application for linked service principals.
        """
        return pulumi.get(self, "gallery")

    @property
    @pulumi.getter
    def hide(self) -> Optional[bool]:
        """
        Whether this app is visible to users in My Apps and Office 365 Launcher.
        """
        return pulumi.get(self, "hide")


@pulumi.output_type
class GetApplicationOptionalClaimResult(dict):
    def __init__(__self__, *,
                 access_tokens: Optional[Sequence['outputs.GetApplicationOptionalClaimAccessTokenResult']] = None,
                 id_tokens: Optional[Sequence['outputs.GetApplicationOptionalClaimIdTokenResult']] = None,
                 saml2_tokens: Optional[Sequence['outputs.GetApplicationOptionalClaimSaml2TokenResult']] = None):
        """
        :param Sequence['GetApplicationOptionalClaimAccessTokenArgs'] access_tokens: One or more `access_token` blocks as documented below.
        :param Sequence['GetApplicationOptionalClaimIdTokenArgs'] id_tokens: One or more `id_token` blocks as documented below.
        :param Sequence['GetApplicationOptionalClaimSaml2TokenArgs'] saml2_tokens: One or more `saml2_token` blocks as documented below.
        """
        if access_tokens is not None:
            pulumi.set(__self__, "access_tokens", access_tokens)
        if id_tokens is not None:
            pulumi.set(__self__, "id_tokens", id_tokens)
        if saml2_tokens is not None:
            pulumi.set(__self__, "saml2_tokens", saml2_tokens)

    @property
    @pulumi.getter(name="accessTokens")
    def access_tokens(self) -> Optional[Sequence['outputs.GetApplicationOptionalClaimAccessTokenResult']]:
        """
        One or more `access_token` blocks as documented below.
        """
        return pulumi.get(self, "access_tokens")

    @property
    @pulumi.getter(name="idTokens")
    def id_tokens(self) -> Optional[Sequence['outputs.GetApplicationOptionalClaimIdTokenResult']]:
        """
        One or more `id_token` blocks as documented below.
        """
        return pulumi.get(self, "id_tokens")

    @property
    @pulumi.getter(name="saml2Tokens")
    def saml2_tokens(self) -> Optional[Sequence['outputs.GetApplicationOptionalClaimSaml2TokenResult']]:
        """
        One or more `saml2_token` blocks as documented below.
        """
        return pulumi.get(self, "saml2_tokens")


@pulumi.output_type
class GetApplicationOptionalClaimAccessTokenResult(dict):
    def __init__(__self__, *,
                 name: str,
                 additional_properties: Optional[Sequence[str]] = None,
                 essential: Optional[bool] = None,
                 source: Optional[str] = None):
        """
        :param str name: The name of the optional claim.
        :param Sequence[str] additional_properties: List of Additional Properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param bool essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param str source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[Sequence[str]]:
        """
        List of Additional Properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @property
    @pulumi.getter
    def essential(self) -> Optional[bool]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @property
    @pulumi.getter
    def source(self) -> Optional[str]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")


@pulumi.output_type
class GetApplicationOptionalClaimIdTokenResult(dict):
    def __init__(__self__, *,
                 name: str,
                 additional_properties: Optional[Sequence[str]] = None,
                 essential: Optional[bool] = None,
                 source: Optional[str] = None):
        """
        :param str name: The name of the optional claim.
        :param Sequence[str] additional_properties: List of Additional Properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param bool essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param str source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[Sequence[str]]:
        """
        List of Additional Properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @property
    @pulumi.getter
    def essential(self) -> Optional[bool]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @property
    @pulumi.getter
    def source(self) -> Optional[str]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")


@pulumi.output_type
class GetApplicationOptionalClaimSaml2TokenResult(dict):
    def __init__(__self__, *,
                 name: str,
                 additional_properties: Optional[Sequence[str]] = None,
                 essential: Optional[bool] = None,
                 source: Optional[str] = None):
        """
        :param str name: The name of the optional claim.
        :param Sequence[str] additional_properties: List of Additional Properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param bool essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param str source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[Sequence[str]]:
        """
        List of Additional Properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @property
    @pulumi.getter
    def essential(self) -> Optional[bool]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @property
    @pulumi.getter
    def source(self) -> Optional[str]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")


