# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from . import _utilities

__all__ = [
    'AccessPackageAssignmentPolicyApprovalSettingsArgs',
    'AccessPackageAssignmentPolicyApprovalSettingsArgsDict',
    'AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgs',
    'AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgsDict',
    'AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgs',
    'AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgsDict',
    'AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgs',
    'AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgsDict',
    'AccessPackageAssignmentPolicyAssignmentReviewSettingsArgs',
    'AccessPackageAssignmentPolicyAssignmentReviewSettingsArgsDict',
    'AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgs',
    'AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgsDict',
    'AccessPackageAssignmentPolicyQuestionArgs',
    'AccessPackageAssignmentPolicyQuestionArgsDict',
    'AccessPackageAssignmentPolicyQuestionChoiceArgs',
    'AccessPackageAssignmentPolicyQuestionChoiceArgsDict',
    'AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgs',
    'AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgsDict',
    'AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgs',
    'AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgsDict',
    'AccessPackageAssignmentPolicyQuestionTextArgs',
    'AccessPackageAssignmentPolicyQuestionTextArgsDict',
    'AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgs',
    'AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgsDict',
    'AccessPackageAssignmentPolicyRequestorSettingsArgs',
    'AccessPackageAssignmentPolicyRequestorSettingsArgsDict',
    'AccessPackageAssignmentPolicyRequestorSettingsRequestorArgs',
    'AccessPackageAssignmentPolicyRequestorSettingsRequestorArgsDict',
    'ApplicationApiArgs',
    'ApplicationApiArgsDict',
    'ApplicationApiOauth2PermissionScopeArgs',
    'ApplicationApiOauth2PermissionScopeArgsDict',
    'ApplicationAppRoleArgs',
    'ApplicationAppRoleArgsDict',
    'ApplicationFeatureTagArgs',
    'ApplicationFeatureTagArgsDict',
    'ApplicationOptionalClaimsArgs',
    'ApplicationOptionalClaimsArgsDict',
    'ApplicationOptionalClaimsAccessTokenArgs',
    'ApplicationOptionalClaimsAccessTokenArgsDict',
    'ApplicationOptionalClaimsIdTokenArgs',
    'ApplicationOptionalClaimsIdTokenArgsDict',
    'ApplicationOptionalClaimsSaml2TokenArgs',
    'ApplicationOptionalClaimsSaml2TokenArgsDict',
    'ApplicationPasswordArgs',
    'ApplicationPasswordArgsDict',
    'ApplicationPublicClientArgs',
    'ApplicationPublicClientArgsDict',
    'ApplicationRequiredResourceAccessArgs',
    'ApplicationRequiredResourceAccessArgsDict',
    'ApplicationRequiredResourceAccessResourceAccessArgs',
    'ApplicationRequiredResourceAccessResourceAccessArgsDict',
    'ApplicationSinglePageApplicationArgs',
    'ApplicationSinglePageApplicationArgsDict',
    'ApplicationWebArgs',
    'ApplicationWebArgsDict',
    'ApplicationWebImplicitGrantArgs',
    'ApplicationWebImplicitGrantArgsDict',
    'ConditionalAccessPolicyConditionsArgs',
    'ConditionalAccessPolicyConditionsArgsDict',
    'ConditionalAccessPolicyConditionsApplicationsArgs',
    'ConditionalAccessPolicyConditionsApplicationsArgsDict',
    'ConditionalAccessPolicyConditionsClientApplicationsArgs',
    'ConditionalAccessPolicyConditionsClientApplicationsArgsDict',
    'ConditionalAccessPolicyConditionsDevicesArgs',
    'ConditionalAccessPolicyConditionsDevicesArgsDict',
    'ConditionalAccessPolicyConditionsDevicesFilterArgs',
    'ConditionalAccessPolicyConditionsDevicesFilterArgsDict',
    'ConditionalAccessPolicyConditionsLocationsArgs',
    'ConditionalAccessPolicyConditionsLocationsArgsDict',
    'ConditionalAccessPolicyConditionsPlatformsArgs',
    'ConditionalAccessPolicyConditionsPlatformsArgsDict',
    'ConditionalAccessPolicyConditionsUsersArgs',
    'ConditionalAccessPolicyConditionsUsersArgsDict',
    'ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgs',
    'ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgsDict',
    'ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgs',
    'ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgsDict',
    'ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgs',
    'ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgsDict',
    'ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgs',
    'ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgsDict',
    'ConditionalAccessPolicyGrantControlsArgs',
    'ConditionalAccessPolicyGrantControlsArgsDict',
    'ConditionalAccessPolicySessionControlsArgs',
    'ConditionalAccessPolicySessionControlsArgsDict',
    'CustomDirectoryRolePermissionArgs',
    'CustomDirectoryRolePermissionArgsDict',
    'GroupDynamicMembershipArgs',
    'GroupDynamicMembershipArgsDict',
    'GroupRoleManagementPolicyActivationRulesArgs',
    'GroupRoleManagementPolicyActivationRulesArgsDict',
    'GroupRoleManagementPolicyActivationRulesApprovalStageArgs',
    'GroupRoleManagementPolicyActivationRulesApprovalStageArgsDict',
    'GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgs',
    'GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgsDict',
    'GroupRoleManagementPolicyActiveAssignmentRulesArgs',
    'GroupRoleManagementPolicyActiveAssignmentRulesArgsDict',
    'GroupRoleManagementPolicyEligibleAssignmentRulesArgs',
    'GroupRoleManagementPolicyEligibleAssignmentRulesArgsDict',
    'GroupRoleManagementPolicyNotificationRulesArgs',
    'GroupRoleManagementPolicyNotificationRulesArgsDict',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgs',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgsDict',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgs',
    'GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgsDict',
    'InvitationMessageArgs',
    'InvitationMessageArgsDict',
    'NamedLocationCountryArgs',
    'NamedLocationCountryArgsDict',
    'NamedLocationIpArgs',
    'NamedLocationIpArgsDict',
    'ServicePrincipalAppRoleArgs',
    'ServicePrincipalAppRoleArgsDict',
    'ServicePrincipalFeatureArgs',
    'ServicePrincipalFeatureArgsDict',
    'ServicePrincipalFeatureTagArgs',
    'ServicePrincipalFeatureTagArgsDict',
    'ServicePrincipalOauth2PermissionScopeArgs',
    'ServicePrincipalOauth2PermissionScopeArgsDict',
    'ServicePrincipalSamlSingleSignOnArgs',
    'ServicePrincipalSamlSingleSignOnArgsDict',
    'SynchronizationJobProvisionOnDemandParameterArgs',
    'SynchronizationJobProvisionOnDemandParameterArgsDict',
    'SynchronizationJobProvisionOnDemandParameterSubjectArgs',
    'SynchronizationJobProvisionOnDemandParameterSubjectArgsDict',
    'SynchronizationJobScheduleArgs',
    'SynchronizationJobScheduleArgsDict',
    'SynchronizationSecretCredentialArgs',
    'SynchronizationSecretCredentialArgsDict',
]

MYPY = False

if not MYPY:
    class AccessPackageAssignmentPolicyApprovalSettingsArgsDict(TypedDict):
        approval_required: NotRequired[pulumi.Input[bool]]
        """
        Whether an approval is required.
        """
        approval_required_for_extension: NotRequired[pulumi.Input[bool]]
        """
        Whether an approval is required to grant extension. Same approval settings used to approve initial access will apply.
        """
        approval_stages: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgsDict']]]]
        """
        An `approval_stage` block specifying the process to obtain an approval, as documented below.
        """
        requestor_justification_required: NotRequired[pulumi.Input[bool]]
        """
        Whether a requestor is required to provide a justification to request an access package. Justification is visible to approvers and the requestor.
        """
elif False:
    AccessPackageAssignmentPolicyApprovalSettingsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyApprovalSettingsArgs:
    def __init__(__self__, *,
                 approval_required: Optional[pulumi.Input[bool]] = None,
                 approval_required_for_extension: Optional[pulumi.Input[bool]] = None,
                 approval_stages: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgs']]]] = None,
                 requestor_justification_required: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] approval_required: Whether an approval is required.
        :param pulumi.Input[bool] approval_required_for_extension: Whether an approval is required to grant extension. Same approval settings used to approve initial access will apply.
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgs']]] approval_stages: An `approval_stage` block specifying the process to obtain an approval, as documented below.
        :param pulumi.Input[bool] requestor_justification_required: Whether a requestor is required to provide a justification to request an access package. Justification is visible to approvers and the requestor.
        """
        if approval_required is not None:
            pulumi.set(__self__, "approval_required", approval_required)
        if approval_required_for_extension is not None:
            pulumi.set(__self__, "approval_required_for_extension", approval_required_for_extension)
        if approval_stages is not None:
            pulumi.set(__self__, "approval_stages", approval_stages)
        if requestor_justification_required is not None:
            pulumi.set(__self__, "requestor_justification_required", requestor_justification_required)

    @property
    @pulumi.getter(name="approvalRequired")
    def approval_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether an approval is required.
        """
        return pulumi.get(self, "approval_required")

    @approval_required.setter
    def approval_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "approval_required", value)

    @property
    @pulumi.getter(name="approvalRequiredForExtension")
    def approval_required_for_extension(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether an approval is required to grant extension. Same approval settings used to approve initial access will apply.
        """
        return pulumi.get(self, "approval_required_for_extension")

    @approval_required_for_extension.setter
    def approval_required_for_extension(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "approval_required_for_extension", value)

    @property
    @pulumi.getter(name="approvalStages")
    def approval_stages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgs']]]]:
        """
        An `approval_stage` block specifying the process to obtain an approval, as documented below.
        """
        return pulumi.get(self, "approval_stages")

    @approval_stages.setter
    def approval_stages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgs']]]]):
        pulumi.set(self, "approval_stages", value)

    @property
    @pulumi.getter(name="requestorJustificationRequired")
    def requestor_justification_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether a requestor is required to provide a justification to request an access package. Justification is visible to approvers and the requestor.
        """
        return pulumi.get(self, "requestor_justification_required")

    @requestor_justification_required.setter
    def requestor_justification_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "requestor_justification_required", value)


if not MYPY:
    class AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgsDict(TypedDict):
        approval_timeout_in_days: pulumi.Input[int]
        """
        Decision must be made in how many days? If a request is not approved within this time period after it is made, it will be automatically rejected
        """
        alternative_approval_enabled: NotRequired[pulumi.Input[bool]]
        """
        If no action taken, forward to alternate approvers?
        """
        alternative_approvers: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgsDict']]]]
        """
        If escalation is enabled and the primary approvers do not respond before the escalation time, the escalationApprovers are the users who will be asked to approve requests. This can be a collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, if there are no escalation approvers, or escalation approvers are not required for the stage, the value of this property should be an empty collection
        """
        approver_justification_required: NotRequired[pulumi.Input[bool]]
        """
        Whether an approver must provide a justification for their decision. Justification is visible to other approvers and the requestor
        """
        enable_alternative_approval_in_days: NotRequired[pulumi.Input[int]]
        """
        Forward to alternate approver(s) after how many days?
        """
        primary_approvers: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgsDict']]]]
        """
        The users who will be asked to approve requests. A collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, include at least one userSet in this collection
        """
elif False:
    AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyApprovalSettingsApprovalStageArgs:
    def __init__(__self__, *,
                 approval_timeout_in_days: pulumi.Input[int],
                 alternative_approval_enabled: Optional[pulumi.Input[bool]] = None,
                 alternative_approvers: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgs']]]] = None,
                 approver_justification_required: Optional[pulumi.Input[bool]] = None,
                 enable_alternative_approval_in_days: Optional[pulumi.Input[int]] = None,
                 primary_approvers: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgs']]]] = None):
        """
        :param pulumi.Input[int] approval_timeout_in_days: Decision must be made in how many days? If a request is not approved within this time period after it is made, it will be automatically rejected
        :param pulumi.Input[bool] alternative_approval_enabled: If no action taken, forward to alternate approvers?
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgs']]] alternative_approvers: If escalation is enabled and the primary approvers do not respond before the escalation time, the escalationApprovers are the users who will be asked to approve requests. This can be a collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, if there are no escalation approvers, or escalation approvers are not required for the stage, the value of this property should be an empty collection
        :param pulumi.Input[bool] approver_justification_required: Whether an approver must provide a justification for their decision. Justification is visible to other approvers and the requestor
        :param pulumi.Input[int] enable_alternative_approval_in_days: Forward to alternate approver(s) after how many days?
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgs']]] primary_approvers: The users who will be asked to approve requests. A collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, include at least one userSet in this collection
        """
        pulumi.set(__self__, "approval_timeout_in_days", approval_timeout_in_days)
        if alternative_approval_enabled is not None:
            pulumi.set(__self__, "alternative_approval_enabled", alternative_approval_enabled)
        if alternative_approvers is not None:
            pulumi.set(__self__, "alternative_approvers", alternative_approvers)
        if approver_justification_required is not None:
            pulumi.set(__self__, "approver_justification_required", approver_justification_required)
        if enable_alternative_approval_in_days is not None:
            pulumi.set(__self__, "enable_alternative_approval_in_days", enable_alternative_approval_in_days)
        if primary_approvers is not None:
            pulumi.set(__self__, "primary_approvers", primary_approvers)

    @property
    @pulumi.getter(name="approvalTimeoutInDays")
    def approval_timeout_in_days(self) -> pulumi.Input[int]:
        """
        Decision must be made in how many days? If a request is not approved within this time period after it is made, it will be automatically rejected
        """
        return pulumi.get(self, "approval_timeout_in_days")

    @approval_timeout_in_days.setter
    def approval_timeout_in_days(self, value: pulumi.Input[int]):
        pulumi.set(self, "approval_timeout_in_days", value)

    @property
    @pulumi.getter(name="alternativeApprovalEnabled")
    def alternative_approval_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        If no action taken, forward to alternate approvers?
        """
        return pulumi.get(self, "alternative_approval_enabled")

    @alternative_approval_enabled.setter
    def alternative_approval_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "alternative_approval_enabled", value)

