# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from . import _utilities

__all__ = [
    'ApplicationApiArgs',
    'ApplicationApiOauth2PermissionScopeArgs',
    'ApplicationAppRoleArgs',
    'ApplicationFeatureTagArgs',
    'ApplicationOptionalClaimsArgs',
    'ApplicationOptionalClaimsAccessTokenArgs',
    'ApplicationOptionalClaimsIdTokenArgs',
    'ApplicationOptionalClaimsSaml2TokenArgs',
    'ApplicationPublicClientArgs',
    'ApplicationRequiredResourceAccessArgs',
    'ApplicationRequiredResourceAccessResourceAccessArgs',
    'ApplicationSinglePageApplicationArgs',
    'ApplicationWebArgs',
    'ApplicationWebImplicitGrantArgs',
    'ConditionalAccessPolicyConditionsArgs',
    'ConditionalAccessPolicyConditionsApplicationsArgs',
    'ConditionalAccessPolicyConditionsLocationsArgs',
    'ConditionalAccessPolicyConditionsPlatformsArgs',
    'ConditionalAccessPolicyConditionsUsersArgs',
    'ConditionalAccessPolicyGrantControlsArgs',
    'ConditionalAccessPolicySessionControlsArgs',
    'InvitationMessageArgs',
    'NamedLocationCountryArgs',
    'NamedLocationIpArgs',
    'ServicePrincipalAppRoleArgs',
    'ServicePrincipalFeatureArgs',
    'ServicePrincipalFeatureTagArgs',
    'ServicePrincipalOauth2PermissionScopeArgs',
    'ServicePrincipalSamlSingleSignOnArgs',
]

@pulumi.input_type
class ApplicationApiArgs:
    def __init__(__self__, *,
                 known_client_applications: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 mapped_claims_enabled: Optional[pulumi.Input[bool]] = None,
                 oauth2_permission_scopes: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]]] = None,
                 requested_access_token_version: Optional[pulumi.Input[int]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] known_client_applications: A set of application IDs (client IDs), used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        :param pulumi.Input[bool] mapped_claims_enabled: Allows an application to use claims mapping without specifying a custom signing key. Defaults to `false`.
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]] oauth2_permission_scopes: One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        :param pulumi.Input[int] requested_access_token_version: The access token version expected by this resource. Must be one of `1` or `2`, and must be `2` when `sign_in_audience` is either `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount` Defaults to `1`.
        """
        if known_client_applications is not None:
            pulumi.set(__self__, "known_client_applications", known_client_applications)
        if mapped_claims_enabled is not None:
            pulumi.set(__self__, "mapped_claims_enabled", mapped_claims_enabled)
        if oauth2_permission_scopes is not None:
            pulumi.set(__self__, "oauth2_permission_scopes", oauth2_permission_scopes)
        if requested_access_token_version is not None:
            pulumi.set(__self__, "requested_access_token_version", requested_access_token_version)

    @property
    @pulumi.getter(name="knownClientApplications")
    def known_client_applications(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of application IDs (client IDs), used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        """
        return pulumi.get(self, "known_client_applications")

    @known_client_applications.setter
    def known_client_applications(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "known_client_applications", value)

    @property
    @pulumi.getter(name="mappedClaimsEnabled")
    def mapped_claims_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Allows an application to use claims mapping without specifying a custom signing key. Defaults to `false`.
        """
        return pulumi.get(self, "mapped_claims_enabled")

    @mapped_claims_enabled.setter
    def mapped_claims_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "mapped_claims_enabled", value)

    @property
    @pulumi.getter(name="oauth2PermissionScopes")
    def oauth2_permission_scopes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]]]:
        """
        One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        """
        return pulumi.get(self, "oauth2_permission_scopes")

    @oauth2_permission_scopes.setter
    def oauth2_permission_scopes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]]]):
        pulumi.set(self, "oauth2_permission_scopes", value)

    @property
    @pulumi.getter(name="requestedAccessTokenVersion")
    def requested_access_token_version(self) -> Optional[pulumi.Input[int]]:
        """
        The access token version expected by this resource. Must be one of `1` or `2`, and must be `2` when `sign_in_audience` is either `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount` Defaults to `1`.
        """
        return pulumi.get(self, "requested_access_token_version")

    @requested_access_token_version.setter
    def requested_access_token_version(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "requested_access_token_version", value)


@pulumi.input_type
class ApplicationApiOauth2PermissionScopeArgs:
    def __init__(__self__, *,
                 id: pulumi.Input[str],
                 admin_consent_description: Optional[pulumi.Input[str]] = None,
                 admin_consent_display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 user_consent_description: Optional[pulumi.Input[str]] = None,
                 user_consent_display_name: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] id: The unique identifier of the delegated permission. Must be a valid UUID.
        :param pulumi.Input[str] admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[str] admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[bool] enabled: Determines if the permission scope is enabled. Defaults to `true`.
        :param pulumi.Input[str] type: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Defaults to `User`. Possible values are `User` or `Admin`.
        :param pulumi.Input[str] user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param pulumi.Input[str] user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param pulumi.Input[str] value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        pulumi.set(__self__, "id", id)
        if admin_consent_description is not None:
            pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        if admin_consent_display_name is not None:
            pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if type is not None:
            pulumi.set(__self__, "type", type)
        if user_consent_description is not None:
            pulumi.set(__self__, "user_consent_description", user_consent_description)
        if user_consent_display_name is not None:
            pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def id(self) -> pulumi.Input[str]:
        """
        The unique identifier of the delegated permission. Must be a valid UUID.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: pulumi.Input[str]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @admin_consent_description.setter
    def admin_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_description", value)