@pulumi.output_type
class GetApplicationPublicClientResult(dict):
    def __init__(__self__, *,
                 redirect_uris: Sequence[str]):
        """
        :param Sequence[str] redirect_uris: A list of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
        """
        pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Sequence[str]:
        """
        A list of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
        """
        return pulumi.get(self, "redirect_uris")


@pulumi.output_type
class GetApplicationRequiredResourceAccessResult(dict):
    def __init__(__self__, *,
                 resource_accesses: Sequence['outputs.GetApplicationRequiredResourceAccessResourceAccessResult'],
                 resource_app_id: str):
        """
        :param Sequence['GetApplicationRequiredResourceAccessResourceAccessArgs'] resource_accesses: A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        :param str resource_app_id: The unique identifier for the resource that the application requires access to. This is the Application ID of the target application.
        """
        pulumi.set(__self__, "resource_accesses", resource_accesses)
        pulumi.set(__self__, "resource_app_id", resource_app_id)

    @property
    @pulumi.getter(name="resourceAccesses")
    def resource_accesses(self) -> Sequence['outputs.GetApplicationRequiredResourceAccessResourceAccessResult']:
        """
        A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        """
        return pulumi.get(self, "resource_accesses")

    @property
    @pulumi.getter(name="resourceAppId")
    def resource_app_id(self) -> str:
        """
        The unique identifier for the resource that the application requires access to. This is the Application ID of the target application.
        """
        return pulumi.get(self, "resource_app_id")


@pulumi.output_type
class GetApplicationRequiredResourceAccessResourceAccessResult(dict):
    def __init__(__self__, *,
                 id: str,
                 type: str):
        """
        :param str id: The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        :param str type: Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "type", type)

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def type(self) -> str:
        """
        Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        return pulumi.get(self, "type")


@pulumi.output_type
class GetApplicationSinglePageApplicationResult(dict):
    def __init__(__self__, *,
                 redirect_uris: Sequence[str]):
        """
        :param Sequence[str] redirect_uris: A list of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
        """
        pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Sequence[str]:
        """
        A list of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
        """
        return pulumi.get(self, "redirect_uris")


@pulumi.output_type
class GetApplicationWebResult(dict):
    def __init__(__self__, *,
                 homepage_url: str,
                 implicit_grants: Sequence['outputs.GetApplicationWebImplicitGrantResult'],
                 logout_url: str,
                 redirect_uris: Sequence[str]):
        """
        :param str homepage_url: Home page or landing page of the application.
        :param Sequence['GetApplicationWebImplicitGrantArgs'] implicit_grants: An `implicit_grant` block as documented above.
        :param str logout_url: The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        :param Sequence[str] redirect_uris: A list of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
        """
        pulumi.set(__self__, "homepage_url", homepage_url)
        pulumi.set(__self__, "implicit_grants", implicit_grants)
        pulumi.set(__self__, "logout_url", logout_url)
        pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="homepageUrl")
    def homepage_url(self) -> str:
        """
        Home page or landing page of the application.
        """
        return pulumi.get(self, "homepage_url")

    @property
    @pulumi.getter(name="implicitGrants")
    def implicit_grants(self) -> Sequence['outputs.GetApplicationWebImplicitGrantResult']:
        """
        An `implicit_grant` block as documented above.
        """
        return pulumi.get(self, "implicit_grants")

    @property
    @pulumi.getter(name="logoutUrl")
    def logout_url(self) -> str:
        """
        The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        """
        return pulumi.get(self, "logout_url")

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Sequence[str]:
        """
        A list of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
        """
        return pulumi.get(self, "redirect_uris")


@pulumi.output_type
class GetApplicationWebImplicitGrantResult(dict):
    def __init__(__self__, *,
                 access_token_issuance_enabled: bool,
                 id_token_issuance_enabled: bool):
        """
        :param bool access_token_issuance_enabled: Whether this web application can request an access token using OAuth 2.0 implicit flow.
        :param bool id_token_issuance_enabled: Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        pulumi.set(__self__, "access_token_issuance_enabled", access_token_issuance_enabled)
        pulumi.set(__self__, "id_token_issuance_enabled", id_token_issuance_enabled)

    @property
    @pulumi.getter(name="accessTokenIssuanceEnabled")
    def access_token_issuance_enabled(self) -> bool:
        """
        Whether this web application can request an access token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "access_token_issuance_enabled")