    @property
    @pulumi.getter(name="alternativeApprovers")
    def alternative_approvers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgs']]]]:
        """
        If escalation is enabled and the primary approvers do not respond before the escalation time, the escalationApprovers are the users who will be asked to approve requests. This can be a collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, if there are no escalation approvers, or escalation approvers are not required for the stage, the value of this property should be an empty collection
        """
        return pulumi.get(self, "alternative_approvers")

    @alternative_approvers.setter
    def alternative_approvers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgs']]]]):
        pulumi.set(self, "alternative_approvers", value)

    @property
    @pulumi.getter(name="approverJustificationRequired")
    def approver_justification_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether an approver must provide a justification for their decision. Justification is visible to other approvers and the requestor
        """
        return pulumi.get(self, "approver_justification_required")

    @approver_justification_required.setter
    def approver_justification_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "approver_justification_required", value)

    @property
    @pulumi.getter(name="enableAlternativeApprovalInDays")
    def enable_alternative_approval_in_days(self) -> Optional[pulumi.Input[int]]:
        """
        Forward to alternate approver(s) after how many days?
        """
        return pulumi.get(self, "enable_alternative_approval_in_days")

    @enable_alternative_approval_in_days.setter
    def enable_alternative_approval_in_days(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "enable_alternative_approval_in_days", value)

    @property
    @pulumi.getter(name="primaryApprovers")
    def primary_approvers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgs']]]]:
        """
        The users who will be asked to approve requests. A collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, include at least one userSet in this collection
        """
        return pulumi.get(self, "primary_approvers")

    @primary_approvers.setter
    def primary_approvers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgs']]]]):
        pulumi.set(self, "primary_approvers", value)


if not MYPY:
    class AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgsDict(TypedDict):
        subject_type: pulumi.Input[str]
        """
        Type of users
        """
        backup: NotRequired[pulumi.Input[bool]]
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        object_id: NotRequired[pulumi.Input[str]]
        """
        The object ID of the subject
        """
elif False:
    AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyApprovalSettingsApprovalStageAlternativeApproverArgs:
    def __init__(__self__, *,
                 subject_type: pulumi.Input[str],
                 backup: Optional[pulumi.Input[bool]] = None,
                 object_id: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] subject_type: Type of users
        :param pulumi.Input[bool] backup: For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        :param pulumi.Input[str] object_id: The object ID of the subject
        """
        pulumi.set(__self__, "subject_type", subject_type)
        if backup is not None:
            pulumi.set(__self__, "backup", backup)
        if object_id is not None:
            pulumi.set(__self__, "object_id", object_id)

    @property
    @pulumi.getter(name="subjectType")
    def subject_type(self) -> pulumi.Input[str]:
        """
        Type of users
        """
        return pulumi.get(self, "subject_type")

    @subject_type.setter
    def subject_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "subject_type", value)

    @property
    @pulumi.getter
    def backup(self) -> Optional[pulumi.Input[bool]]:
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        return pulumi.get(self, "backup")

    @backup.setter
    def backup(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "backup", value)

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> Optional[pulumi.Input[str]]:
        """
        The object ID of the subject
        """
        return pulumi.get(self, "object_id")

    @object_id.setter
    def object_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "object_id", value)


if not MYPY:
    class AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgsDict(TypedDict):
        subject_type: pulumi.Input[str]
        """
        Type of users
        """
        backup: NotRequired[pulumi.Input[bool]]
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        object_id: NotRequired[pulumi.Input[str]]
        """
        The object ID of the subject
        """
elif False:
    AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyApprovalSettingsApprovalStagePrimaryApproverArgs:
    def __init__(__self__, *,
                 subject_type: pulumi.Input[str],
                 backup: Optional[pulumi.Input[bool]] = None,
                 object_id: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] subject_type: Type of users
        :param pulumi.Input[bool] backup: For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        :param pulumi.Input[str] object_id: The object ID of the subject
        """
        pulumi.set(__self__, "subject_type", subject_type)
        if backup is not None:
            pulumi.set(__self__, "backup", backup)
        if object_id is not None:
            pulumi.set(__self__, "object_id", object_id)

    @property
    @pulumi.getter(name="subjectType")
    def subject_type(self) -> pulumi.Input[str]:
        """
        Type of users
        """
        return pulumi.get(self, "subject_type")

    @subject_type.setter
    def subject_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "subject_type", value)

    @property
    @pulumi.getter
    def backup(self) -> Optional[pulumi.Input[bool]]:
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        return pulumi.get(self, "backup")

    @backup.setter
    def backup(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "backup", value)

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> Optional[pulumi.Input[str]]:
        """
        The object ID of the subject
        """
        return pulumi.get(self, "object_id")

    @object_id.setter
    def object_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "object_id", value)


if not MYPY:
    class AccessPackageAssignmentPolicyAssignmentReviewSettingsArgsDict(TypedDict):
        access_recommendation_enabled: NotRequired[pulumi.Input[bool]]
        """
        Whether to show the reviewer decision helpers. If enabled, system recommendations based on users' access information will be shown to the reviewers. The reviewer will be recommended to approve the review if the user has signed-in at least once during the last 30 days. The reviewer will be recommended to deny the review if the user has not signed-in during the last 30 days.
        """
        access_review_timeout_behavior: NotRequired[pulumi.Input[str]]
        """
        Specifies the actions the system takes if reviewers don't respond in time. Valid values are `keepAccess`, `removeAccess`, or `acceptAccessRecommendation`.
        """
        approver_justification_required: NotRequired[pulumi.Input[bool]]
        """
        Whether a reviewer needs to provide a justification for their decision. Justification is visible to other reviewers and the requestor.
        """
        duration_in_days: NotRequired[pulumi.Input[int]]
        """
        How many days each occurrence of the access review series will run.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Whether to enable assignment review.
        """
        review_frequency: NotRequired[pulumi.Input[str]]
        """
        This will determine how often the access review campaign runs, valid values are `weekly`, `monthly`, `quarterly`, `halfyearly`, or `annual`.
        """
        review_type: NotRequired[pulumi.Input[str]]
        """
        Self-review or specific reviewers. Valid values are `Manager`, `Reviewers`, or `Self`.
        """
        reviewers: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgsDict']]]]
        """
        One or more `reviewer` blocks to specify the users who will be reviewers (when `review_type` is `Reviewers`), as documented below.
        """
        starting_on: NotRequired[pulumi.Input[str]]
        """
        This is the date the access review campaign will start on, formatted as an RFC3339 date string in UTC(e.g. 2018-01-01T01:02:03Z), default is now. Once an access review has been created, you cannot update its start date
        """
elif False:
    AccessPackageAssignmentPolicyAssignmentReviewSettingsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyAssignmentReviewSettingsArgs:
    def __init__(__self__, *,
                 access_recommendation_enabled: Optional[pulumi.Input[bool]] = None,
                 access_review_timeout_behavior: Optional[pulumi.Input[str]] = None,
                 approver_justification_required: Optional[pulumi.Input[bool]] = None,
                 duration_in_days: Optional[pulumi.Input[int]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 review_frequency: Optional[pulumi.Input[str]] = None,
                 review_type: Optional[pulumi.Input[str]] = None,
                 reviewers: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgs']]]] = None,
                 starting_on: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[bool] access_recommendation_enabled: Whether to show the reviewer decision helpers. If enabled, system recommendations based on users' access information will be shown to the reviewers. The reviewer will be recommended to approve the review if the user has signed-in at least once during the last 30 days. The reviewer will be recommended to deny the review if the user has not signed-in during the last 30 days.
        :param pulumi.Input[str] access_review_timeout_behavior: Specifies the actions the system takes if reviewers don't respond in time. Valid values are `keepAccess`, `removeAccess`, or `acceptAccessRecommendation`.
        :param pulumi.Input[bool] approver_justification_required: Whether a reviewer needs to provide a justification for their decision. Justification is visible to other reviewers and the requestor.
        :param pulumi.Input[int] duration_in_days: How many days each occurrence of the access review series will run.
        :param pulumi.Input[bool] enabled: Whether to enable assignment review.
        :param pulumi.Input[str] review_frequency: This will determine how often the access review campaign runs, valid values are `weekly`, `monthly`, `quarterly`, `halfyearly`, or `annual`.
        :param pulumi.Input[str] review_type: Self-review or specific reviewers. Valid values are `Manager`, `Reviewers`, or `Self`.
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgs']]] reviewers: One or more `reviewer` blocks to specify the users who will be reviewers (when `review_type` is `Reviewers`), as documented below.
        :param pulumi.Input[str] starting_on: This is the date the access review campaign will start on, formatted as an RFC3339 date string in UTC(e.g. 2018-01-01T01:02:03Z), default is now. Once an access review has been created, you cannot update its start date
        """
        if access_recommendation_enabled is not None:
            pulumi.set(__self__, "access_recommendation_enabled", access_recommendation_enabled)
        if access_review_timeout_behavior is not None:
            pulumi.set(__self__, "access_review_timeout_behavior", access_review_timeout_behavior)
        if approver_justification_required is not None:
            pulumi.set(__self__, "approver_justification_required", approver_justification_required)
        if duration_in_days is not None:
            pulumi.set(__self__, "duration_in_days", duration_in_days)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if review_frequency is not None:
            pulumi.set(__self__, "review_frequency", review_frequency)
        if review_type is not None:
            pulumi.set(__self__, "review_type", review_type)
        if reviewers is not None:
            pulumi.set(__self__, "reviewers", reviewers)
        if starting_on is not None:
            pulumi.set(__self__, "starting_on", starting_on)

    @property
    @pulumi.getter(name="accessRecommendationEnabled")
    def access_recommendation_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether to show the reviewer decision helpers. If enabled, system recommendations based on users' access information will be shown to the reviewers. The reviewer will be recommended to approve the review if the user has signed-in at least once during the last 30 days. The reviewer will be recommended to deny the review if the user has not signed-in during the last 30 days.
        """
        return pulumi.get(self, "access_recommendation_enabled")

    @access_recommendation_enabled.setter
    def access_recommendation_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "access_recommendation_enabled", value)

    @property
    @pulumi.getter(name="accessReviewTimeoutBehavior")
    def access_review_timeout_behavior(self) -> Optional[pulumi.Input[str]]:
        """
        Specifies the actions the system takes if reviewers don't respond in time. Valid values are `keepAccess`, `removeAccess`, or `acceptAccessRecommendation`.
        """
        return pulumi.get(self, "access_review_timeout_behavior")

    @access_review_timeout_behavior.setter
    def access_review_timeout_behavior(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "access_review_timeout_behavior", value)

    @property
    @pulumi.getter(name="approverJustificationRequired")
    def approver_justification_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether a reviewer needs to provide a justification for their decision. Justification is visible to other reviewers and the requestor.
        """
        return pulumi.get(self, "approver_justification_required")

    @approver_justification_required.setter
    def approver_justification_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "approver_justification_required", value)

    @property
    @pulumi.getter(name="durationInDays")
    def duration_in_days(self) -> Optional[pulumi.Input[int]]:
        """
        How many days each occurrence of the access review series will run.
        """
        return pulumi.get(self, "duration_in_days")

    @duration_in_days.setter
    def duration_in_days(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "duration_in_days", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether to enable assignment review.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="reviewFrequency")
    def review_frequency(self) -> Optional[pulumi.Input[str]]:
        """
        This will determine how often the access review campaign runs, valid values are `weekly`, `monthly`, `quarterly`, `halfyearly`, or `annual`.
        """
        return pulumi.get(self, "review_frequency")

    @review_frequency.setter
    def review_frequency(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "review_frequency", value)

    @property
    @pulumi.getter(name="reviewType")
    def review_type(self) -> Optional[pulumi.Input[str]]:
        """
        Self-review or specific reviewers. Valid values are `Manager`, `Reviewers`, or `Self`.
        """
        return pulumi.get(self, "review_type")

    @review_type.setter
    def review_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "review_type", value)

    @property
    @pulumi.getter
    def reviewers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgs']]]]:
        """
        One or more `reviewer` blocks to specify the users who will be reviewers (when `review_type` is `Reviewers`), as documented below.
        """
        return pulumi.get(self, "reviewers")

    @reviewers.setter
    def reviewers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgs']]]]):
        pulumi.set(self, "reviewers", value)

    @property
    @pulumi.getter(name="startingOn")
    def starting_on(self) -> Optional[pulumi.Input[str]]:
        """
        This is the date the access review campaign will start on, formatted as an RFC3339 date string in UTC(e.g. 2018-01-01T01:02:03Z), default is now. Once an access review has been created, you cannot update its start date
        """
        return pulumi.get(self, "starting_on")

    @starting_on.setter
    def starting_on(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "starting_on", value)


if not MYPY:
    class AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgsDict(TypedDict):
        subject_type: pulumi.Input[str]
        """
        Type of users
        """
        backup: NotRequired[pulumi.Input[bool]]
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        object_id: NotRequired[pulumi.Input[str]]
        """
        The object ID of the subject
        """
elif False:
    AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyAssignmentReviewSettingsReviewerArgs:
    def __init__(__self__, *,
                 subject_type: pulumi.Input[str],
                 backup: Optional[pulumi.Input[bool]] = None,
                 object_id: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] subject_type: Type of users
        :param pulumi.Input[bool] backup: For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        :param pulumi.Input[str] object_id: The object ID of the subject
        """
        pulumi.set(__self__, "subject_type", subject_type)
        if backup is not None:
            pulumi.set(__self__, "backup", backup)
        if object_id is not None:
            pulumi.set(__self__, "object_id", object_id)

    @property
    @pulumi.getter(name="subjectType")
    def subject_type(self) -> pulumi.Input[str]:
        """
        Type of users
        """
        return pulumi.get(self, "subject_type")

    @subject_type.setter
    def subject_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "subject_type", value)

    @property
    @pulumi.getter
    def backup(self) -> Optional[pulumi.Input[bool]]:
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        return pulumi.get(self, "backup")

    @backup.setter
    def backup(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "backup", value)

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> Optional[pulumi.Input[str]]:
        """
        The object ID of the subject
        """
        return pulumi.get(self, "object_id")