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @admin_consent_display_name.setter
    def admin_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Determines if the permission scope is enabled. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def type(self) -> Optional[pulumi.Input[str]]:
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Defaults to `User`. Possible values are `User` or `Admin`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "type", value)

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @user_consent_description.setter
    def user_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_description", value)

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @user_consent_display_name.setter
    def user_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_display_name", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


@pulumi.input_type
class ApplicationAppRoleArgs:
    def __init__(__self__, *,
                 allowed_member_types: pulumi.Input[Sequence[pulumi.Input[str]]],
                 description: pulumi.Input[str],
                 display_name: pulumi.Input[str],
                 id: pulumi.Input[str],
                 enabled: Optional[pulumi.Input[bool]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups by setting to `User`, or to other applications (that are accessing this application in a standalone scenario) by setting to `Application`, or to both.
        :param pulumi.Input[str] description: Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        :param pulumi.Input[str] display_name: Display name for the app role that appears during app role assignment and in consent experiences.
        :param pulumi.Input[str] id: The unique identifier of the app role. Must be a valid UUID.
        :param pulumi.Input[bool] enabled: Determines if the app role is enabled. Defaults to `true`.
        :param pulumi.Input[str] value: The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "display_name", display_name)
        pulumi.set(__self__, "id", id)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        Specifies whether this app role definition can be assigned to users and groups by setting to `User`, or to other applications (that are accessing this application in a standalone scenario) by setting to `Application`, or to both.
        """
        return pulumi.get(self, "allowed_member_types")

    @allowed_member_types.setter
    def allowed_member_types(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "allowed_member_types", value)

    @property
    @pulumi.getter
    def description(self) -> pulumi.Input[str]:
        """
        Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: pulumi.Input[str]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> pulumi.Input[str]:
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "display_name", value)

    @property
    @pulumi.getter
    def id(self) -> pulumi.Input[str]:
        """
        The unique identifier of the app role. Must be a valid UUID.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: pulumi.Input[str]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Determines if the app role is enabled. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


@pulumi.input_type
class ApplicationFeatureTagArgs:
    def __init__(__self__, *,
                 custom_single_sign_on: Optional[pulumi.Input[bool]] = None,
                 enterprise: Optional[pulumi.Input[bool]] = None,
                 gallery: Optional[pulumi.Input[bool]] = None,
                 hide: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] custom_single_sign_on: Whether this application represents a custom SAML application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        :param pulumi.Input[bool] enterprise: Whether this application represents an Enterprise Application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        :param pulumi.Input[bool] gallery: Whether this application represents a gallery application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        :param pulumi.Input[bool] hide: Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        if custom_single_sign_on is not None:
            pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        if enterprise is not None:
            pulumi.set(__self__, "enterprise", enterprise)
        if gallery is not None:
            pulumi.set(__self__, "gallery", gallery)
        if hide is not None:
            pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this application represents a custom SAML application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        return pulumi.get(self, "custom_single_sign_on")

    @custom_single_sign_on.setter
    def custom_single_sign_on(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "custom_single_sign_on", value)

    @property
    @pulumi.getter
    def enterprise(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this application represents an Enterprise Application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "enterprise")

    @enterprise.setter
    def enterprise(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enterprise", value)

    @property
    @pulumi.getter
    def gallery(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this application represents a gallery application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        return pulumi.get(self, "gallery")

    @gallery.setter
    def gallery(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "gallery", value)

    @property
    @pulumi.getter
    def hide(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "hide")

    @hide.setter
    def hide(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide", value)


@pulumi.input_type
class ApplicationOptionalClaimsArgs:
    def __init__(__self__, *,
                 access_tokens: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]]] = None,
                 id_tokens: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]]] = None,
                 saml2_tokens: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]] access_tokens: One or more `access_token` blocks as documented below.
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]] id_tokens: One or more `id_token` blocks as documented below.
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]] saml2_tokens: One or more `saml2_token` blocks as documented below.
        """
        if access_tokens is not None:
            pulumi.set(__self__, "access_tokens", access_tokens)
        if id_tokens is not None:
            pulumi.set(__self__, "id_tokens", id_tokens)
        if saml2_tokens is not None:
            pulumi.set(__self__, "saml2_tokens", saml2_tokens)

    @property
    @pulumi.getter(name="accessTokens")
    def access_tokens(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]]]:
        """
        One or more `access_token` blocks as documented below.
        """
        return pulumi.get(self, "access_tokens")

    @access_tokens.setter
    def access_tokens(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]]]):
        pulumi.set(self, "access_tokens", value)

    @property
    @pulumi.getter(name="idTokens")
    def id_tokens(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]]]:
        """
        One or more `id_token` blocks as documented below.
        """
        return pulumi.get(self, "id_tokens")

    @id_tokens.setter
    def id_tokens(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]]]):
        pulumi.set(self, "id_tokens", value)

    @property
    @pulumi.getter(name="saml2Tokens")
    def saml2_tokens(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]]]:
        """
        One or more `saml2_token` blocks as documented below.
        """
        return pulumi.get(self, "saml2_tokens")

    @saml2_tokens.setter
    def saml2_tokens(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]]]):
        pulumi.set(self, "saml2_tokens", value)


@pulumi.input_type
class ApplicationOptionalClaimsAccessTokenArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 additional_properties: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 essential: Optional[pulumi.Input[bool]] = None,
                 source: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the optional claim.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param pulumi.Input[bool] essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param pulumi.Input[str] source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @additional_properties.setter
    def additional_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_properties", value)