    @property
    @pulumi.getter(name="idTokenIssuanceEnabled")
    def id_token_issuance_enabled(self) -> bool:
        """
        Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "id_token_issuance_enabled")


@pulumi.output_type
class GetDomainsDomainResult(dict):
    def __init__(__self__, *,
                 admin_managed: bool,
                 authentication_type: str,
                 default: bool,
                 domain_name: str,
                 initial: bool,
                 root: bool,
                 supported_services: Sequence[str],
                 verified: bool):
        """
        :param bool admin_managed: Set to `true` to only return domains whose DNS is managed by Microsoft 365. Defaults to `false`.
        :param str authentication_type: The authentication type of the domain. Possible values include `Managed` or `Federated`.
        :param bool default: Whether this is the default domain that is used for user creation.
        :param str domain_name: The name of the domain.
        :param bool initial: Whether this is the initial domain created by Azure Active Directory.
        :param bool root: Whether the domain is a verified root domain (not a subdomain).
        :param Sequence[str] supported_services: A list of capabilities / services supported by the domain. Possible values include `Email`, `Sharepoint`, `EmailInternalRelayOnly`, `OfficeCommunicationsOnline`, `SharePointDefaultDomain`, `FullRedelegation`, `SharePointPublic`, `OrgIdAuthentication`, `Yammer` and `Intune`.
        :param bool verified: Whether the domain has completed domain ownership verification.
        """
        pulumi.set(__self__, "admin_managed", admin_managed)
        pulumi.set(__self__, "authentication_type", authentication_type)
        pulumi.set(__self__, "default", default)
        pulumi.set(__self__, "domain_name", domain_name)
        pulumi.set(__self__, "initial", initial)
        pulumi.set(__self__, "root", root)
        pulumi.set(__self__, "supported_services", supported_services)
        pulumi.set(__self__, "verified", verified)

    @property
    @pulumi.getter(name="adminManaged")
    def admin_managed(self) -> bool:
        """
        Set to `true` to only return domains whose DNS is managed by Microsoft 365. Defaults to `false`.
        """
        return pulumi.get(self, "admin_managed")

    @property
    @pulumi.getter(name="authenticationType")
    def authentication_type(self) -> str:
        """
        The authentication type of the domain. Possible values include `Managed` or `Federated`.
        """
        return pulumi.get(self, "authentication_type")

    @property
    @pulumi.getter
    def default(self) -> bool:
        """
        Whether this is the default domain that is used for user creation.
        """
        return pulumi.get(self, "default")

    @property
    @pulumi.getter(name="domainName")
    def domain_name(self) -> str:
        """
        The name of the domain.
        """
        return pulumi.get(self, "domain_name")

    @property
    @pulumi.getter
    def initial(self) -> bool:
        """
        Whether this is the initial domain created by Azure Active Directory.
        """
        return pulumi.get(self, "initial")

    @property
    @pulumi.getter
    def root(self) -> bool:
        """
        Whether the domain is a verified root domain (not a subdomain).
        """
        return pulumi.get(self, "root")

    @property
    @pulumi.getter(name="supportedServices")
    def supported_services(self) -> Sequence[str]:
        """
        A list of capabilities / services supported by the domain. Possible values include `Email`, `Sharepoint`, `EmailInternalRelayOnly`, `OfficeCommunicationsOnline`, `SharePointDefaultDomain`, `FullRedelegation`, `SharePointPublic`, `OrgIdAuthentication`, `Yammer` and `Intune`.
        """
        return pulumi.get(self, "supported_services")

    @property
    @pulumi.getter
    def verified(self) -> bool:
        """
        Whether the domain has completed domain ownership verification.
        """
        return pulumi.get(self, "verified")


@pulumi.output_type
class GetServicePrincipalAppRoleResult(dict):
    def __init__(__self__, *,
                 allowed_member_types: Sequence[str],
                 description: str,
                 display_name: str,
                 enabled: bool,
                 id: str,
                 value: str):
        """
        :param Sequence[str] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in daemon service scenarios). Possible values are: `User` and `Application`, or both.
        :param str description: Permission help text that appears in the admin app assignment and consent experiences.
        :param str display_name: The display name of the application associated with this service principal.
        :param bool enabled: Determines if the permission scope is enabled.
        :param str id: The unique identifier of the delegated permission. Must be a valid UUID.
        :param str value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "display_name", display_name)
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> Sequence[str]:
        """
        Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in daemon service scenarios). Possible values are: `User` and `Application`, or both.
        """
        return pulumi.get(self, "allowed_member_types")