    @object_id.setter
    def object_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "object_id", value)


if not MYPY:
    class AccessPackageAssignmentPolicyQuestionArgsDict(TypedDict):
        text: pulumi.Input['AccessPackageAssignmentPolicyQuestionTextArgsDict']
        """
        A block describing the content of this question, as documented below.
        """
        choices: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceArgsDict']]]]
        """
        One or more blocks configuring a choice to the question, as documented below.
        """
        required: NotRequired[pulumi.Input[bool]]
        """
        Whether this question is required.
        """
        sequence: NotRequired[pulumi.Input[int]]
        """
        The sequence number of this question.
        """
elif False:
    AccessPackageAssignmentPolicyQuestionArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyQuestionArgs:
    def __init__(__self__, *,
                 text: pulumi.Input['AccessPackageAssignmentPolicyQuestionTextArgs'],
                 choices: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceArgs']]]] = None,
                 required: Optional[pulumi.Input[bool]] = None,
                 sequence: Optional[pulumi.Input[int]] = None):
        """
        :param pulumi.Input['AccessPackageAssignmentPolicyQuestionTextArgs'] text: A block describing the content of this question, as documented below.
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceArgs']]] choices: One or more blocks configuring a choice to the question, as documented below.
        :param pulumi.Input[bool] required: Whether this question is required.
        :param pulumi.Input[int] sequence: The sequence number of this question.
        """
        pulumi.set(__self__, "text", text)
        if choices is not None:
            pulumi.set(__self__, "choices", choices)
        if required is not None:
            pulumi.set(__self__, "required", required)
        if sequence is not None:
            pulumi.set(__self__, "sequence", sequence)

    @property
    @pulumi.getter
    def text(self) -> pulumi.Input['AccessPackageAssignmentPolicyQuestionTextArgs']:
        """
        A block describing the content of this question, as documented below.
        """
        return pulumi.get(self, "text")

    @text.setter
    def text(self, value: pulumi.Input['AccessPackageAssignmentPolicyQuestionTextArgs']):
        pulumi.set(self, "text", value)

    @property
    @pulumi.getter
    def choices(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceArgs']]]]:
        """
        One or more blocks configuring a choice to the question, as documented below.
        """
        return pulumi.get(self, "choices")

    @choices.setter
    def choices(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceArgs']]]]):
        pulumi.set(self, "choices", value)

    @property
    @pulumi.getter
    def required(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this question is required.
        """
        return pulumi.get(self, "required")

    @required.setter
    def required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "required", value)

    @property
    @pulumi.getter
    def sequence(self) -> Optional[pulumi.Input[int]]:
        """
        The sequence number of this question.
        """
        return pulumi.get(self, "sequence")

    @sequence.setter
    def sequence(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "sequence", value)


if not MYPY:
    class AccessPackageAssignmentPolicyQuestionChoiceArgsDict(TypedDict):
        actual_value: pulumi.Input[str]
        """
        The actual value of this choice
        """
        display_value: pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgsDict']
        """
        The display text of this choice
        """
elif False:
    AccessPackageAssignmentPolicyQuestionChoiceArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyQuestionChoiceArgs:
    def __init__(__self__, *,
                 actual_value: pulumi.Input[str],
                 display_value: pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgs']):
        """
        :param pulumi.Input[str] actual_value: The actual value of this choice
        :param pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgs'] display_value: The display text of this choice
        """
        pulumi.set(__self__, "actual_value", actual_value)
        pulumi.set(__self__, "display_value", display_value)

    @property
    @pulumi.getter(name="actualValue")
    def actual_value(self) -> pulumi.Input[str]:
        """
        The actual value of this choice
        """
        return pulumi.get(self, "actual_value")

    @actual_value.setter
    def actual_value(self, value: pulumi.Input[str]):
        pulumi.set(self, "actual_value", value)

    @property
    @pulumi.getter(name="displayValue")
    def display_value(self) -> pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgs']:
        """
        The display text of this choice
        """
        return pulumi.get(self, "display_value")

    @display_value.setter
    def display_value(self, value: pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgs']):
        pulumi.set(self, "display_value", value)


if not MYPY:
    class AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgsDict(TypedDict):
        default_text: pulumi.Input[str]
        """
        The default text of this question
        """
        localized_texts: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgsDict']]]]
        """
        The localized text of this question
        """
elif False:
    AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyQuestionChoiceDisplayValueArgs:
    def __init__(__self__, *,
                 default_text: pulumi.Input[str],
                 localized_texts: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgs']]]] = None):
        """
        :param pulumi.Input[str] default_text: The default text of this question
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgs']]] localized_texts: The localized text of this question
        """
        pulumi.set(__self__, "default_text", default_text)
        if localized_texts is not None:
            pulumi.set(__self__, "localized_texts", localized_texts)

    @property
    @pulumi.getter(name="defaultText")
    def default_text(self) -> pulumi.Input[str]:
        """
        The default text of this question
        """
        return pulumi.get(self, "default_text")

    @default_text.setter
    def default_text(self, value: pulumi.Input[str]):
        pulumi.set(self, "default_text", value)

    @property
    @pulumi.getter(name="localizedTexts")
    def localized_texts(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgs']]]]:
        """
        The localized text of this question
        """
        return pulumi.get(self, "localized_texts")

    @localized_texts.setter
    def localized_texts(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgs']]]]):
        pulumi.set(self, "localized_texts", value)


if not MYPY:
    class AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgsDict(TypedDict):
        content: pulumi.Input[str]
        """
        The localized content of this question
        """
        language_code: pulumi.Input[str]
        """
        The language code of this question content
        """
elif False:
    AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyQuestionChoiceDisplayValueLocalizedTextArgs:
    def __init__(__self__, *,
                 content: pulumi.Input[str],
                 language_code: pulumi.Input[str]):
        """
        :param pulumi.Input[str] content: The localized content of this question
        :param pulumi.Input[str] language_code: The language code of this question content
        """
        pulumi.set(__self__, "content", content)
        pulumi.set(__self__, "language_code", language_code)

    @property
    @pulumi.getter
    def content(self) -> pulumi.Input[str]:
        """
        The localized content of this question
        """
        return pulumi.get(self, "content")

    @content.setter
    def content(self, value: pulumi.Input[str]):
        pulumi.set(self, "content", value)

    @property
    @pulumi.getter(name="languageCode")
    def language_code(self) -> pulumi.Input[str]:
        """
        The language code of this question content
        """
        return pulumi.get(self, "language_code")

    @language_code.setter
    def language_code(self, value: pulumi.Input[str]):
        pulumi.set(self, "language_code", value)


if not MYPY:
    class AccessPackageAssignmentPolicyQuestionTextArgsDict(TypedDict):
        default_text: pulumi.Input[str]
        """
        The default text of this question
        """
        localized_texts: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgsDict']]]]
        """
        The localized text of this question
        """
elif False:
    AccessPackageAssignmentPolicyQuestionTextArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyQuestionTextArgs:
    def __init__(__self__, *,
                 default_text: pulumi.Input[str],
                 localized_texts: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgs']]]] = None):
        """
        :param pulumi.Input[str] default_text: The default text of this question
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgs']]] localized_texts: The localized text of this question
        """
        pulumi.set(__self__, "default_text", default_text)
        if localized_texts is not None:
            pulumi.set(__self__, "localized_texts", localized_texts)

    @property
    @pulumi.getter(name="defaultText")
    def default_text(self) -> pulumi.Input[str]:
        """
        The default text of this question
        """
        return pulumi.get(self, "default_text")

    @default_text.setter
    def default_text(self, value: pulumi.Input[str]):
        pulumi.set(self, "default_text", value)

    @property
    @pulumi.getter(name="localizedTexts")
    def localized_texts(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgs']]]]:
        """
        The localized text of this question
        """
        return pulumi.get(self, "localized_texts")

    @localized_texts.setter
    def localized_texts(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgs']]]]):
        pulumi.set(self, "localized_texts", value)


if not MYPY:
    class AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgsDict(TypedDict):
        content: pulumi.Input[str]
        """
        The localized content of this question
        """
        language_code: pulumi.Input[str]
        """
        The language code of this question content
        """
elif False:
    AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyQuestionTextLocalizedTextArgs:
    def __init__(__self__, *,
                 content: pulumi.Input[str],
                 language_code: pulumi.Input[str]):
        """
        :param pulumi.Input[str] content: The localized content of this question
        :param pulumi.Input[str] language_code: The language code of this question content
        """
        pulumi.set(__self__, "content", content)
        pulumi.set(__self__, "language_code", language_code)

    @property
    @pulumi.getter
    def content(self) -> pulumi.Input[str]:
        """
        The localized content of this question
        """
        return pulumi.get(self, "content")

    @content.setter
    def content(self, value: pulumi.Input[str]):
        pulumi.set(self, "content", value)

    @property
    @pulumi.getter(name="languageCode")
    def language_code(self) -> pulumi.Input[str]:
        """
        The language code of this question content
        """
        return pulumi.get(self, "language_code")

    @language_code.setter
    def language_code(self, value: pulumi.Input[str]):
        pulumi.set(self, "language_code", value)


if not MYPY:
    class AccessPackageAssignmentPolicyRequestorSettingsArgsDict(TypedDict):
        requestors: NotRequired[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyRequestorSettingsRequestorArgsDict']]]]
        """
        A block specifying the users who are allowed to request on this policy, as documented below.
        """
        requests_accepted: NotRequired[pulumi.Input[bool]]
        """
        Whether to accept requests using this policy. When `false`, no new requests can be made using this policy.
        """
        scope_type: NotRequired[pulumi.Input[str]]
        """
        Specifies the scopes of the requestors. Valid values are `AllConfiguredConnectedOrganizationSubjects`, `AllExistingConnectedOrganizationSubjects`, `AllExistingDirectoryMemberUsers`, `AllExistingDirectorySubjects`, `AllExternalSubjects`, `NoSubjects`, `SpecificConnectedOrganizationSubjects`, or `SpecificDirectorySubjects`.
        """
elif False:
    AccessPackageAssignmentPolicyRequestorSettingsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyRequestorSettingsArgs:
    def __init__(__self__, *,
                 requestors: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyRequestorSettingsRequestorArgs']]]] = None,
                 requests_accepted: Optional[pulumi.Input[bool]] = None,
                 scope_type: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyRequestorSettingsRequestorArgs']]] requestors: A block specifying the users who are allowed to request on this policy, as documented below.
        :param pulumi.Input[bool] requests_accepted: Whether to accept requests using this policy. When `false`, no new requests can be made using this policy.
        :param pulumi.Input[str] scope_type: Specifies the scopes of the requestors. Valid values are `AllConfiguredConnectedOrganizationSubjects`, `AllExistingConnectedOrganizationSubjects`, `AllExistingDirectoryMemberUsers`, `AllExistingDirectorySubjects`, `AllExternalSubjects`, `NoSubjects`, `SpecificConnectedOrganizationSubjects`, or `SpecificDirectorySubjects`.
        """
        if requestors is not None:
            pulumi.set(__self__, "requestors", requestors)
        if requests_accepted is not None:
            pulumi.set(__self__, "requests_accepted", requests_accepted)
        if scope_type is not None:
            pulumi.set(__self__, "scope_type", scope_type)

    @property
    @pulumi.getter
    def requestors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyRequestorSettingsRequestorArgs']]]]:
        """
        A block specifying the users who are allowed to request on this policy, as documented below.
        """
        return pulumi.get(self, "requestors")

    @requestors.setter
    def requestors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['AccessPackageAssignmentPolicyRequestorSettingsRequestorArgs']]]]):
        pulumi.set(self, "requestors", value)

    @property
    @pulumi.getter(name="requestsAccepted")
    def requests_accepted(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether to accept requests using this policy. When `false`, no new requests can be made using this policy.
        """
        return pulumi.get(self, "requests_accepted")

    @requests_accepted.setter
    def requests_accepted(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "requests_accepted", value)

    @property
    @pulumi.getter(name="scopeType")
    def scope_type(self) -> Optional[pulumi.Input[str]]:
        """
        Specifies the scopes of the requestors. Valid values are `AllConfiguredConnectedOrganizationSubjects`, `AllExistingConnectedOrganizationSubjects`, `AllExistingDirectoryMemberUsers`, `AllExistingDirectorySubjects`, `AllExternalSubjects`, `NoSubjects`, `SpecificConnectedOrganizationSubjects`, or `SpecificDirectorySubjects`.
        """
        return pulumi.get(self, "scope_type")

    @scope_type.setter
    def scope_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "scope_type", value)


if not MYPY:
    class AccessPackageAssignmentPolicyRequestorSettingsRequestorArgsDict(TypedDict):
        subject_type: pulumi.Input[str]
        """
        Type of users
        """
        backup: NotRequired[pulumi.Input[bool]]
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        object_id: NotRequired[pulumi.Input[str]]
        """
        The object ID of the subject
        """
elif False:
    AccessPackageAssignmentPolicyRequestorSettingsRequestorArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class AccessPackageAssignmentPolicyRequestorSettingsRequestorArgs:
    def __init__(__self__, *,
                 subject_type: pulumi.Input[str],
                 backup: Optional[pulumi.Input[bool]] = None,
                 object_id: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] subject_type: Type of users
        :param pulumi.Input[bool] backup: For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        :param pulumi.Input[str] object_id: The object ID of the subject
        """
        pulumi.set(__self__, "subject_type", subject_type)
        if backup is not None:
            pulumi.set(__self__, "backup", backup)
        if object_id is not None:
            pulumi.set(__self__, "object_id", object_id)

    @property
    @pulumi.getter(name="subjectType")
    def subject_type(self) -> pulumi.Input[str]:
        """
        Type of users
        """
        return pulumi.get(self, "subject_type")

    @subject_type.setter
    def subject_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "subject_type", value)

    @property
    @pulumi.getter
    def backup(self) -> Optional[pulumi.Input[bool]]:
        """
        For a user in an approval stage, this property indicates whether the user is a backup fallback approver
        """
        return pulumi.get(self, "backup")

    @backup.setter
    def backup(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "backup", value)

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> Optional[pulumi.Input[str]]:
        """
        The object ID of the subject
        """
        return pulumi.get(self, "object_id")