    @property
    @pulumi.getter
    def essential(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @essential.setter
    def essential(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "essential", value)

    @property
    @pulumi.getter
    def source(self) -> Optional[pulumi.Input[str]]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")

    @source.setter
    def source(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source", value)


@pulumi.input_type
class ApplicationOptionalClaimsIdTokenArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 additional_properties: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 essential: Optional[pulumi.Input[bool]] = None,
                 source: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the optional claim.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param pulumi.Input[bool] essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param pulumi.Input[str] source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @additional_properties.setter
    def additional_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_properties", value)

    @property
    @pulumi.getter
    def essential(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @essential.setter
    def essential(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "essential", value)

    @property
    @pulumi.getter
    def source(self) -> Optional[pulumi.Input[str]]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")

    @source.setter
    def source(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source", value)


@pulumi.input_type
class ApplicationOptionalClaimsSaml2TokenArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 additional_properties: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 essential: Optional[pulumi.Input[bool]] = None,
                 source: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the optional claim.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        :param pulumi.Input[bool] essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param pulumi.Input[str] source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim.
        """
        return pulumi.get(self, "additional_properties")

    @additional_properties.setter
    def additional_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_properties", value)

    @property
    @pulumi.getter
    def essential(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @essential.setter
    def essential(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "essential", value)

    @property
    @pulumi.getter
    def source(self) -> Optional[pulumi.Input[str]]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")

    @source.setter
    def source(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source", value)


@pulumi.input_type
class ApplicationPublicClientArgs:
    def __init__(__self__, *,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` or `ms-appx-web` URL.
        """
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` or `ms-appx-web` URL.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)


@pulumi.input_type
class ApplicationRequiredResourceAccessArgs:
    def __init__(__self__, *,
                 resource_accesses: pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]],
                 resource_app_id: pulumi.Input[str]):
        """
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]] resource_accesses: A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        :param pulumi.Input[str] resource_app_id: The unique identifier for the resource that the application requires access to. This should be the Application ID of the target application.
        """
        pulumi.set(__self__, "resource_accesses", resource_accesses)
        pulumi.set(__self__, "resource_app_id", resource_app_id)

    @property
    @pulumi.getter(name="resourceAccesses")
    def resource_accesses(self) -> pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]]:
        """
        A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        """
        return pulumi.get(self, "resource_accesses")

    @resource_accesses.setter
    def resource_accesses(self, value: pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]]):
        pulumi.set(self, "resource_accesses", value)

    @property
    @pulumi.getter(name="resourceAppId")
    def resource_app_id(self) -> pulumi.Input[str]:
        """
        The unique identifier for the resource that the application requires access to. This should be the Application ID of the target application.
        """
        return pulumi.get(self, "resource_app_id")

    @resource_app_id.setter
    def resource_app_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "resource_app_id", value)


@pulumi.input_type
class ApplicationRequiredResourceAccessResourceAccessArgs:
    def __init__(__self__, *,
                 id: pulumi.Input[str],
                 type: pulumi.Input[str]):
        """
        :param pulumi.Input[str] id: The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        :param pulumi.Input[str] type: Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "type", type)

    @property
    @pulumi.getter
    def id(self) -> pulumi.Input[str]:
        """
        The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: pulumi.Input[str]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def type(self) -> pulumi.Input[str]:
        """
        Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: pulumi.Input[str]):
        pulumi.set(self, "type", value)


@pulumi.input_type
class ApplicationSinglePageApplicationArgs:
    def __init__(__self__, *,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` URL.
        """
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` URL.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)


@pulumi.input_type
class ApplicationWebArgs:
    def __init__(__self__, *,
                 homepage_url: Optional[pulumi.Input[str]] = None,
                 implicit_grant: Optional[pulumi.Input['ApplicationWebImplicitGrantArgs']] = None,
                 logout_url: Optional[pulumi.Input[str]] = None,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] homepage_url: Home page or landing page of the application.
        :param pulumi.Input['ApplicationWebImplicitGrantArgs'] implicit_grant: An `implicit_grant` block as documented above.
        :param pulumi.Input[str] logout_url: The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `http` URL or a URN.
        """
        if homepage_url is not None:
            pulumi.set(__self__, "homepage_url", homepage_url)
        if implicit_grant is not None:
            pulumi.set(__self__, "implicit_grant", implicit_grant)
        if logout_url is not None:
            pulumi.set(__self__, "logout_url", logout_url)
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="homepageUrl")
    def homepage_url(self) -> Optional[pulumi.Input[str]]:
        """
        Home page or landing page of the application.
        """
        return pulumi.get(self, "homepage_url")

    @homepage_url.setter
    def homepage_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "homepage_url", value)

    @property
    @pulumi.getter(name="implicitGrant")
    def implicit_grant(self) -> Optional[pulumi.Input['ApplicationWebImplicitGrantArgs']]:
        """
        An `implicit_grant` block as documented above.
        """
        return pulumi.get(self, "implicit_grant")

    @implicit_grant.setter
    def implicit_grant(self, value: Optional[pulumi.Input['ApplicationWebImplicitGrantArgs']]):
        pulumi.set(self, "implicit_grant", value)

    @property
    @pulumi.getter(name="logoutUrl")
    def logout_url(self) -> Optional[pulumi.Input[str]]:
        """
        The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        """
        return pulumi.get(self, "logout_url")

    @logout_url.setter
    def logout_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "logout_url", value)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `http` URL or a URN.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)