    @property
    @pulumi.getter
    def description(self) -> str:
        """
        Permission help text that appears in the admin app assignment and consent experiences.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> str:
        """
        The display name of the application associated with this service principal.
        """
        return pulumi.get(self, "display_name")

    @property
    @pulumi.getter
    def enabled(self) -> bool:
        """
        Determines if the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier of the delegated permission. Must be a valid UUID.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class GetServicePrincipalFeatureResult(dict):
    def __init__(__self__, *,
                 custom_single_sign_on_app: bool,
                 enterprise_application: bool,
                 gallery_application: bool,
                 visible_to_users: bool):
        """
        :param bool custom_single_sign_on_app: Whether this service principal represents a custom SAML application.
        :param bool enterprise_application: Whether this service principal represents an Enterprise Application.
        :param bool gallery_application: Whether this service principal represents a gallery application.
        :param bool visible_to_users: Whether this app is visible to users in My Apps and Office 365 Launcher.
        """
        pulumi.set(__self__, "custom_single_sign_on_app", custom_single_sign_on_app)
        pulumi.set(__self__, "enterprise_application", enterprise_application)
        pulumi.set(__self__, "gallery_application", gallery_application)
        pulumi.set(__self__, "visible_to_users", visible_to_users)

    @property
    @pulumi.getter(name="customSingleSignOnApp")
    def custom_single_sign_on_app(self) -> bool:
        """
        Whether this service principal represents a custom SAML application.
        """
        return pulumi.get(self, "custom_single_sign_on_app")

    @property
    @pulumi.getter(name="enterpriseApplication")
    def enterprise_application(self) -> bool:
        """
        Whether this service principal represents an Enterprise Application.
        """
        return pulumi.get(self, "enterprise_application")

    @property
    @pulumi.getter(name="galleryApplication")
    def gallery_application(self) -> bool:
        """
        Whether this service principal represents a gallery application.
        """
        return pulumi.get(self, "gallery_application")

    @property
    @pulumi.getter(name="visibleToUsers")
    def visible_to_users(self) -> bool:
        """
        Whether this app is visible to users in My Apps and Office 365 Launcher.
        """
        return pulumi.get(self, "visible_to_users")


@pulumi.output_type
class GetServicePrincipalFeatureTagResult(dict):
    def __init__(__self__, *,
                 custom_single_sign_on: bool,
                 enterprise: bool,
                 gallery: bool,
                 hide: bool):
        pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        pulumi.set(__self__, "enterprise", enterprise)
        pulumi.set(__self__, "gallery", gallery)
        pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> bool:
        return pulumi.get(self, "custom_single_sign_on")

    @property
    @pulumi.getter
    def enterprise(self) -> bool:
        return pulumi.get(self, "enterprise")

    @property
    @pulumi.getter
    def gallery(self) -> bool:
        return pulumi.get(self, "gallery")

    @property
    @pulumi.getter
    def hide(self) -> bool:
        return pulumi.get(self, "hide")


@pulumi.output_type
class GetServicePrincipalOauth2PermissionScopeResult(dict):
    def __init__(__self__, *,
                 admin_consent_description: str,
                 admin_consent_display_name: str,
                 enabled: bool,
                 id: str,
                 type: str,
                 user_consent_description: str,
                 user_consent_display_name: str,
                 value: str):
        """
        :param str admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param str admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param bool enabled: Determines if the permission scope is enabled.
        :param str id: The unique identifier of the delegated permission. Must be a valid UUID.
        :param str type: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        :param str user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param str user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param str value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "type", type)
        pulumi.set(__self__, "user_consent_description", user_consent_description)
        pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> str:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> str:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @property
    @pulumi.getter
    def enabled(self) -> bool:
        """
        Determines if the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        The unique identifier of the delegated permission. Must be a valid UUID.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def type(self) -> str:
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        """
        return pulumi.get(self, "type")

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> str:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> str:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class GetServicePrincipalSamlSingleSignOnResult(dict):
    def __init__(__self__, *,
                 relay_state: str):
        """
        :param str relay_state: The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        pulumi.set(__self__, "relay_state", relay_state)