    @object_id.setter
    def object_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "object_id", value)


if not MYPY:
    class ApplicationApiArgsDict(TypedDict):
        known_client_applications: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A set of client IDs, used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        """
        mapped_claims_enabled: NotRequired[pulumi.Input[bool]]
        """
        Allows an application to use claims mapping without specifying a custom signing key. Defaults to `false`.
        """
        oauth2_permission_scopes: NotRequired[pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgsDict']]]]
        """
        One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        """
        requested_access_token_version: NotRequired[pulumi.Input[int]]
        """
        The access token version expected by this resource. Must be one of `1` or `2`, and must be `2` when `sign_in_audience` is either `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount` Defaults to `1`.
        """
elif False:
    ApplicationApiArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationApiArgs:
    def __init__(__self__, *,
                 known_client_applications: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 mapped_claims_enabled: Optional[pulumi.Input[bool]] = None,
                 oauth2_permission_scopes: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]]] = None,
                 requested_access_token_version: Optional[pulumi.Input[int]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] known_client_applications: A set of client IDs, used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        :param pulumi.Input[bool] mapped_claims_enabled: Allows an application to use claims mapping without specifying a custom signing key. Defaults to `false`.
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]] oauth2_permission_scopes: One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        :param pulumi.Input[int] requested_access_token_version: The access token version expected by this resource. Must be one of `1` or `2`, and must be `2` when `sign_in_audience` is either `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount` Defaults to `1`.
        """
        if known_client_applications is not None:
            pulumi.set(__self__, "known_client_applications", known_client_applications)
        if mapped_claims_enabled is not None:
            pulumi.set(__self__, "mapped_claims_enabled", mapped_claims_enabled)
        if oauth2_permission_scopes is not None:
            pulumi.set(__self__, "oauth2_permission_scopes", oauth2_permission_scopes)
        if requested_access_token_version is not None:
            pulumi.set(__self__, "requested_access_token_version", requested_access_token_version)

    @property
    @pulumi.getter(name="knownClientApplications")
    def known_client_applications(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of client IDs, used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app.
        """
        return pulumi.get(self, "known_client_applications")

    @known_client_applications.setter
    def known_client_applications(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "known_client_applications", value)

    @property
    @pulumi.getter(name="mappedClaimsEnabled")
    def mapped_claims_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Allows an application to use claims mapping without specifying a custom signing key. Defaults to `false`.
        """
        return pulumi.get(self, "mapped_claims_enabled")

    @mapped_claims_enabled.setter
    def mapped_claims_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "mapped_claims_enabled", value)

    @property
    @pulumi.getter(name="oauth2PermissionScopes")
    def oauth2_permission_scopes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]]]:
        """
        One or more `oauth2_permission_scope` blocks as documented below, to describe delegated permissions exposed by the web API represented by this application.
        """
        return pulumi.get(self, "oauth2_permission_scopes")

    @oauth2_permission_scopes.setter
    def oauth2_permission_scopes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationApiOauth2PermissionScopeArgs']]]]):
        pulumi.set(self, "oauth2_permission_scopes", value)

    @property
    @pulumi.getter(name="requestedAccessTokenVersion")
    def requested_access_token_version(self) -> Optional[pulumi.Input[int]]:
        """
        The access token version expected by this resource. Must be one of `1` or `2`, and must be `2` when `sign_in_audience` is either `AzureADandPersonalMicrosoftAccount` or `PersonalMicrosoftAccount` Defaults to `1`.
        """
        return pulumi.get(self, "requested_access_token_version")

    @requested_access_token_version.setter
    def requested_access_token_version(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "requested_access_token_version", value)


if not MYPY:
    class ApplicationApiOauth2PermissionScopeArgsDict(TypedDict):
        id: pulumi.Input[str]
        """
        The unique identifier of the delegated permission. Must be a valid UUID.

        > **Tip: Generating a UUID for the `id` field** To generate a value for the `id` field in cases where the actual UUID is not important, you can use the `random_uuid` resource. See the application example in the provider repository.
        """
        admin_consent_description: NotRequired[pulumi.Input[str]]
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        admin_consent_display_name: NotRequired[pulumi.Input[str]]
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Determines if the permission scope is enabled. Defaults to `true`.
        """
        type: NotRequired[pulumi.Input[str]]
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Defaults to `User`. Possible values are `User` or `Admin`.
        """
        user_consent_description: NotRequired[pulumi.Input[str]]
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        user_consent_display_name: NotRequired[pulumi.Input[str]]
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        value: NotRequired[pulumi.Input[str]]
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens
        """
elif False:
    ApplicationApiOauth2PermissionScopeArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationApiOauth2PermissionScopeArgs:
    def __init__(__self__, *,
                 id: pulumi.Input[str],
                 admin_consent_description: Optional[pulumi.Input[str]] = None,
                 admin_consent_display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 user_consent_description: Optional[pulumi.Input[str]] = None,
                 user_consent_display_name: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] id: The unique identifier of the delegated permission. Must be a valid UUID.
               
               > **Tip: Generating a UUID for the `id` field** To generate a value for the `id` field in cases where the actual UUID is not important, you can use the `random_uuid` resource. See the application example in the provider repository.
        :param pulumi.Input[str] admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[str] admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[bool] enabled: Determines if the permission scope is enabled. Defaults to `true`.
        :param pulumi.Input[str] type: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Defaults to `User`. Possible values are `User` or `Admin`.
        :param pulumi.Input[str] user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param pulumi.Input[str] user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param pulumi.Input[str] value: The value that is used for the `scp` claim in OAuth 2.0 access tokens
        """
        pulumi.set(__self__, "id", id)
        if admin_consent_description is not None:
            pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        if admin_consent_display_name is not None:
            pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if type is not None:
            pulumi.set(__self__, "type", type)
        if user_consent_description is not None:
            pulumi.set(__self__, "user_consent_description", user_consent_description)
        if user_consent_display_name is not None:
            pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def id(self) -> pulumi.Input[str]:
        """
        The unique identifier of the delegated permission. Must be a valid UUID.

        > **Tip: Generating a UUID for the `id` field** To generate a value for the `id` field in cases where the actual UUID is not important, you can use the `random_uuid` resource. See the application example in the provider repository.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: pulumi.Input[str]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @admin_consent_description.setter
    def admin_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_description", value)

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @admin_consent_display_name.setter
    def admin_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Determines if the permission scope is enabled. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def type(self) -> Optional[pulumi.Input[str]]:
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Defaults to `User`. Possible values are `User` or `Admin`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "type", value)

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @user_consent_description.setter
    def user_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_description", value)

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @user_consent_display_name.setter
    def user_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_display_name", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


if not MYPY:
    class ApplicationAppRoleArgsDict(TypedDict):
        allowed_member_types: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        Specifies whether this app role definition can be assigned to users and groups by setting to `User`, or to other applications (that are accessing this application in a standalone scenario) by setting to `Application`, or to both.
        """
        description: pulumi.Input[str]
        """
        Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        """
        display_name: pulumi.Input[str]
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        id: pulumi.Input[str]
        """
        The unique identifier of the app role. Must be a valid UUID.

        > **Tip: Generating a UUID for the `id` field** To generate a value for the `id` field in cases where the actual UUID is not important, you can use the `random_uuid` resource. See the application example in the provider repository.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Determines if the app role is enabled. Defaults to `true`.
        """
        value: NotRequired[pulumi.Input[str]]
        """
        The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal
        """
elif False:
    ApplicationAppRoleArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationAppRoleArgs:
    def __init__(__self__, *,
                 allowed_member_types: pulumi.Input[Sequence[pulumi.Input[str]]],
                 description: pulumi.Input[str],
                 display_name: pulumi.Input[str],
                 id: pulumi.Input[str],
                 enabled: Optional[pulumi.Input[bool]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups by setting to `User`, or to other applications (that are accessing this application in a standalone scenario) by setting to `Application`, or to both.
        :param pulumi.Input[str] description: Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        :param pulumi.Input[str] display_name: Display name for the app role that appears during app role assignment and in consent experiences.
        :param pulumi.Input[str] id: The unique identifier of the app role. Must be a valid UUID.
               
               > **Tip: Generating a UUID for the `id` field** To generate a value for the `id` field in cases where the actual UUID is not important, you can use the `random_uuid` resource. See the application example in the provider repository.
        :param pulumi.Input[bool] enabled: Determines if the app role is enabled. Defaults to `true`.
        :param pulumi.Input[str] value: The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal
        """
        pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        pulumi.set(__self__, "description", description)
        pulumi.set(__self__, "display_name", display_name)
        pulumi.set(__self__, "id", id)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        Specifies whether this app role definition can be assigned to users and groups by setting to `User`, or to other applications (that are accessing this application in a standalone scenario) by setting to `Application`, or to both.
        """
        return pulumi.get(self, "allowed_member_types")

    @allowed_member_types.setter
    def allowed_member_types(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "allowed_member_types", value)

    @property
    @pulumi.getter
    def description(self) -> pulumi.Input[str]:
        """
        Description of the app role that appears when the role is being assigned and, if the role functions as an application permissions, during the consent experiences.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: pulumi.Input[str]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> pulumi.Input[str]:
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "display_name", value)

    @property
    @pulumi.getter
    def id(self) -> pulumi.Input[str]:
        """
        The unique identifier of the app role. Must be a valid UUID.

        > **Tip: Generating a UUID for the `id` field** To generate a value for the `id` field in cases where the actual UUID is not important, you can use the `random_uuid` resource. See the application example in the provider repository.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: pulumi.Input[str]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Determines if the app role is enabled. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `roles` claim in ID tokens and OAuth 2.0 access tokens that are authenticating an assigned service or user principal
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


if not MYPY:
    class ApplicationFeatureTagArgsDict(TypedDict):
        custom_single_sign_on: NotRequired[pulumi.Input[bool]]
        """
        Whether this application represents a custom SAML application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        enterprise: NotRequired[pulumi.Input[bool]]
        """
        Whether this application represents an Enterprise Application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        gallery: NotRequired[pulumi.Input[bool]]
        """
        Whether this application represents a gallery application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        hide: NotRequired[pulumi.Input[bool]]
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
elif False:
    ApplicationFeatureTagArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationFeatureTagArgs:
    def __init__(__self__, *,
                 custom_single_sign_on: Optional[pulumi.Input[bool]] = None,
                 enterprise: Optional[pulumi.Input[bool]] = None,
                 gallery: Optional[pulumi.Input[bool]] = None,
                 hide: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] custom_single_sign_on: Whether this application represents a custom SAML application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        :param pulumi.Input[bool] enterprise: Whether this application represents an Enterprise Application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        :param pulumi.Input[bool] gallery: Whether this application represents a gallery application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        :param pulumi.Input[bool] hide: Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        if custom_single_sign_on is not None:
            pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        if enterprise is not None:
            pulumi.set(__self__, "enterprise", enterprise)
        if gallery is not None:
            pulumi.set(__self__, "gallery", gallery)
        if hide is not None:
            pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this application represents a custom SAML application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        return pulumi.get(self, "custom_single_sign_on")

    @custom_single_sign_on.setter
    def custom_single_sign_on(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "custom_single_sign_on", value)

    @property
    @pulumi.getter
    def enterprise(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this application represents an Enterprise Application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "enterprise")

    @enterprise.setter
    def enterprise(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enterprise", value)

    @property
    @pulumi.getter
    def gallery(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this application represents a gallery application for linked service principals. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        return pulumi.get(self, "gallery")

    @gallery.setter
    def gallery(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "gallery", value)

    @property
    @pulumi.getter
    def hide(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "hide")

    @hide.setter
    def hide(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide", value)


if not MYPY:
    class ApplicationOptionalClaimsArgsDict(TypedDict):
        access_tokens: NotRequired[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgsDict']]]]
        """
        One or more `access_token` blocks as documented below.
        """
        id_tokens: NotRequired[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgsDict']]]]
        """
        One or more `id_token` blocks as documented below.
        """
        saml2_tokens: NotRequired[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgsDict']]]]
        """
        One or more `saml2_token` blocks as documented below.
        """
elif False:
    ApplicationOptionalClaimsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationOptionalClaimsArgs:
    def __init__(__self__, *,
                 access_tokens: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]]] = None,
                 id_tokens: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]]] = None,
                 saml2_tokens: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]] access_tokens: One or more `access_token` blocks as documented below.
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]] id_tokens: One or more `id_token` blocks as documented below.
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]] saml2_tokens: One or more `saml2_token` blocks as documented below.
        """
        if access_tokens is not None:
            pulumi.set(__self__, "access_tokens", access_tokens)
        if id_tokens is not None:
            pulumi.set(__self__, "id_tokens", id_tokens)
        if saml2_tokens is not None:
            pulumi.set(__self__, "saml2_tokens", saml2_tokens)

    @property
    @pulumi.getter(name="accessTokens")
    def access_tokens(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]]]:
        """
        One or more `access_token` blocks as documented below.
        """
        return pulumi.get(self, "access_tokens")

    @access_tokens.setter
    def access_tokens(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsAccessTokenArgs']]]]):
        pulumi.set(self, "access_tokens", value)

    @property
    @pulumi.getter(name="idTokens")
    def id_tokens(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]]]:
        """
        One or more `id_token` blocks as documented below.
        """
        return pulumi.get(self, "id_tokens")

    @id_tokens.setter
    def id_tokens(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsIdTokenArgs']]]]):
        pulumi.set(self, "id_tokens", value)

    @property
    @pulumi.getter(name="saml2Tokens")
    def saml2_tokens(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]]]:
        """
        One or more `saml2_token` blocks as documented below.
        """
        return pulumi.get(self, "saml2_tokens")

    @saml2_tokens.setter
    def saml2_tokens(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ApplicationOptionalClaimsSaml2TokenArgs']]]]):
        pulumi.set(self, "saml2_tokens", value)


if not MYPY:
    class ApplicationOptionalClaimsAccessTokenArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the optional claim.
        """
        additional_properties: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        """
        essential: NotRequired[pulumi.Input[bool]]
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        source: NotRequired[pulumi.Input[str]]
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
elif False:
    ApplicationOptionalClaimsAccessTokenArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationOptionalClaimsAccessTokenArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 additional_properties: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 essential: Optional[pulumi.Input[bool]] = None,
                 source: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the optional claim.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        :param pulumi.Input[bool] essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param pulumi.Input[str] source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        """
        return pulumi.get(self, "additional_properties")