@pulumi.input_type
class ApplicationWebImplicitGrantArgs:
    def __init__(__self__, *,
                 access_token_issuance_enabled: Optional[pulumi.Input[bool]] = None,
                 id_token_issuance_enabled: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] access_token_issuance_enabled: Whether this web application can request an access token using OAuth 2.0 implicit flow.
        :param pulumi.Input[bool] id_token_issuance_enabled: Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        if access_token_issuance_enabled is not None:
            pulumi.set(__self__, "access_token_issuance_enabled", access_token_issuance_enabled)
        if id_token_issuance_enabled is not None:
            pulumi.set(__self__, "id_token_issuance_enabled", id_token_issuance_enabled)

    @property
    @pulumi.getter(name="accessTokenIssuanceEnabled")
    def access_token_issuance_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this web application can request an access token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "access_token_issuance_enabled")

    @access_token_issuance_enabled.setter
    def access_token_issuance_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "access_token_issuance_enabled", value)

    @property
    @pulumi.getter(name="idTokenIssuanceEnabled")
    def id_token_issuance_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "id_token_issuance_enabled")

    @id_token_issuance_enabled.setter
    def id_token_issuance_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "id_token_issuance_enabled", value)


@pulumi.input_type
class ConditionalAccessPolicyConditionsArgs:
    def __init__(__self__, *,
                 applications: pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs'],
                 client_app_types: pulumi.Input[Sequence[pulumi.Input[str]]],
                 locations: pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs'],
                 platforms: pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs'],
                 users: pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs'],
                 sign_in_risk_levels: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 user_risk_levels: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs'] applications: An `applications` block as documented below, which specifies applications and user actions included in and excluded from the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] client_app_types: A list of client application types included in the policy. Possible values are: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported` and `other`.
        :param pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs'] locations: A `locations` block as documented below, which specifies locations included in and excluded from the policy.
        :param pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs'] platforms: A `platforms` block as documented below, which specifies platforms included in and excluded from the policy.
        :param pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs'] users: A `users` block as documented below, which specifies users, groups, and roles included in and excluded from the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] sign_in_risk_levels: A list of sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] user_risk_levels: A list of user risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        pulumi.set(__self__, "applications", applications)
        pulumi.set(__self__, "client_app_types", client_app_types)
        pulumi.set(__self__, "locations", locations)
        pulumi.set(__self__, "platforms", platforms)
        pulumi.set(__self__, "users", users)
        if sign_in_risk_levels is not None:
            pulumi.set(__self__, "sign_in_risk_levels", sign_in_risk_levels)
        if user_risk_levels is not None:
            pulumi.set(__self__, "user_risk_levels", user_risk_levels)

    @property
    @pulumi.getter
    def applications(self) -> pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs']:
        """
        An `applications` block as documented below, which specifies applications and user actions included in and excluded from the policy.
        """
        return pulumi.get(self, "applications")

    @applications.setter
    def applications(self, value: pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs']):
        pulumi.set(self, "applications", value)

    @property
    @pulumi.getter(name="clientAppTypes")
    def client_app_types(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of client application types included in the policy. Possible values are: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported` and `other`.
        """
        return pulumi.get(self, "client_app_types")

    @client_app_types.setter
    def client_app_types(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "client_app_types", value)

    @property
    @pulumi.getter
    def locations(self) -> pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs']:
        """
        A `locations` block as documented below, which specifies locations included in and excluded from the policy.
        """
        return pulumi.get(self, "locations")

    @locations.setter
    def locations(self, value: pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs']):
        pulumi.set(self, "locations", value)

    @property
    @pulumi.getter
    def platforms(self) -> pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs']:
        """
        A `platforms` block as documented below, which specifies platforms included in and excluded from the policy.
        """
        return pulumi.get(self, "platforms")

    @platforms.setter
    def platforms(self, value: pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs']):
        pulumi.set(self, "platforms", value)

    @property
    @pulumi.getter
    def users(self) -> pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs']:
        """
        A `users` block as documented below, which specifies users, groups, and roles included in and excluded from the policy.
        """
        return pulumi.get(self, "users")

    @users.setter
    def users(self, value: pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs']):
        pulumi.set(self, "users", value)

    @property
    @pulumi.getter(name="signInRiskLevels")
    def sign_in_risk_levels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        return pulumi.get(self, "sign_in_risk_levels")

    @sign_in_risk_levels.setter
    def sign_in_risk_levels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "sign_in_risk_levels", value)

    @property
    @pulumi.getter(name="userRiskLevels")
    def user_risk_levels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        return pulumi.get(self, "user_risk_levels")

    @user_risk_levels.setter
    def user_risk_levels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "user_risk_levels", value)


@pulumi.input_type
class ConditionalAccessPolicyConditionsApplicationsArgs:
    def __init__(__self__, *,
                 included_applications: pulumi.Input[Sequence[pulumi.Input[str]]],
                 excluded_applications: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_user_actions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_applications: A list of application IDs the policy applies to, unless explicitly excluded (in `excluded_applications`). Can also be set to `All`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_applications: A list of application IDs explicitly excluded from the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_user_actions: A list of user actions to include. Supported values are `urn:user:registersecurityinfo` and `urn:user:registerdevice`.
        """
        pulumi.set(__self__, "included_applications", included_applications)
        if excluded_applications is not None:
            pulumi.set(__self__, "excluded_applications", excluded_applications)
        if included_user_actions is not None:
            pulumi.set(__self__, "included_user_actions", included_user_actions)