    @property
    @pulumi.getter(name="relayState")
    def relay_state(self) -> str:
        """
        The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        return pulumi.get(self, "relay_state")


@pulumi.output_type
class GetServicePrincipalsServicePrincipalResult(dict):
    def __init__(__self__, *,
                 account_enabled: bool,
                 app_role_assignment_required: bool,
                 application_id: str,
                 application_tenant_id: str,
                 display_name: str,
                 preferred_single_sign_on_mode: str,
                 saml_metadata_url: str,
                 service_principal_names: Sequence[str],
                 sign_in_audience: str,
                 tags: Sequence[str],
                 type: str):
        """
        :param bool account_enabled: Whether or not the service principal account is enabled.
        :param bool app_role_assignment_required: Whether this service principal requires an app role assignment to a user or group before Azure AD will issue a user or access token to the application.
        :param str application_id: The application ID (client ID) of the application associated with this service principal.
        :param str application_tenant_id: The tenant ID where the associated application is registered.
        :param str display_name: The display name of the application associated with this service principal.
        :param str preferred_single_sign_on_mode: The single sign-on mode configured for this application. Azure AD uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Azure AD My Apps.
        :param str saml_metadata_url: The URL where the service exposes SAML metadata for federation.
        :param Sequence[str] service_principal_names: A list of identifier URI(s), copied over from the associated application.
        :param str sign_in_audience: The Microsoft account types that are supported for the associated application. Possible values include `AzureADMyOrg`, `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount`.
        :param Sequence[str] tags: A list of tags applied to the service principal.
        :param str type: Identifies whether the service principal represents an application or a managed identity. Possible values include `Application` or `ManagedIdentity`.
        """
        pulumi.set(__self__, "account_enabled", account_enabled)
        pulumi.set(__self__, "app_role_assignment_required", app_role_assignment_required)
        pulumi.set(__self__, "application_id", application_id)
        pulumi.set(__self__, "application_tenant_id", application_tenant_id)
        pulumi.set(__self__, "display_name", display_name)
        pulumi.set(__self__, "preferred_single_sign_on_mode", preferred_single_sign_on_mode)
        pulumi.set(__self__, "saml_metadata_url", saml_metadata_url)
        pulumi.set(__self__, "service_principal_names", service_principal_names)
        pulumi.set(__self__, "sign_in_audience", sign_in_audience)
        pulumi.set(__self__, "tags", tags)
        pulumi.set(__self__, "type", type)

    @property
    @pulumi.getter(name="accountEnabled")
    def account_enabled(self) -> bool:
        """
        Whether or not the service principal account is enabled.
        """
        return pulumi.get(self, "account_enabled")

    @property
    @pulumi.getter(name="appRoleAssignmentRequired")
    def app_role_assignment_required(self) -> bool:
        """
        Whether this service principal requires an app role assignment to a user or group before Azure AD will issue a user or access token to the application.
        """
        return pulumi.get(self, "app_role_assignment_required")

    @property
    @pulumi.getter(name="applicationId")
    def application_id(self) -> str:
        """
        The application ID (client ID) of the application associated with this service principal.
        """
        return pulumi.get(self, "application_id")

    @property
    @pulumi.getter(name="applicationTenantId")
    def application_tenant_id(self) -> str:
        """
        The tenant ID where the associated application is registered.
        """
        return pulumi.get(self, "application_tenant_id")

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> str:
        """
        The display name of the application associated with this service principal.
        """
        return pulumi.get(self, "display_name")

    @property
    @pulumi.getter(name="preferredSingleSignOnMode")
    def preferred_single_sign_on_mode(self) -> str:
        """
        The single sign-on mode configured for this application. Azure AD uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Azure AD My Apps.
        """
        return pulumi.get(self, "preferred_single_sign_on_mode")

    @property
    @pulumi.getter(name="samlMetadataUrl")
    def saml_metadata_url(self) -> str:
        """
        The URL where the service exposes SAML metadata for federation.
        """
        return pulumi.get(self, "saml_metadata_url")

    @property
    @pulumi.getter(name="servicePrincipalNames")
    def service_principal_names(self) -> Sequence[str]:
        """
        A list of identifier URI(s), copied over from the associated application.
        """
        return pulumi.get(self, "service_principal_names")