    @additional_properties.setter
    def additional_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_properties", value)

    @property
    @pulumi.getter
    def essential(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @essential.setter
    def essential(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "essential", value)

    @property
    @pulumi.getter
    def source(self) -> Optional[pulumi.Input[str]]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")

    @source.setter
    def source(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source", value)


if not MYPY:
    class ApplicationOptionalClaimsIdTokenArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the optional claim.
        """
        additional_properties: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        """
        essential: NotRequired[pulumi.Input[bool]]
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        source: NotRequired[pulumi.Input[str]]
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
elif False:
    ApplicationOptionalClaimsIdTokenArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationOptionalClaimsIdTokenArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 additional_properties: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 essential: Optional[pulumi.Input[bool]] = None,
                 source: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the optional claim.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        :param pulumi.Input[bool] essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param pulumi.Input[str] source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        """
        return pulumi.get(self, "additional_properties")

    @additional_properties.setter
    def additional_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_properties", value)

    @property
    @pulumi.getter
    def essential(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @essential.setter
    def essential(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "essential", value)

    @property
    @pulumi.getter
    def source(self) -> Optional[pulumi.Input[str]]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")

    @source.setter
    def source(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source", value)


if not MYPY:
    class ApplicationOptionalClaimsSaml2TokenArgsDict(TypedDict):
        name: pulumi.Input[str]
        """
        The name of the optional claim.
        """
        additional_properties: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        """
        essential: NotRequired[pulumi.Input[bool]]
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        source: NotRequired[pulumi.Input[str]]
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
elif False:
    ApplicationOptionalClaimsSaml2TokenArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationOptionalClaimsSaml2TokenArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 additional_properties: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 essential: Optional[pulumi.Input[bool]] = None,
                 source: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] name: The name of the optional claim.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_properties: List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        :param pulumi.Input[bool] essential: Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        :param pulumi.Input[str] source: The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        pulumi.set(__self__, "name", name)
        if additional_properties is not None:
            pulumi.set(__self__, "additional_properties", additional_properties)
        if essential is not None:
            pulumi.set(__self__, "essential", essential)
        if source is not None:
            pulumi.set(__self__, "source", source)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        """
        The name of the optional claim.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="additionalProperties")
    def additional_properties(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of additional properties of the claim. If a property exists in this list, it modifies the behaviour of the optional claim. Possible values are: `cloud_displayname`, `dns_domain_and_sam_account_name`, `emit_as_roles`, `include_externally_authenticated_upn_without_hash`, `include_externally_authenticated_upn`, `max_size_limit`, `netbios_domain_and_sam_account_name`, `on_premise_security_identifier`, `sam_account_name`, and `use_guid`.
        """
        return pulumi.get(self, "additional_properties")

    @additional_properties.setter
    def additional_properties(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_properties", value)

    @property
    @pulumi.getter
    def essential(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the claim specified by the client is necessary to ensure a smooth authorization experience.
        """
        return pulumi.get(self, "essential")

    @essential.setter
    def essential(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "essential", value)

    @property
    @pulumi.getter
    def source(self) -> Optional[pulumi.Input[str]]:
        """
        The source of the claim. If `source` is absent, the claim is a predefined optional claim. If `source` is `user`, the value of `name` is the extension property from the user object.
        """
        return pulumi.get(self, "source")

    @source.setter
    def source(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "source", value)


if not MYPY:
    class ApplicationPasswordArgsDict(TypedDict):
        display_name: pulumi.Input[str]
        """
        A display name for the password. Changing this field forces a new resource to be created.
        """
        end_date: NotRequired[pulumi.Input[str]]
        """
        The end date until which the password is valid, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`). Changing this field forces a new resource to be created.
        """
        key_id: NotRequired[pulumi.Input[str]]
        """
        (Required) The unique key ID for the generated password.
        """
        start_date: NotRequired[pulumi.Input[str]]
        """
        The start date from which the password is valid, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`). If this isn't specified, the current date is used.  Changing this field forces a new resource to be created.
        """
        value: NotRequired[pulumi.Input[str]]
        """
        (Required) The generated password for the application.
        """
elif False:
    ApplicationPasswordArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationPasswordArgs:
    def __init__(__self__, *,
                 display_name: pulumi.Input[str],
                 end_date: Optional[pulumi.Input[str]] = None,
                 key_id: Optional[pulumi.Input[str]] = None,
                 start_date: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] display_name: A display name for the password. Changing this field forces a new resource to be created.
        :param pulumi.Input[str] end_date: The end date until which the password is valid, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`). Changing this field forces a new resource to be created.
        :param pulumi.Input[str] key_id: (Required) The unique key ID for the generated password.
        :param pulumi.Input[str] start_date: The start date from which the password is valid, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`). If this isn't specified, the current date is used.  Changing this field forces a new resource to be created.
        :param pulumi.Input[str] value: (Required) The generated password for the application.
        """
        pulumi.set(__self__, "display_name", display_name)
        if end_date is not None:
            pulumi.set(__self__, "end_date", end_date)
        if key_id is not None:
            pulumi.set(__self__, "key_id", key_id)
        if start_date is not None:
            pulumi.set(__self__, "start_date", start_date)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> pulumi.Input[str]:
        """
        A display name for the password. Changing this field forces a new resource to be created.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "display_name", value)

    @property
    @pulumi.getter(name="endDate")
    def end_date(self) -> Optional[pulumi.Input[str]]:
        """
        The end date until which the password is valid, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`). Changing this field forces a new resource to be created.
        """
        return pulumi.get(self, "end_date")

    @end_date.setter
    def end_date(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "end_date", value)

    @property
    @pulumi.getter(name="keyId")
    def key_id(self) -> Optional[pulumi.Input[str]]:
        """
        (Required) The unique key ID for the generated password.
        """
        return pulumi.get(self, "key_id")

    @key_id.setter
    def key_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "key_id", value)

    @property
    @pulumi.getter(name="startDate")
    def start_date(self) -> Optional[pulumi.Input[str]]:
        """
        The start date from which the password is valid, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`). If this isn't specified, the current date is used.  Changing this field forces a new resource to be created.
        """
        return pulumi.get(self, "start_date")

    @start_date.setter
    def start_date(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "start_date", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        (Required) The generated password for the application.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


if not MYPY:
    class ApplicationPublicClientArgsDict(TypedDict):
        redirect_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` or `ms-appx-web` URL.
        """
elif False:
    ApplicationPublicClientArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationPublicClientArgs:
    def __init__(__self__, *,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` or `ms-appx-web` URL.
        """
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` or `ms-appx-web` URL.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)


if not MYPY:
    class ApplicationRequiredResourceAccessArgsDict(TypedDict):
        resource_accesses: pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgsDict']]]
        """
        A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        """
        resource_app_id: pulumi.Input[str]
        """
        The unique identifier for the resource that the application requires access to. This should be the Application ID of the target application.

        > **Note:** Documentation on `resource_app_id` values for Microsoft APIs can be difficult to find, but you can use the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az_ad_sp_list) to find them. (e.g. `az ad sp list --display-name "Microsoft Graph" --query '[].{appDisplayName:appDisplayName, appId:appId}'`)
        """
elif False:
    ApplicationRequiredResourceAccessArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationRequiredResourceAccessArgs:
    def __init__(__self__, *,
                 resource_accesses: pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]],
                 resource_app_id: pulumi.Input[str]):
        """
        :param pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]] resource_accesses: A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        :param pulumi.Input[str] resource_app_id: The unique identifier for the resource that the application requires access to. This should be the Application ID of the target application.
               
               > **Note:** Documentation on `resource_app_id` values for Microsoft APIs can be difficult to find, but you can use the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az_ad_sp_list) to find them. (e.g. `az ad sp list --display-name "Microsoft Graph" --query '[].{appDisplayName:appDisplayName, appId:appId}'`)
        """
        pulumi.set(__self__, "resource_accesses", resource_accesses)
        pulumi.set(__self__, "resource_app_id", resource_app_id)

    @property
    @pulumi.getter(name="resourceAccesses")
    def resource_accesses(self) -> pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]]:
        """
        A collection of `resource_access` blocks as documented below, describing OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
        """
        return pulumi.get(self, "resource_accesses")

    @resource_accesses.setter
    def resource_accesses(self, value: pulumi.Input[Sequence[pulumi.Input['ApplicationRequiredResourceAccessResourceAccessArgs']]]):
        pulumi.set(self, "resource_accesses", value)

    @property
    @pulumi.getter(name="resourceAppId")
    def resource_app_id(self) -> pulumi.Input[str]:
        """
        The unique identifier for the resource that the application requires access to. This should be the Application ID of the target application.

        > **Note:** Documentation on `resource_app_id` values for Microsoft APIs can be difficult to find, but you can use the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az_ad_sp_list) to find them. (e.g. `az ad sp list --display-name "Microsoft Graph" --query '[].{appDisplayName:appDisplayName, appId:appId}'`)
        """
        return pulumi.get(self, "resource_app_id")

    @resource_app_id.setter
    def resource_app_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "resource_app_id", value)


if not MYPY:
    class ApplicationRequiredResourceAccessResourceAccessArgsDict(TypedDict):
        id: pulumi.Input[str]
        """
        The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        """
        type: pulumi.Input[str]
        """
        Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
elif False:
    ApplicationRequiredResourceAccessResourceAccessArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationRequiredResourceAccessResourceAccessArgs:
    def __init__(__self__, *,
                 id: pulumi.Input[str],
                 type: pulumi.Input[str]):
        """
        :param pulumi.Input[str] id: The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        :param pulumi.Input[str] type: Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "type", type)

    @property
    @pulumi.getter
    def id(self) -> pulumi.Input[str]:
        """
        The unique identifier for an app role or OAuth2 permission scope published by the resource application.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: pulumi.Input[str]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def type(self) -> pulumi.Input[str]:
        """
        Specifies whether the `id` property references an app role or an OAuth2 permission scope. Possible values are `Role` or `Scope`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: pulumi.Input[str]):
        pulumi.set(self, "type", value)


if not MYPY:
    class ApplicationSinglePageApplicationArgsDict(TypedDict):
        redirect_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` URL.
        """
elif False:
    ApplicationSinglePageApplicationArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationSinglePageApplicationArgs:
    def __init__(__self__, *,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` URL.
        """
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `https` URL.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)


if not MYPY:
    class ApplicationWebArgsDict(TypedDict):
        homepage_url: NotRequired[pulumi.Input[str]]
        """
        Home page or landing page of the application.
        """
        implicit_grant: NotRequired[pulumi.Input['ApplicationWebImplicitGrantArgsDict']]
        """
        An `implicit_grant` block as documented above.
        """
        logout_url: NotRequired[pulumi.Input[str]]
        """
        The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        """
        redirect_uris: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `http` URL or a URN.
        """
elif False:
    ApplicationWebArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationWebArgs:
    def __init__(__self__, *,
                 homepage_url: Optional[pulumi.Input[str]] = None,
                 implicit_grant: Optional[pulumi.Input['ApplicationWebImplicitGrantArgs']] = None,
                 logout_url: Optional[pulumi.Input[str]] = None,
                 redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] homepage_url: Home page or landing page of the application.
        :param pulumi.Input['ApplicationWebImplicitGrantArgs'] implicit_grant: An `implicit_grant` block as documented above.
        :param pulumi.Input[str] logout_url: The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] redirect_uris: A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `http` URL or a URN.
        """
        if homepage_url is not None:
            pulumi.set(__self__, "homepage_url", homepage_url)
        if implicit_grant is not None:
            pulumi.set(__self__, "implicit_grant", implicit_grant)
        if logout_url is not None:
            pulumi.set(__self__, "logout_url", logout_url)
        if redirect_uris is not None:
            pulumi.set(__self__, "redirect_uris", redirect_uris)

    @property
    @pulumi.getter(name="homepageUrl")
    def homepage_url(self) -> Optional[pulumi.Input[str]]:
        """
        Home page or landing page of the application.
        """
        return pulumi.get(self, "homepage_url")

    @homepage_url.setter
    def homepage_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "homepage_url", value)

    @property
    @pulumi.getter(name="implicitGrant")
    def implicit_grant(self) -> Optional[pulumi.Input['ApplicationWebImplicitGrantArgs']]:
        """
        An `implicit_grant` block as documented above.
        """
        return pulumi.get(self, "implicit_grant")

    @implicit_grant.setter
    def implicit_grant(self, value: Optional[pulumi.Input['ApplicationWebImplicitGrantArgs']]):
        pulumi.set(self, "implicit_grant", value)

    @property
    @pulumi.getter(name="logoutUrl")
    def logout_url(self) -> Optional[pulumi.Input[str]]:
        """
        The URL that will be used by Microsoft's authorization service to sign out a user using front-channel, back-channel or SAML logout protocols.
        """
        return pulumi.get(self, "logout_url")

    @logout_url.setter
    def logout_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "logout_url", value)

    @property
    @pulumi.getter(name="redirectUris")
    def redirect_uris(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A set of URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Must be a valid `http` URL or a URN.
        """
        return pulumi.get(self, "redirect_uris")

    @redirect_uris.setter
    def redirect_uris(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "redirect_uris", value)


if not MYPY:
    class ApplicationWebImplicitGrantArgsDict(TypedDict):
        access_token_issuance_enabled: NotRequired[pulumi.Input[bool]]
        """
        Whether this web application can request an access token using OAuth 2.0 implicit flow.
        """
        id_token_issuance_enabled: NotRequired[pulumi.Input[bool]]
        """
        Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
elif False:
    ApplicationWebImplicitGrantArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ApplicationWebImplicitGrantArgs:
    def __init__(__self__, *,
                 access_token_issuance_enabled: Optional[pulumi.Input[bool]] = None,
                 id_token_issuance_enabled: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] access_token_issuance_enabled: Whether this web application can request an access token using OAuth 2.0 implicit flow.
        :param pulumi.Input[bool] id_token_issuance_enabled: Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        if access_token_issuance_enabled is not None:
            pulumi.set(__self__, "access_token_issuance_enabled", access_token_issuance_enabled)
        if id_token_issuance_enabled is not None:
            pulumi.set(__self__, "id_token_issuance_enabled", id_token_issuance_enabled)