    @property
    @pulumi.getter(name="includedApplications")
    def included_applications(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of application IDs the policy applies to, unless explicitly excluded (in `excluded_applications`). Can also be set to `All`.
        """
        return pulumi.get(self, "included_applications")

    @included_applications.setter
    def included_applications(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "included_applications", value)

    @property
    @pulumi.getter(name="excludedApplications")
    def excluded_applications(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of application IDs explicitly excluded from the policy.
        """
        return pulumi.get(self, "excluded_applications")

    @excluded_applications.setter
    def excluded_applications(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_applications", value)

    @property
    @pulumi.getter(name="includedUserActions")
    def included_user_actions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user actions to include. Supported values are `urn:user:registersecurityinfo` and `urn:user:registerdevice`.
        """
        return pulumi.get(self, "included_user_actions")

    @included_user_actions.setter
    def included_user_actions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_user_actions", value)


@pulumi.input_type
class ConditionalAccessPolicyConditionsLocationsArgs:
    def __init__(__self__, *,
                 included_locations: pulumi.Input[Sequence[pulumi.Input[str]]],
                 excluded_locations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_locations: A list of location IDs in scope of policy unless explicitly excluded. Can also be set to `All`, or `AllTrusted`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_locations: A list of location IDs excluded from scope of policy.
        """
        pulumi.set(__self__, "included_locations", included_locations)
        if excluded_locations is not None:
            pulumi.set(__self__, "excluded_locations", excluded_locations)

    @property
    @pulumi.getter(name="includedLocations")
    def included_locations(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of location IDs in scope of policy unless explicitly excluded. Can also be set to `All`, or `AllTrusted`.
        """
        return pulumi.get(self, "included_locations")

    @included_locations.setter
    def included_locations(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "included_locations", value)

    @property
    @pulumi.getter(name="excludedLocations")
    def excluded_locations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of location IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_locations")

    @excluded_locations.setter
    def excluded_locations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_locations", value)


@pulumi.input_type
class ConditionalAccessPolicyConditionsPlatformsArgs:
    def __init__(__self__, *,
                 included_platforms: pulumi.Input[Sequence[pulumi.Input[str]]],
                 excluded_platforms: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_platforms: A list of platforms the policy applies to, unless explicitly excluded. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_platforms: A list of platforms explicitly excluded from the policy. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        pulumi.set(__self__, "included_platforms", included_platforms)
        if excluded_platforms is not None:
            pulumi.set(__self__, "excluded_platforms", excluded_platforms)

    @property
    @pulumi.getter(name="includedPlatforms")
    def included_platforms(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of platforms the policy applies to, unless explicitly excluded. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        return pulumi.get(self, "included_platforms")

    @included_platforms.setter
    def included_platforms(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "included_platforms", value)

    @property
    @pulumi.getter(name="excludedPlatforms")
    def excluded_platforms(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of platforms explicitly excluded from the policy. Possible values are: `all`, `android`, `iOS`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        return pulumi.get(self, "excluded_platforms")

    @excluded_platforms.setter
    def excluded_platforms(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_platforms", value)


@pulumi.input_type
class ConditionalAccessPolicyConditionsUsersArgs:
    def __init__(__self__, *,
                 excluded_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 excluded_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 excluded_users: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_users: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_groups: A list of group IDs excluded from scope of policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_roles: A list of role IDs excluded from scope of policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_users: A list of user IDs excluded from scope of policy and/or `GuestsOrExternalUsers`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_groups: A list of group IDs in scope of policy unless explicitly excluded, or `All`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_roles: A list of role IDs in scope of policy unless explicitly excluded, or `All`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_users: A list of user IDs in scope of policy unless explicitly excluded, or `None` or `All` or `GuestsOrExternalUsers`.
        """
        if excluded_groups is not None:
            pulumi.set(__self__, "excluded_groups", excluded_groups)
        if excluded_roles is not None:
            pulumi.set(__self__, "excluded_roles", excluded_roles)
        if excluded_users is not None:
            pulumi.set(__self__, "excluded_users", excluded_users)
        if included_groups is not None:
            pulumi.set(__self__, "included_groups", included_groups)
        if included_roles is not None:
            pulumi.set(__self__, "included_roles", included_roles)
        if included_users is not None:
            pulumi.set(__self__, "included_users", included_users)

    @property
    @pulumi.getter(name="excludedGroups")
    def excluded_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of group IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_groups")

    @excluded_groups.setter
    def excluded_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_groups", value)

    @property
    @pulumi.getter(name="excludedRoles")
    def excluded_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of role IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_roles")

    @excluded_roles.setter
    def excluded_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_roles", value)

    @property
    @pulumi.getter(name="excludedUsers")
    def excluded_users(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user IDs excluded from scope of policy and/or `GuestsOrExternalUsers`.
        """
        return pulumi.get(self, "excluded_users")

    @excluded_users.setter
    def excluded_users(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_users", value)

    @property
    @pulumi.getter(name="includedGroups")
    def included_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of group IDs in scope of policy unless explicitly excluded, or `All`.
        """
        return pulumi.get(self, "included_groups")

    @included_groups.setter
    def included_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_groups", value)

    @property
    @pulumi.getter(name="includedRoles")
    def included_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of role IDs in scope of policy unless explicitly excluded, or `All`.
        """
        return pulumi.get(self, "included_roles")

    @included_roles.setter
    def included_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_roles", value)

    @property
    @pulumi.getter(name="includedUsers")
    def included_users(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user IDs in scope of policy unless explicitly excluded, or `None` or `All` or `GuestsOrExternalUsers`.
        """
        return pulumi.get(self, "included_users")