    @property
    @pulumi.getter(name="signInAudience")
    def sign_in_audience(self) -> str:
        """
        The Microsoft account types that are supported for the associated application. Possible values include `AzureADMyOrg`, `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount`.
        """
        return pulumi.get(self, "sign_in_audience")

    @property
    @pulumi.getter
    def tags(self) -> Sequence[str]:
        """
        A list of tags applied to the service principal.
        """
        return pulumi.get(self, "tags")

    @property
    @pulumi.getter
    def type(self) -> str:
        """
        Identifies whether the service principal represents an application or a managed identity. Possible values include `Application` or `ManagedIdentity`.
        """
        return pulumi.get(self, "type")


@pulumi.output_type
class GetUsersUserResult(dict):
    def __init__(__self__, *,
                 account_enabled: bool,
                 display_name: str,
                 mail: str,
                 mail_nickname: str,
                 object_id: str,
                 onpremises_immutable_id: str,
                 onpremises_sam_account_name: str,
                 onpremises_user_principal_name: str,
                 usage_location: str,
                 user_principal_name: str):
        """
        :param bool account_enabled: Whether or not the account is enabled.
        :param str display_name: The display name of the user.
        :param str mail: The primary email address of the user.
        :param str mail_nickname: The email alias of the user.
        :param str object_id: The object ID of the user.
        :param str onpremises_immutable_id: The value used to associate an on-premises Active Directory user account with their Azure AD user object.
        :param str onpremises_sam_account_name: The on-premise SAM account name of the user.
        :param str onpremises_user_principal_name: The on-premise user principal name of the user.
        :param str usage_location: The usage location of the user.
        :param str user_principal_name: The user principal name (UPN) of the user.
        """
        pulumi.set(__self__, "account_enabled", account_enabled)
        pulumi.set(__self__, "display_name", display_name)
        pulumi.set(__self__, "mail", mail)
        pulumi.set(__self__, "mail_nickname", mail_nickname)
        pulumi.set(__self__, "object_id", object_id)
        pulumi.set(__self__, "onpremises_immutable_id", onpremises_immutable_id)
        pulumi.set(__self__, "onpremises_sam_account_name", onpremises_sam_account_name)
        pulumi.set(__self__, "onpremises_user_principal_name", onpremises_user_principal_name)
        pulumi.set(__self__, "usage_location", usage_location)
        pulumi.set(__self__, "user_principal_name", user_principal_name)

    @property
    @pulumi.getter(name="accountEnabled")
    def account_enabled(self) -> bool:
        """
        Whether or not the account is enabled.
        """
        return pulumi.get(self, "account_enabled")

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> str:
        """
        The display name of the user.
        """
        return pulumi.get(self, "display_name")

    @property
    @pulumi.getter
    def mail(self) -> str:
        """
        The primary email address of the user.
        """
        return pulumi.get(self, "mail")

    @property
    @pulumi.getter(name="mailNickname")
    def mail_nickname(self) -> str:
        """
        The email alias of the user.
        """
        return pulumi.get(self, "mail_nickname")

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> str:
        """
        The object ID of the user.
        """
        return pulumi.get(self, "object_id")

    @property
    @pulumi.getter(name="onpremisesImmutableId")
    def onpremises_immutable_id(self) -> str:
        """
        The value used to associate an on-premises Active Directory user account with their Azure AD user object.
        """
        return pulumi.get(self, "onpremises_immutable_id")

    @property
    @pulumi.getter(name="onpremisesSamAccountName")
    def onpremises_sam_account_name(self) -> str:
        """
        The on-premise SAM account name of the user.
        """
        return pulumi.get(self, "onpremises_sam_account_name")

    @property
    @pulumi.getter(name="onpremisesUserPrincipalName")
    def onpremises_user_principal_name(self) -> str:
        """
        The on-premise user principal name of the user.
        """
        return pulumi.get(self, "onpremises_user_principal_name")

    @property
    @pulumi.getter(name="usageLocation")
    def usage_location(self) -> str:
        """
        The usage location of the user.
        """
        return pulumi.get(self, "usage_location")

    @property
    @pulumi.getter(name="userPrincipalName")
    def user_principal_name(self) -> str:
        """
        The user principal name (UPN) of the user.
        """
        return pulumi.get(self, "user_principal_name")