    @property
    @pulumi.getter(name="accessTokenIssuanceEnabled")
    def access_token_issuance_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this web application can request an access token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "access_token_issuance_enabled")

    @access_token_issuance_enabled.setter
    def access_token_issuance_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "access_token_issuance_enabled", value)

    @property
    @pulumi.getter(name="idTokenIssuanceEnabled")
    def id_token_issuance_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this web application can request an ID token using OAuth 2.0 implicit flow.
        """
        return pulumi.get(self, "id_token_issuance_enabled")

    @id_token_issuance_enabled.setter
    def id_token_issuance_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "id_token_issuance_enabled", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsArgsDict(TypedDict):
        applications: pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgsDict']
        """
        An `applications` block as documented below, which specifies applications and user actions included in and excluded from the policy.
        """
        client_app_types: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A list of client application types included in the policy. Possible values are: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported` and `other`.
        """
        users: pulumi.Input['ConditionalAccessPolicyConditionsUsersArgsDict']
        """
        A `users` block as documented below, which specifies users, groups, and roles included in and excluded from the policy.
        """
        client_applications: NotRequired[pulumi.Input['ConditionalAccessPolicyConditionsClientApplicationsArgsDict']]
        """
        An `client_applications` block as documented below, which specifies service principals included in and excluded from the policy.
        """
        devices: NotRequired[pulumi.Input['ConditionalAccessPolicyConditionsDevicesArgsDict']]
        """
        A `devices` block as documented below, which describes devices to be included in and excluded from the policy. A `devices` block can be added to an existing policy, but removing the `devices` block forces a new resource to be created.
        """
        insider_risk_levels: NotRequired[pulumi.Input[str]]
        """
        The insider risk level in the policy. Possible values are: `minor`, `moderate`, `elevated`, `unknownFutureValue`.
        """
        locations: NotRequired[pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgsDict']]
        """
        A `locations` block as documented below, which specifies locations included in and excluded from the policy.
        """
        platforms: NotRequired[pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgsDict']]
        """
        A `platforms` block as documented below, which specifies platforms included in and excluded from the policy.
        """
        service_principal_risk_levels: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of service principal sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `none`, `unknownFutureValue`.
        """
        sign_in_risk_levels: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of user sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        user_risk_levels: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of user risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
elif False:
    ConditionalAccessPolicyConditionsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsArgs:
    def __init__(__self__, *,
                 applications: pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs'],
                 client_app_types: pulumi.Input[Sequence[pulumi.Input[str]]],
                 users: pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs'],
                 client_applications: Optional[pulumi.Input['ConditionalAccessPolicyConditionsClientApplicationsArgs']] = None,
                 devices: Optional[pulumi.Input['ConditionalAccessPolicyConditionsDevicesArgs']] = None,
                 insider_risk_levels: Optional[pulumi.Input[str]] = None,
                 locations: Optional[pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs']] = None,
                 platforms: Optional[pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs']] = None,
                 service_principal_risk_levels: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 sign_in_risk_levels: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 user_risk_levels: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs'] applications: An `applications` block as documented below, which specifies applications and user actions included in and excluded from the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] client_app_types: A list of client application types included in the policy. Possible values are: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported` and `other`.
        :param pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs'] users: A `users` block as documented below, which specifies users, groups, and roles included in and excluded from the policy.
        :param pulumi.Input['ConditionalAccessPolicyConditionsClientApplicationsArgs'] client_applications: An `client_applications` block as documented below, which specifies service principals included in and excluded from the policy.
        :param pulumi.Input['ConditionalAccessPolicyConditionsDevicesArgs'] devices: A `devices` block as documented below, which describes devices to be included in and excluded from the policy. A `devices` block can be added to an existing policy, but removing the `devices` block forces a new resource to be created.
        :param pulumi.Input[str] insider_risk_levels: The insider risk level in the policy. Possible values are: `minor`, `moderate`, `elevated`, `unknownFutureValue`.
        :param pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs'] locations: A `locations` block as documented below, which specifies locations included in and excluded from the policy.
        :param pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs'] platforms: A `platforms` block as documented below, which specifies platforms included in and excluded from the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] service_principal_risk_levels: A list of service principal sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `none`, `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] sign_in_risk_levels: A list of user sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] user_risk_levels: A list of user risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        pulumi.set(__self__, "applications", applications)
        pulumi.set(__self__, "client_app_types", client_app_types)
        pulumi.set(__self__, "users", users)
        if client_applications is not None:
            pulumi.set(__self__, "client_applications", client_applications)
        if devices is not None:
            pulumi.set(__self__, "devices", devices)
        if insider_risk_levels is not None:
            pulumi.set(__self__, "insider_risk_levels", insider_risk_levels)
        if locations is not None:
            pulumi.set(__self__, "locations", locations)
        if platforms is not None:
            pulumi.set(__self__, "platforms", platforms)
        if service_principal_risk_levels is not None:
            pulumi.set(__self__, "service_principal_risk_levels", service_principal_risk_levels)
        if sign_in_risk_levels is not None:
            pulumi.set(__self__, "sign_in_risk_levels", sign_in_risk_levels)
        if user_risk_levels is not None:
            pulumi.set(__self__, "user_risk_levels", user_risk_levels)

    @property
    @pulumi.getter
    def applications(self) -> pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs']:
        """
        An `applications` block as documented below, which specifies applications and user actions included in and excluded from the policy.
        """
        return pulumi.get(self, "applications")

    @applications.setter
    def applications(self, value: pulumi.Input['ConditionalAccessPolicyConditionsApplicationsArgs']):
        pulumi.set(self, "applications", value)

    @property
    @pulumi.getter(name="clientAppTypes")
    def client_app_types(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of client application types included in the policy. Possible values are: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported` and `other`.
        """
        return pulumi.get(self, "client_app_types")

    @client_app_types.setter
    def client_app_types(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "client_app_types", value)

    @property
    @pulumi.getter
    def users(self) -> pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs']:
        """
        A `users` block as documented below, which specifies users, groups, and roles included in and excluded from the policy.
        """
        return pulumi.get(self, "users")

    @users.setter
    def users(self, value: pulumi.Input['ConditionalAccessPolicyConditionsUsersArgs']):
        pulumi.set(self, "users", value)

    @property
    @pulumi.getter(name="clientApplications")
    def client_applications(self) -> Optional[pulumi.Input['ConditionalAccessPolicyConditionsClientApplicationsArgs']]:
        """
        An `client_applications` block as documented below, which specifies service principals included in and excluded from the policy.
        """
        return pulumi.get(self, "client_applications")

    @client_applications.setter
    def client_applications(self, value: Optional[pulumi.Input['ConditionalAccessPolicyConditionsClientApplicationsArgs']]):
        pulumi.set(self, "client_applications", value)

    @property
    @pulumi.getter
    def devices(self) -> Optional[pulumi.Input['ConditionalAccessPolicyConditionsDevicesArgs']]:
        """
        A `devices` block as documented below, which describes devices to be included in and excluded from the policy. A `devices` block can be added to an existing policy, but removing the `devices` block forces a new resource to be created.
        """
        return pulumi.get(self, "devices")

    @devices.setter
    def devices(self, value: Optional[pulumi.Input['ConditionalAccessPolicyConditionsDevicesArgs']]):
        pulumi.set(self, "devices", value)

    @property
    @pulumi.getter(name="insiderRiskLevels")
    def insider_risk_levels(self) -> Optional[pulumi.Input[str]]:
        """
        The insider risk level in the policy. Possible values are: `minor`, `moderate`, `elevated`, `unknownFutureValue`.
        """
        return pulumi.get(self, "insider_risk_levels")

    @insider_risk_levels.setter
    def insider_risk_levels(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "insider_risk_levels", value)

    @property
    @pulumi.getter
    def locations(self) -> Optional[pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs']]:
        """
        A `locations` block as documented below, which specifies locations included in and excluded from the policy.
        """
        return pulumi.get(self, "locations")

    @locations.setter
    def locations(self, value: Optional[pulumi.Input['ConditionalAccessPolicyConditionsLocationsArgs']]):
        pulumi.set(self, "locations", value)

    @property
    @pulumi.getter
    def platforms(self) -> Optional[pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs']]:
        """
        A `platforms` block as documented below, which specifies platforms included in and excluded from the policy.
        """
        return pulumi.get(self, "platforms")

    @platforms.setter
    def platforms(self, value: Optional[pulumi.Input['ConditionalAccessPolicyConditionsPlatformsArgs']]):
        pulumi.set(self, "platforms", value)

    @property
    @pulumi.getter(name="servicePrincipalRiskLevels")
    def service_principal_risk_levels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of service principal sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `none`, `unknownFutureValue`.
        """
        return pulumi.get(self, "service_principal_risk_levels")

    @service_principal_risk_levels.setter
    def service_principal_risk_levels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "service_principal_risk_levels", value)

    @property
    @pulumi.getter(name="signInRiskLevels")
    def sign_in_risk_levels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user sign-in risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        return pulumi.get(self, "sign_in_risk_levels")

    @sign_in_risk_levels.setter
    def sign_in_risk_levels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "sign_in_risk_levels", value)

    @property
    @pulumi.getter(name="userRiskLevels")
    def user_risk_levels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user risk levels included in the policy. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
        """
        return pulumi.get(self, "user_risk_levels")

    @user_risk_levels.setter
    def user_risk_levels(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "user_risk_levels", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsApplicationsArgsDict(TypedDict):
        excluded_applications: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of application IDs explicitly excluded from the policy. Can also be set to `Office365`.
        """
        included_applications: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of application IDs the policy applies to, unless explicitly excluded (in `excluded_applications`). Can also be set to `All`, `None` or `Office365`. Cannot be specified with `included_user_actions`. One of `included_applications` or `included_user_actions` must be specified.
        """
        included_user_actions: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of user actions to include. Supported values are `urn:user:registerdevice` and `urn:user:registersecurityinfo`. Cannot be specified with `included_applications`. One of `included_applications` or `included_user_actions` must be specified.
        """
elif False:
    ConditionalAccessPolicyConditionsApplicationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsApplicationsArgs:
    def __init__(__self__, *,
                 excluded_applications: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_applications: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_user_actions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_applications: A list of application IDs explicitly excluded from the policy. Can also be set to `Office365`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_applications: A list of application IDs the policy applies to, unless explicitly excluded (in `excluded_applications`). Can also be set to `All`, `None` or `Office365`. Cannot be specified with `included_user_actions`. One of `included_applications` or `included_user_actions` must be specified.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_user_actions: A list of user actions to include. Supported values are `urn:user:registerdevice` and `urn:user:registersecurityinfo`. Cannot be specified with `included_applications`. One of `included_applications` or `included_user_actions` must be specified.
        """
        if excluded_applications is not None:
            pulumi.set(__self__, "excluded_applications", excluded_applications)
        if included_applications is not None:
            pulumi.set(__self__, "included_applications", included_applications)
        if included_user_actions is not None:
            pulumi.set(__self__, "included_user_actions", included_user_actions)

    @property
    @pulumi.getter(name="excludedApplications")
    def excluded_applications(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of application IDs explicitly excluded from the policy. Can also be set to `Office365`.
        """
        return pulumi.get(self, "excluded_applications")

    @excluded_applications.setter
    def excluded_applications(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_applications", value)

    @property
    @pulumi.getter(name="includedApplications")
    def included_applications(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of application IDs the policy applies to, unless explicitly excluded (in `excluded_applications`). Can also be set to `All`, `None` or `Office365`. Cannot be specified with `included_user_actions`. One of `included_applications` or `included_user_actions` must be specified.
        """
        return pulumi.get(self, "included_applications")

    @included_applications.setter
    def included_applications(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_applications", value)

    @property
    @pulumi.getter(name="includedUserActions")
    def included_user_actions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user actions to include. Supported values are `urn:user:registerdevice` and `urn:user:registersecurityinfo`. Cannot be specified with `included_applications`. One of `included_applications` or `included_user_actions` must be specified.
        """
        return pulumi.get(self, "included_user_actions")

    @included_user_actions.setter
    def included_user_actions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_user_actions", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsClientApplicationsArgsDict(TypedDict):
        excluded_service_principals: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of service principal IDs explicitly excluded in the policy.
        """
        included_service_principals: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of service principal IDs explicitly included in the policy. Can be set to `ServicePrincipalsInMyTenant` to include all service principals. This is mandatory value when at least one `excluded_service_principals` is set.
        """
elif False:
    ConditionalAccessPolicyConditionsClientApplicationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsClientApplicationsArgs:
    def __init__(__self__, *,
                 excluded_service_principals: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_service_principals: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_service_principals: A list of service principal IDs explicitly excluded in the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_service_principals: A list of service principal IDs explicitly included in the policy. Can be set to `ServicePrincipalsInMyTenant` to include all service principals. This is mandatory value when at least one `excluded_service_principals` is set.
        """
        if excluded_service_principals is not None:
            pulumi.set(__self__, "excluded_service_principals", excluded_service_principals)
        if included_service_principals is not None:
            pulumi.set(__self__, "included_service_principals", included_service_principals)

    @property
    @pulumi.getter(name="excludedServicePrincipals")
    def excluded_service_principals(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of service principal IDs explicitly excluded in the policy.
        """
        return pulumi.get(self, "excluded_service_principals")

    @excluded_service_principals.setter
    def excluded_service_principals(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_service_principals", value)

    @property
    @pulumi.getter(name="includedServicePrincipals")
    def included_service_principals(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of service principal IDs explicitly included in the policy. Can be set to `ServicePrincipalsInMyTenant` to include all service principals. This is mandatory value when at least one `excluded_service_principals` is set.
        """
        return pulumi.get(self, "included_service_principals")