    @included_users.setter
    def included_users(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_users", value)


@pulumi.input_type
class ConditionalAccessPolicyGrantControlsArgs:
    def __init__(__self__, *,
                 built_in_controls: pulumi.Input[Sequence[pulumi.Input[str]]],
                 operator: pulumi.Input[str],
                 custom_authentication_factors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 terms_of_uses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] built_in_controls: List of built-in controls required by the policy. Possible values are: `block`, `mfa`, `approvedApplication`, `compliantApplication`, `compliantDevice`, `domainJoinedDevice`, `passwordChange` or `unknownFutureValue`.
        :param pulumi.Input[str] operator: Defines the relationship of the grant controls. Possible values are: `AND`, `OR`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_authentication_factors: List of custom controls IDs required by the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] terms_of_uses: List of terms of use IDs required by the policy.
        """
        pulumi.set(__self__, "built_in_controls", built_in_controls)
        pulumi.set(__self__, "operator", operator)
        if custom_authentication_factors is not None:
            pulumi.set(__self__, "custom_authentication_factors", custom_authentication_factors)
        if terms_of_uses is not None:
            pulumi.set(__self__, "terms_of_uses", terms_of_uses)

    @property
    @pulumi.getter(name="builtInControls")
    def built_in_controls(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        List of built-in controls required by the policy. Possible values are: `block`, `mfa`, `approvedApplication`, `compliantApplication`, `compliantDevice`, `domainJoinedDevice`, `passwordChange` or `unknownFutureValue`.
        """
        return pulumi.get(self, "built_in_controls")

    @built_in_controls.setter
    def built_in_controls(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "built_in_controls", value)

    @property
    @pulumi.getter
    def operator(self) -> pulumi.Input[str]:
        """
        Defines the relationship of the grant controls. Possible values are: `AND`, `OR`.
        """
        return pulumi.get(self, "operator")

    @operator.setter
    def operator(self, value: pulumi.Input[str]):
        pulumi.set(self, "operator", value)

    @property
    @pulumi.getter(name="customAuthenticationFactors")
    def custom_authentication_factors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of custom controls IDs required by the policy.
        """
        return pulumi.get(self, "custom_authentication_factors")

    @custom_authentication_factors.setter
    def custom_authentication_factors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "custom_authentication_factors", value)

    @property
    @pulumi.getter(name="termsOfUses")
    def terms_of_uses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of terms of use IDs required by the policy.
        """
        return pulumi.get(self, "terms_of_uses")

    @terms_of_uses.setter
    def terms_of_uses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "terms_of_uses", value)


@pulumi.input_type
class ConditionalAccessPolicySessionControlsArgs:
    def __init__(__self__, *,
                 application_enforced_restrictions_enabled: Optional[pulumi.Input[bool]] = None,
                 cloud_app_security_policy: Optional[pulumi.Input[str]] = None,
                 sign_in_frequency: Optional[pulumi.Input[int]] = None,
                 sign_in_frequency_period: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[bool] application_enforced_restrictions_enabled: Whether or not application enforced restrictions are enabled. Defaults to `false`.
        :param pulumi.Input[str] cloud_app_security_policy: Enables cloud app security and specifies the cloud app security policy to use. Possible values are: `blockDownloads`, `mcasConfigured`, `monitorOnly` or `unknownFutureValue`.
        :param pulumi.Input[int] sign_in_frequency: Number of days or hours to enforce sign-in frequency. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        :param pulumi.Input[str] sign_in_frequency_period: The time period to enforce sign-in frequency. Possible values are: `hours` or `days`. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        """
        if application_enforced_restrictions_enabled is not None:
            pulumi.set(__self__, "application_enforced_restrictions_enabled", application_enforced_restrictions_enabled)
        if cloud_app_security_policy is not None:
            pulumi.set(__self__, "cloud_app_security_policy", cloud_app_security_policy)
        if sign_in_frequency is not None:
            pulumi.set(__self__, "sign_in_frequency", sign_in_frequency)
        if sign_in_frequency_period is not None:
            pulumi.set(__self__, "sign_in_frequency_period", sign_in_frequency_period)

    @property
    @pulumi.getter(name="applicationEnforcedRestrictionsEnabled")
    def application_enforced_restrictions_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether or not application enforced restrictions are enabled. Defaults to `false`.
        """
        return pulumi.get(self, "application_enforced_restrictions_enabled")

    @application_enforced_restrictions_enabled.setter
    def application_enforced_restrictions_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "application_enforced_restrictions_enabled", value)

    @property
    @pulumi.getter(name="cloudAppSecurityPolicy")
    def cloud_app_security_policy(self) -> Optional[pulumi.Input[str]]:
        """
        Enables cloud app security and specifies the cloud app security policy to use. Possible values are: `blockDownloads`, `mcasConfigured`, `monitorOnly` or `unknownFutureValue`.
        """
        return pulumi.get(self, "cloud_app_security_policy")

    @cloud_app_security_policy.setter
    def cloud_app_security_policy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "cloud_app_security_policy", value)

    @property
    @pulumi.getter(name="signInFrequency")
    def sign_in_frequency(self) -> Optional[pulumi.Input[int]]:
        """
        Number of days or hours to enforce sign-in frequency. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        """
        return pulumi.get(self, "sign_in_frequency")

    @sign_in_frequency.setter
    def sign_in_frequency(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "sign_in_frequency", value)

    @property
    @pulumi.getter(name="signInFrequencyPeriod")
    def sign_in_frequency_period(self) -> Optional[pulumi.Input[str]]:
        """
        The time period to enforce sign-in frequency. Possible values are: `hours` or `days`. Required when `sign_in_frequency_period` is specified. Due to an API issue, removing this property forces a new resource to be created.
        """
        return pulumi.get(self, "sign_in_frequency_period")

    @sign_in_frequency_period.setter
    def sign_in_frequency_period(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "sign_in_frequency_period", value)


@pulumi.input_type
class InvitationMessageArgs:
    def __init__(__self__, *,
                 additional_recipients: Optional[pulumi.Input[str]] = None,
                 body: Optional[pulumi.Input[str]] = None,
                 language: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] additional_recipients: Email addresses of additional recipients the invitation message should be sent to. Only 1 additional recipient is currently supported by Azure.
        :param pulumi.Input[str] body: Customized message body you want to send if you don't want to send the default message. Cannot be specified with `language`.
        :param pulumi.Input[str] language: The language you want to send the default message in. The value specified must be in ISO 639 format. Defaults to `en-US`. Cannot be specified with `body`.
        """
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)
        if body is not None:
            pulumi.set(__self__, "body", body)
        if language is not None:
            pulumi.set(__self__, "language", language)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[str]]:
        """
        Email addresses of additional recipients the invitation message should be sent to. Only 1 additional recipient is currently supported by Azure.
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "additional_recipients", value)

    @property
    @pulumi.getter
    def body(self) -> Optional[pulumi.Input[str]]:
        """
        Customized message body you want to send if you don't want to send the default message. Cannot be specified with `language`.
        """
        return pulumi.get(self, "body")

    @body.setter
    def body(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "body", value)

    @property
    @pulumi.getter
    def language(self) -> Optional[pulumi.Input[str]]:
        """
        The language you want to send the default message in. The value specified must be in ISO 639 format. Defaults to `en-US`. Cannot be specified with `body`.
        """
        return pulumi.get(self, "language")

    @language.setter
    def language(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "language", value)


@pulumi.input_type
class NamedLocationCountryArgs:
    def __init__(__self__, *,
                 countries_and_regions: pulumi.Input[Sequence[pulumi.Input[str]]],
                 include_unknown_countries_and_regions: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] countries_and_regions: List of countries and/or regions in two-letter format specified by ISO 3166-2.
        :param pulumi.Input[bool] include_unknown_countries_and_regions: Whether IP addresses that don't map to a country or region should be included in the named location. Defaults to `false`.
        """
        pulumi.set(__self__, "countries_and_regions", countries_and_regions)
        if include_unknown_countries_and_regions is not None:
            pulumi.set(__self__, "include_unknown_countries_and_regions", include_unknown_countries_and_regions)

    @property
    @pulumi.getter(name="countriesAndRegions")
    def countries_and_regions(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        List of countries and/or regions in two-letter format specified by ISO 3166-2.
        """
        return pulumi.get(self, "countries_and_regions")

    @countries_and_regions.setter
    def countries_and_regions(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "countries_and_regions", value)

    @property
    @pulumi.getter(name="includeUnknownCountriesAndRegions")
    def include_unknown_countries_and_regions(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether IP addresses that don't map to a country or region should be included in the named location. Defaults to `false`.
        """
        return pulumi.get(self, "include_unknown_countries_and_regions")

    @include_unknown_countries_and_regions.setter
    def include_unknown_countries_and_regions(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_unknown_countries_and_regions", value)


@pulumi.input_type
class NamedLocationIpArgs:
    def __init__(__self__, *,
                 ip_ranges: pulumi.Input[Sequence[pulumi.Input[str]]],
                 trusted: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] ip_ranges: List of IP address ranges in IPv4 CIDR format (e.g. 1.2.3.4/32) or any allowable IPv6 format from IETF RFC596.
        :param pulumi.Input[bool] trusted: Whether the named location is trusted. Defaults to `false`.
        """
        pulumi.set(__self__, "ip_ranges", ip_ranges)
        if trusted is not None:
            pulumi.set(__self__, "trusted", trusted)

    @property
    @pulumi.getter(name="ipRanges")
    def ip_ranges(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        List of IP address ranges in IPv4 CIDR format (e.g. 1.2.3.4/32) or any allowable IPv6 format from IETF RFC596.
        """
        return pulumi.get(self, "ip_ranges")

    @ip_ranges.setter
    def ip_ranges(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "ip_ranges", value)

    @property
    @pulumi.getter
    def trusted(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the named location is trusted. Defaults to `false`.
        """
        return pulumi.get(self, "trusted")

    @trusted.setter
    def trusted(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "trusted", value)


@pulumi.input_type
class ServicePrincipalAppRoleArgs:
    def __init__(__self__, *,
                 allowed_member_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 id: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are: `User` and `Application`, or both.
        :param pulumi.Input[str] description: A description of the service principal provided for internal end-users.
        :param pulumi.Input[str] display_name: Display name for the app role that appears during app role assignment and in consent experiences.
        :param pulumi.Input[bool] enabled: Specifies whether the permission scope is enabled.
        :param pulumi.Input[str] id: The unique identifier of the delegated permission.
        :param pulumi.Input[str] value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        if allowed_member_types is not None:
            pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if display_name is not None:
            pulumi.set(__self__, "display_name", display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are: `User` and `Application`, or both.
        """
        return pulumi.get(self, "allowed_member_types")

    @allowed_member_types.setter
    def allowed_member_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "allowed_member_types", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        A description of the service principal provided for internal end-users.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Specifies whether the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def id(self) -> Optional[pulumi.Input[str]]:
        """
        The unique identifier of the delegated permission.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