    @included_service_principals.setter
    def included_service_principals(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_service_principals", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsDevicesArgsDict(TypedDict):
        filter: NotRequired[pulumi.Input['ConditionalAccessPolicyConditionsDevicesFilterArgsDict']]
        """
        A `filter` block as described below.
        """
elif False:
    ConditionalAccessPolicyConditionsDevicesArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsDevicesArgs:
    def __init__(__self__, *,
                 filter: Optional[pulumi.Input['ConditionalAccessPolicyConditionsDevicesFilterArgs']] = None):
        """
        :param pulumi.Input['ConditionalAccessPolicyConditionsDevicesFilterArgs'] filter: A `filter` block as described below.
        """
        if filter is not None:
            pulumi.set(__self__, "filter", filter)

    @property
    @pulumi.getter
    def filter(self) -> Optional[pulumi.Input['ConditionalAccessPolicyConditionsDevicesFilterArgs']]:
        """
        A `filter` block as described below.
        """
        return pulumi.get(self, "filter")

    @filter.setter
    def filter(self, value: Optional[pulumi.Input['ConditionalAccessPolicyConditionsDevicesFilterArgs']]):
        pulumi.set(self, "filter", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsDevicesFilterArgsDict(TypedDict):
        mode: pulumi.Input[str]
        """
        Whether to include in, or exclude from, matching devices from the policy. Supported values are `include` or `exclude`.
        """
        rule: pulumi.Input[str]
        """
        Condition filter to match devices. For more information, see [official documentation](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters-for-devices#supported-operators-and-device-properties-for-filters).
        """
elif False:
    ConditionalAccessPolicyConditionsDevicesFilterArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsDevicesFilterArgs:
    def __init__(__self__, *,
                 mode: pulumi.Input[str],
                 rule: pulumi.Input[str]):
        """
        :param pulumi.Input[str] mode: Whether to include in, or exclude from, matching devices from the policy. Supported values are `include` or `exclude`.
        :param pulumi.Input[str] rule: Condition filter to match devices. For more information, see [official documentation](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters-for-devices#supported-operators-and-device-properties-for-filters).
        """
        pulumi.set(__self__, "mode", mode)
        pulumi.set(__self__, "rule", rule)

    @property
    @pulumi.getter
    def mode(self) -> pulumi.Input[str]:
        """
        Whether to include in, or exclude from, matching devices from the policy. Supported values are `include` or `exclude`.
        """
        return pulumi.get(self, "mode")

    @mode.setter
    def mode(self, value: pulumi.Input[str]):
        pulumi.set(self, "mode", value)

    @property
    @pulumi.getter
    def rule(self) -> pulumi.Input[str]:
        """
        Condition filter to match devices. For more information, see [official documentation](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-condition-filters-for-devices#supported-operators-and-device-properties-for-filters).
        """
        return pulumi.get(self, "rule")

    @rule.setter
    def rule(self, value: pulumi.Input[str]):
        pulumi.set(self, "rule", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsLocationsArgsDict(TypedDict):
        included_locations: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A list of location IDs in scope of policy unless explicitly excluded. Can also be set to `All`, or `AllTrusted`.
        """
        excluded_locations: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of location IDs excluded from scope of policy. Can also be set to `AllTrusted`.
        """
elif False:
    ConditionalAccessPolicyConditionsLocationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsLocationsArgs:
    def __init__(__self__, *,
                 included_locations: pulumi.Input[Sequence[pulumi.Input[str]]],
                 excluded_locations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_locations: A list of location IDs in scope of policy unless explicitly excluded. Can also be set to `All`, or `AllTrusted`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_locations: A list of location IDs excluded from scope of policy. Can also be set to `AllTrusted`.
        """
        pulumi.set(__self__, "included_locations", included_locations)
        if excluded_locations is not None:
            pulumi.set(__self__, "excluded_locations", excluded_locations)

    @property
    @pulumi.getter(name="includedLocations")
    def included_locations(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of location IDs in scope of policy unless explicitly excluded. Can also be set to `All`, or `AllTrusted`.
        """
        return pulumi.get(self, "included_locations")

    @included_locations.setter
    def included_locations(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "included_locations", value)

    @property
    @pulumi.getter(name="excludedLocations")
    def excluded_locations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of location IDs excluded from scope of policy. Can also be set to `AllTrusted`.
        """
        return pulumi.get(self, "excluded_locations")

    @excluded_locations.setter
    def excluded_locations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_locations", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsPlatformsArgsDict(TypedDict):
        included_platforms: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A list of platforms the policy applies to, unless explicitly excluded. Possible values are: `all`, `android`, `iOS`, `linux`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        excluded_platforms: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of platforms explicitly excluded from the policy. Possible values are: `all`, `android`, `iOS`, `linux`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
elif False:
    ConditionalAccessPolicyConditionsPlatformsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsPlatformsArgs:
    def __init__(__self__, *,
                 included_platforms: pulumi.Input[Sequence[pulumi.Input[str]]],
                 excluded_platforms: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_platforms: A list of platforms the policy applies to, unless explicitly excluded. Possible values are: `all`, `android`, `iOS`, `linux`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_platforms: A list of platforms explicitly excluded from the policy. Possible values are: `all`, `android`, `iOS`, `linux`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        pulumi.set(__self__, "included_platforms", included_platforms)
        if excluded_platforms is not None:
            pulumi.set(__self__, "excluded_platforms", excluded_platforms)

    @property
    @pulumi.getter(name="includedPlatforms")
    def included_platforms(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of platforms the policy applies to, unless explicitly excluded. Possible values are: `all`, `android`, `iOS`, `linux`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        return pulumi.get(self, "included_platforms")

    @included_platforms.setter
    def included_platforms(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "included_platforms", value)

    @property
    @pulumi.getter(name="excludedPlatforms")
    def excluded_platforms(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of platforms explicitly excluded from the policy. Possible values are: `all`, `android`, `iOS`, `linux`, `macOS`, `windows`, `windowsPhone` or `unknownFutureValue`.
        """
        return pulumi.get(self, "excluded_platforms")

    @excluded_platforms.setter
    def excluded_platforms(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_platforms", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsUsersArgsDict(TypedDict):
        excluded_groups: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of group IDs excluded from scope of policy.
        """
        excluded_guests_or_external_users: NotRequired[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgsDict']]]]
        """
        A `guests_or_external_users` block as documented below, which specifies internal guests and external users excluded from scope of policy.
        """
        excluded_roles: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of role IDs excluded from scope of policy.
        """
        excluded_users: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of user IDs excluded from scope of policy and/or `GuestsOrExternalUsers`.
        """
        included_groups: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of group IDs in scope of policy unless explicitly excluded.
        """
        included_guests_or_external_users: NotRequired[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgsDict']]]]
        """
        A `guests_or_external_users` block as documented below, which specifies internal guests and external users in scope of policy.
        """
        included_roles: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of role IDs in scope of policy unless explicitly excluded.
        """
        included_users: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list of user IDs in scope of policy unless explicitly excluded, or `None` or `All` or `GuestsOrExternalUsers`.

        > At least one of `included_groups`, `included_guests_or_external_users`, `included_roles` or `included_users` must be specified.
        """
elif False:
    ConditionalAccessPolicyConditionsUsersArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsUsersArgs:
    def __init__(__self__, *,
                 excluded_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 excluded_guests_or_external_users: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgs']]]] = None,
                 excluded_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 excluded_users: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_guests_or_external_users: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgs']]]] = None,
                 included_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 included_users: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_groups: A list of group IDs excluded from scope of policy.
        :param pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgs']]] excluded_guests_or_external_users: A `guests_or_external_users` block as documented below, which specifies internal guests and external users excluded from scope of policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_roles: A list of role IDs excluded from scope of policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] excluded_users: A list of user IDs excluded from scope of policy and/or `GuestsOrExternalUsers`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_groups: A list of group IDs in scope of policy unless explicitly excluded.
        :param pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgs']]] included_guests_or_external_users: A `guests_or_external_users` block as documented below, which specifies internal guests and external users in scope of policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_roles: A list of role IDs in scope of policy unless explicitly excluded.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] included_users: A list of user IDs in scope of policy unless explicitly excluded, or `None` or `All` or `GuestsOrExternalUsers`.
               
               > At least one of `included_groups`, `included_guests_or_external_users`, `included_roles` or `included_users` must be specified.
        """
        if excluded_groups is not None:
            pulumi.set(__self__, "excluded_groups", excluded_groups)
        if excluded_guests_or_external_users is not None:
            pulumi.set(__self__, "excluded_guests_or_external_users", excluded_guests_or_external_users)
        if excluded_roles is not None:
            pulumi.set(__self__, "excluded_roles", excluded_roles)
        if excluded_users is not None:
            pulumi.set(__self__, "excluded_users", excluded_users)
        if included_groups is not None:
            pulumi.set(__self__, "included_groups", included_groups)
        if included_guests_or_external_users is not None:
            pulumi.set(__self__, "included_guests_or_external_users", included_guests_or_external_users)
        if included_roles is not None:
            pulumi.set(__self__, "included_roles", included_roles)
        if included_users is not None:
            pulumi.set(__self__, "included_users", included_users)

    @property
    @pulumi.getter(name="excludedGroups")
    def excluded_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of group IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_groups")

    @excluded_groups.setter
    def excluded_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_groups", value)

    @property
    @pulumi.getter(name="excludedGuestsOrExternalUsers")
    def excluded_guests_or_external_users(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgs']]]]:
        """
        A `guests_or_external_users` block as documented below, which specifies internal guests and external users excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_guests_or_external_users")

    @excluded_guests_or_external_users.setter
    def excluded_guests_or_external_users(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgs']]]]):
        pulumi.set(self, "excluded_guests_or_external_users", value)

    @property
    @pulumi.getter(name="excludedRoles")
    def excluded_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of role IDs excluded from scope of policy.
        """
        return pulumi.get(self, "excluded_roles")

    @excluded_roles.setter
    def excluded_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_roles", value)

    @property
    @pulumi.getter(name="excludedUsers")
    def excluded_users(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user IDs excluded from scope of policy and/or `GuestsOrExternalUsers`.
        """
        return pulumi.get(self, "excluded_users")

    @excluded_users.setter
    def excluded_users(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "excluded_users", value)

    @property
    @pulumi.getter(name="includedGroups")
    def included_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of group IDs in scope of policy unless explicitly excluded.
        """
        return pulumi.get(self, "included_groups")

    @included_groups.setter
    def included_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_groups", value)

    @property
    @pulumi.getter(name="includedGuestsOrExternalUsers")
    def included_guests_or_external_users(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgs']]]]:
        """
        A `guests_or_external_users` block as documented below, which specifies internal guests and external users in scope of policy.
        """
        return pulumi.get(self, "included_guests_or_external_users")

    @included_guests_or_external_users.setter
    def included_guests_or_external_users(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgs']]]]):
        pulumi.set(self, "included_guests_or_external_users", value)

    @property
    @pulumi.getter(name="includedRoles")
    def included_roles(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of role IDs in scope of policy unless explicitly excluded.
        """
        return pulumi.get(self, "included_roles")

    @included_roles.setter
    def included_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_roles", value)

    @property
    @pulumi.getter(name="includedUsers")
    def included_users(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of user IDs in scope of policy unless explicitly excluded, or `None` or `All` or `GuestsOrExternalUsers`.

        > At least one of `included_groups`, `included_guests_or_external_users`, `included_roles` or `included_users` must be specified.
        """
        return pulumi.get(self, "included_users")

    @included_users.setter
    def included_users(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "included_users", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgsDict(TypedDict):
        guest_or_external_user_types: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A list of guest or external user types. Possible values are: `b2bCollaborationGuest`, `b2bCollaborationMember`, `b2bDirectConnectUser`, `internalGuest`, `none`, `otherExternalUser`, `serviceProvider`, `unknownFutureValue`.
        """
        external_tenants: NotRequired[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgsDict']]]]
        """
        An `external_tenants` block as documented below, which specifies external tenants in a policy scope.
        """
elif False:
    ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserArgs:
    def __init__(__self__, *,
                 guest_or_external_user_types: pulumi.Input[Sequence[pulumi.Input[str]]],
                 external_tenants: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgs']]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] guest_or_external_user_types: A list of guest or external user types. Possible values are: `b2bCollaborationGuest`, `b2bCollaborationMember`, `b2bDirectConnectUser`, `internalGuest`, `none`, `otherExternalUser`, `serviceProvider`, `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgs']]] external_tenants: An `external_tenants` block as documented below, which specifies external tenants in a policy scope.
        """
        pulumi.set(__self__, "guest_or_external_user_types", guest_or_external_user_types)
        if external_tenants is not None:
            pulumi.set(__self__, "external_tenants", external_tenants)

    @property
    @pulumi.getter(name="guestOrExternalUserTypes")
    def guest_or_external_user_types(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of guest or external user types. Possible values are: `b2bCollaborationGuest`, `b2bCollaborationMember`, `b2bDirectConnectUser`, `internalGuest`, `none`, `otherExternalUser`, `serviceProvider`, `unknownFutureValue`.
        """
        return pulumi.get(self, "guest_or_external_user_types")

    @guest_or_external_user_types.setter
    def guest_or_external_user_types(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "guest_or_external_user_types", value)

    @property
    @pulumi.getter(name="externalTenants")
    def external_tenants(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgs']]]]:
        """
        An `external_tenants` block as documented below, which specifies external tenants in a policy scope.
        """
        return pulumi.get(self, "external_tenants")

    @external_tenants.setter
    def external_tenants(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgs']]]]):
        pulumi.set(self, "external_tenants", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgsDict(TypedDict):
        membership_kind: pulumi.Input[str]
        """
        The external tenant membership kind. Possible values are: `all`, `enumerated`, `unknownFutureValue`.
        """
        members: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list tenant IDs. Can only be specified if `membership_kind` is `enumerated`.
        """
elif False:
    ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsUsersExcludedGuestsOrExternalUserExternalTenantArgs:
    def __init__(__self__, *,
                 membership_kind: pulumi.Input[str],
                 members: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] membership_kind: The external tenant membership kind. Possible values are: `all`, `enumerated`, `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] members: A list tenant IDs. Can only be specified if `membership_kind` is `enumerated`.
        """
        pulumi.set(__self__, "membership_kind", membership_kind)
        if members is not None:
            pulumi.set(__self__, "members", members)