@pulumi.input_type
class ServicePrincipalFeatureArgs:
    def __init__(__self__, *,
                 custom_single_sign_on_app: Optional[pulumi.Input[bool]] = None,
                 enterprise_application: Optional[pulumi.Input[bool]] = None,
                 gallery_application: Optional[pulumi.Input[bool]] = None,
                 visible_to_users: Optional[pulumi.Input[bool]] = None):
        if custom_single_sign_on_app is not None:
            pulumi.set(__self__, "custom_single_sign_on_app", custom_single_sign_on_app)
        if enterprise_application is not None:
            pulumi.set(__self__, "enterprise_application", enterprise_application)
        if gallery_application is not None:
            pulumi.set(__self__, "gallery_application", gallery_application)
        if visible_to_users is not None:
            pulumi.set(__self__, "visible_to_users", visible_to_users)

    @property
    @pulumi.getter(name="customSingleSignOnApp")
    def custom_single_sign_on_app(self) -> Optional[pulumi.Input[bool]]:
        return pulumi.get(self, "custom_single_sign_on_app")

    @custom_single_sign_on_app.setter
    def custom_single_sign_on_app(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "custom_single_sign_on_app", value)

    @property
    @pulumi.getter(name="enterpriseApplication")
    def enterprise_application(self) -> Optional[pulumi.Input[bool]]:
        return pulumi.get(self, "enterprise_application")

    @enterprise_application.setter
    def enterprise_application(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enterprise_application", value)

    @property
    @pulumi.getter(name="galleryApplication")
    def gallery_application(self) -> Optional[pulumi.Input[bool]]:
        return pulumi.get(self, "gallery_application")

    @gallery_application.setter
    def gallery_application(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "gallery_application", value)

    @property
    @pulumi.getter(name="visibleToUsers")
    def visible_to_users(self) -> Optional[pulumi.Input[bool]]:
        return pulumi.get(self, "visible_to_users")

    @visible_to_users.setter
    def visible_to_users(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "visible_to_users", value)


@pulumi.input_type
class ServicePrincipalFeatureTagArgs:
    def __init__(__self__, *,
                 custom_single_sign_on: Optional[pulumi.Input[bool]] = None,
                 enterprise: Optional[pulumi.Input[bool]] = None,
                 gallery: Optional[pulumi.Input[bool]] = None,
                 hide: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] custom_single_sign_on: Whether this service principal represents a custom SAML application. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        :param pulumi.Input[bool] enterprise: Whether this service principal represents an Enterprise Application. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        :param pulumi.Input[bool] gallery: Whether this service principal represents a gallery application. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        :param pulumi.Input[bool] hide: Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        if custom_single_sign_on is not None:
            pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        if enterprise is not None:
            pulumi.set(__self__, "enterprise", enterprise)
        if gallery is not None:
            pulumi.set(__self__, "gallery", gallery)
        if hide is not None:
            pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents a custom SAML application. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        return pulumi.get(self, "custom_single_sign_on")

    @custom_single_sign_on.setter
    def custom_single_sign_on(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "custom_single_sign_on", value)

    @property
    @pulumi.getter
    def enterprise(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents an Enterprise Application. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "enterprise")

    @enterprise.setter
    def enterprise(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enterprise", value)

    @property
    @pulumi.getter
    def gallery(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents a gallery application. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        return pulumi.get(self, "gallery")

    @gallery.setter
    def gallery(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "gallery", value)

    @property
    @pulumi.getter
    def hide(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "hide")

    @hide.setter
    def hide(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide", value)


@pulumi.input_type
class ServicePrincipalOauth2PermissionScopeArgs:
    def __init__(__self__, *,
                 admin_consent_description: Optional[pulumi.Input[str]] = None,
                 admin_consent_display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 id: Optional[pulumi.Input[str]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 user_consent_description: Optional[pulumi.Input[str]] = None,
                 user_consent_display_name: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[str] admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[bool] enabled: Specifies whether the permission scope is enabled.
        :param pulumi.Input[str] id: The unique identifier of the delegated permission.
        :param pulumi.Input[str] type: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        :param pulumi.Input[str] user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param pulumi.Input[str] user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param pulumi.Input[str] value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        if admin_consent_description is not None:
            pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        if admin_consent_display_name is not None:
            pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if type is not None:
            pulumi.set(__self__, "type", type)
        if user_consent_description is not None:
            pulumi.set(__self__, "user_consent_description", user_consent_description)
        if user_consent_display_name is not None:
            pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @admin_consent_description.setter
    def admin_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_description", value)

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @admin_consent_display_name.setter
    def admin_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Specifies whether the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def id(self) -> Optional[pulumi.Input[str]]:
        """
        The unique identifier of the delegated permission.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def type(self) -> Optional[pulumi.Input[str]]:
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "type", value)

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @user_consent_description.setter
    def user_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_description", value)

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @user_consent_display_name.setter
    def user_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_display_name", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


@pulumi.input_type
class ServicePrincipalSamlSingleSignOnArgs:
    def __init__(__self__, *,
                 relay_state: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] relay_state: The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        if relay_state is not None:
            pulumi.set(__self__, "relay_state", relay_state)

    @property
    @pulumi.getter(name="relayState")
    def relay_state(self) -> Optional[pulumi.Input[str]]:
        """
        The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        return pulumi.get(self, "relay_state")

    @relay_state.setter
    def relay_state(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "relay_state", value)