    @property
    @pulumi.getter(name="membershipKind")
    def membership_kind(self) -> pulumi.Input[str]:
        """
        The external tenant membership kind. Possible values are: `all`, `enumerated`, `unknownFutureValue`.
        """
        return pulumi.get(self, "membership_kind")

    @membership_kind.setter
    def membership_kind(self, value: pulumi.Input[str]):
        pulumi.set(self, "membership_kind", value)

    @property
    @pulumi.getter
    def members(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list tenant IDs. Can only be specified if `membership_kind` is `enumerated`.
        """
        return pulumi.get(self, "members")

    @members.setter
    def members(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "members", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgsDict(TypedDict):
        guest_or_external_user_types: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A list of guest or external user types. Possible values are: `b2bCollaborationGuest`, `b2bCollaborationMember`, `b2bDirectConnectUser`, `internalGuest`, `none`, `otherExternalUser`, `serviceProvider`, `unknownFutureValue`.
        """
        external_tenants: NotRequired[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgsDict']]]]
        """
        An `external_tenants` block as documented below, which specifies external tenants in a policy scope.
        """
elif False:
    ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserArgs:
    def __init__(__self__, *,
                 guest_or_external_user_types: pulumi.Input[Sequence[pulumi.Input[str]]],
                 external_tenants: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgs']]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] guest_or_external_user_types: A list of guest or external user types. Possible values are: `b2bCollaborationGuest`, `b2bCollaborationMember`, `b2bDirectConnectUser`, `internalGuest`, `none`, `otherExternalUser`, `serviceProvider`, `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgs']]] external_tenants: An `external_tenants` block as documented below, which specifies external tenants in a policy scope.
        """
        pulumi.set(__self__, "guest_or_external_user_types", guest_or_external_user_types)
        if external_tenants is not None:
            pulumi.set(__self__, "external_tenants", external_tenants)

    @property
    @pulumi.getter(name="guestOrExternalUserTypes")
    def guest_or_external_user_types(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A list of guest or external user types. Possible values are: `b2bCollaborationGuest`, `b2bCollaborationMember`, `b2bDirectConnectUser`, `internalGuest`, `none`, `otherExternalUser`, `serviceProvider`, `unknownFutureValue`.
        """
        return pulumi.get(self, "guest_or_external_user_types")

    @guest_or_external_user_types.setter
    def guest_or_external_user_types(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "guest_or_external_user_types", value)

    @property
    @pulumi.getter(name="externalTenants")
    def external_tenants(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgs']]]]:
        """
        An `external_tenants` block as documented below, which specifies external tenants in a policy scope.
        """
        return pulumi.get(self, "external_tenants")

    @external_tenants.setter
    def external_tenants(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgs']]]]):
        pulumi.set(self, "external_tenants", value)


if not MYPY:
    class ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgsDict(TypedDict):
        membership_kind: pulumi.Input[str]
        """
        The external tenant membership kind. Possible values are: `all`, `enumerated`, `unknownFutureValue`.
        """
        members: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        A list tenant IDs. Can only be specified if `membership_kind` is `enumerated`.
        """
elif False:
    ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyConditionsUsersIncludedGuestsOrExternalUserExternalTenantArgs:
    def __init__(__self__, *,
                 membership_kind: pulumi.Input[str],
                 members: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] membership_kind: The external tenant membership kind. Possible values are: `all`, `enumerated`, `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] members: A list tenant IDs. Can only be specified if `membership_kind` is `enumerated`.
        """
        pulumi.set(__self__, "membership_kind", membership_kind)
        if members is not None:
            pulumi.set(__self__, "members", members)

    @property
    @pulumi.getter(name="membershipKind")
    def membership_kind(self) -> pulumi.Input[str]:
        """
        The external tenant membership kind. Possible values are: `all`, `enumerated`, `unknownFutureValue`.
        """
        return pulumi.get(self, "membership_kind")

    @membership_kind.setter
    def membership_kind(self, value: pulumi.Input[str]):
        pulumi.set(self, "membership_kind", value)

    @property
    @pulumi.getter
    def members(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list tenant IDs. Can only be specified if `membership_kind` is `enumerated`.
        """
        return pulumi.get(self, "members")

    @members.setter
    def members(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "members", value)


if not MYPY:
    class ConditionalAccessPolicyGrantControlsArgsDict(TypedDict):
        operator: pulumi.Input[str]
        """
        Defines the relationship of the grant controls. Possible values are: `AND`, `OR`.
        """
        authentication_strength_policy_id: NotRequired[pulumi.Input[str]]
        """
        ID of an Authentication Strength Policy to use in this policy. When using a hard-coded ID, the UUID value should be prefixed with: `/policies/authenticationStrengthPolicies/`.
        """
        built_in_controls: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        List of built-in controls required by the policy. Possible values are: `block`, `mfa`, `approvedApplication`, `compliantApplication`, `compliantDevice`, `domainJoinedDevice`, `passwordChange` or `unknownFutureValue`.
        """
        custom_authentication_factors: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        List of custom controls IDs required by the policy.
        """
        terms_of_uses: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        List of terms of use IDs required by the policy.

        > At least one of `authentication_strength_policy_id`, `built_in_controls` or `terms_of_use` must be specified.
        """
elif False:
    ConditionalAccessPolicyGrantControlsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicyGrantControlsArgs:
    def __init__(__self__, *,
                 operator: pulumi.Input[str],
                 authentication_strength_policy_id: Optional[pulumi.Input[str]] = None,
                 built_in_controls: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 custom_authentication_factors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 terms_of_uses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] operator: Defines the relationship of the grant controls. Possible values are: `AND`, `OR`.
        :param pulumi.Input[str] authentication_strength_policy_id: ID of an Authentication Strength Policy to use in this policy. When using a hard-coded ID, the UUID value should be prefixed with: `/policies/authenticationStrengthPolicies/`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] built_in_controls: List of built-in controls required by the policy. Possible values are: `block`, `mfa`, `approvedApplication`, `compliantApplication`, `compliantDevice`, `domainJoinedDevice`, `passwordChange` or `unknownFutureValue`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_authentication_factors: List of custom controls IDs required by the policy.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] terms_of_uses: List of terms of use IDs required by the policy.
               
               > At least one of `authentication_strength_policy_id`, `built_in_controls` or `terms_of_use` must be specified.
        """
        pulumi.set(__self__, "operator", operator)
        if authentication_strength_policy_id is not None:
            pulumi.set(__self__, "authentication_strength_policy_id", authentication_strength_policy_id)
        if built_in_controls is not None:
            pulumi.set(__self__, "built_in_controls", built_in_controls)
        if custom_authentication_factors is not None:
            pulumi.set(__self__, "custom_authentication_factors", custom_authentication_factors)
        if terms_of_uses is not None:
            pulumi.set(__self__, "terms_of_uses", terms_of_uses)

    @property
    @pulumi.getter
    def operator(self) -> pulumi.Input[str]:
        """
        Defines the relationship of the grant controls. Possible values are: `AND`, `OR`.
        """
        return pulumi.get(self, "operator")

    @operator.setter
    def operator(self, value: pulumi.Input[str]):
        pulumi.set(self, "operator", value)

    @property
    @pulumi.getter(name="authenticationStrengthPolicyId")
    def authentication_strength_policy_id(self) -> Optional[pulumi.Input[str]]:
        """
        ID of an Authentication Strength Policy to use in this policy. When using a hard-coded ID, the UUID value should be prefixed with: `/policies/authenticationStrengthPolicies/`.
        """
        return pulumi.get(self, "authentication_strength_policy_id")

    @authentication_strength_policy_id.setter
    def authentication_strength_policy_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "authentication_strength_policy_id", value)

    @property
    @pulumi.getter(name="builtInControls")
    def built_in_controls(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of built-in controls required by the policy. Possible values are: `block`, `mfa`, `approvedApplication`, `compliantApplication`, `compliantDevice`, `domainJoinedDevice`, `passwordChange` or `unknownFutureValue`.
        """
        return pulumi.get(self, "built_in_controls")

    @built_in_controls.setter
    def built_in_controls(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "built_in_controls", value)

    @property
    @pulumi.getter(name="customAuthenticationFactors")
    def custom_authentication_factors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of custom controls IDs required by the policy.
        """
        return pulumi.get(self, "custom_authentication_factors")

    @custom_authentication_factors.setter
    def custom_authentication_factors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "custom_authentication_factors", value)

    @property
    @pulumi.getter(name="termsOfUses")
    def terms_of_uses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of terms of use IDs required by the policy.

        > At least one of `authentication_strength_policy_id`, `built_in_controls` or `terms_of_use` must be specified.
        """
        return pulumi.get(self, "terms_of_uses")

    @terms_of_uses.setter
    def terms_of_uses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "terms_of_uses", value)


if not MYPY:
    class ConditionalAccessPolicySessionControlsArgsDict(TypedDict):
        application_enforced_restrictions_enabled: NotRequired[pulumi.Input[bool]]
        """
        Whether application enforced restrictions are enabled. Defaults to `false`.

        > Only Office 365, Exchange Online and Sharepoint Online support application enforced restrictions.
        """
        cloud_app_security_policy: NotRequired[pulumi.Input[str]]
        """
        Enables cloud app security and specifies the cloud app security policy to use. Possible values are: `blockDownloads`, `mcasConfigured`, `monitorOnly` or `unknownFutureValue`.
        """
        disable_resilience_defaults: NotRequired[pulumi.Input[bool]]
        """
        Disables [resilience defaults](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/resilience-defaults). Defaults to `false`.
        """
        persistent_browser_mode: NotRequired[pulumi.Input[str]]
        """
        Session control to define whether to persist cookies. Possible values are: `always` or `never`.
        """
        sign_in_frequency: NotRequired[pulumi.Input[int]]
        """
        Number of days or hours to enforce sign-in frequency. Required when `sign_in_frequency_period` is specified.
        """
        sign_in_frequency_authentication_type: NotRequired[pulumi.Input[str]]
        """
        Authentication type for enforcing sign-in frequency. Possible values are: `primaryAndSecondaryAuthentication` or `secondaryAuthentication`. Defaults to `primaryAndSecondaryAuthentication`.
        """
        sign_in_frequency_interval: NotRequired[pulumi.Input[str]]
        """
        The interval to apply to sign-in frequency control. Possible values are: `timeBased` or `everyTime`. Defaults to `timeBased`.
        """
        sign_in_frequency_period: NotRequired[pulumi.Input[str]]
        """
        The time period to enforce sign-in frequency. Possible values are: `hours` or `days`. Required when `sign_in_frequency_period` is specified.
        """
elif False:
    ConditionalAccessPolicySessionControlsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ConditionalAccessPolicySessionControlsArgs:
    def __init__(__self__, *,
                 application_enforced_restrictions_enabled: Optional[pulumi.Input[bool]] = None,
                 cloud_app_security_policy: Optional[pulumi.Input[str]] = None,
                 disable_resilience_defaults: Optional[pulumi.Input[bool]] = None,
                 persistent_browser_mode: Optional[pulumi.Input[str]] = None,
                 sign_in_frequency: Optional[pulumi.Input[int]] = None,
                 sign_in_frequency_authentication_type: Optional[pulumi.Input[str]] = None,
                 sign_in_frequency_interval: Optional[pulumi.Input[str]] = None,
                 sign_in_frequency_period: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[bool] application_enforced_restrictions_enabled: Whether application enforced restrictions are enabled. Defaults to `false`.
               
               > Only Office 365, Exchange Online and Sharepoint Online support application enforced restrictions.
        :param pulumi.Input[str] cloud_app_security_policy: Enables cloud app security and specifies the cloud app security policy to use. Possible values are: `blockDownloads`, `mcasConfigured`, `monitorOnly` or `unknownFutureValue`.
        :param pulumi.Input[bool] disable_resilience_defaults: Disables [resilience defaults](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/resilience-defaults). Defaults to `false`.
        :param pulumi.Input[str] persistent_browser_mode: Session control to define whether to persist cookies. Possible values are: `always` or `never`.
        :param pulumi.Input[int] sign_in_frequency: Number of days or hours to enforce sign-in frequency. Required when `sign_in_frequency_period` is specified.
        :param pulumi.Input[str] sign_in_frequency_authentication_type: Authentication type for enforcing sign-in frequency. Possible values are: `primaryAndSecondaryAuthentication` or `secondaryAuthentication`. Defaults to `primaryAndSecondaryAuthentication`.
        :param pulumi.Input[str] sign_in_frequency_interval: The interval to apply to sign-in frequency control. Possible values are: `timeBased` or `everyTime`. Defaults to `timeBased`.
        :param pulumi.Input[str] sign_in_frequency_period: The time period to enforce sign-in frequency. Possible values are: `hours` or `days`. Required when `sign_in_frequency_period` is specified.
        """
        if application_enforced_restrictions_enabled is not None:
            pulumi.set(__self__, "application_enforced_restrictions_enabled", application_enforced_restrictions_enabled)
        if cloud_app_security_policy is not None:
            pulumi.set(__self__, "cloud_app_security_policy", cloud_app_security_policy)
        if disable_resilience_defaults is not None:
            pulumi.set(__self__, "disable_resilience_defaults", disable_resilience_defaults)
        if persistent_browser_mode is not None:
            pulumi.set(__self__, "persistent_browser_mode", persistent_browser_mode)
        if sign_in_frequency is not None:
            pulumi.set(__self__, "sign_in_frequency", sign_in_frequency)
        if sign_in_frequency_authentication_type is not None:
            pulumi.set(__self__, "sign_in_frequency_authentication_type", sign_in_frequency_authentication_type)
        if sign_in_frequency_interval is not None:
            pulumi.set(__self__, "sign_in_frequency_interval", sign_in_frequency_interval)
        if sign_in_frequency_period is not None:
            pulumi.set(__self__, "sign_in_frequency_period", sign_in_frequency_period)

    @property
    @pulumi.getter(name="applicationEnforcedRestrictionsEnabled")
    def application_enforced_restrictions_enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether application enforced restrictions are enabled. Defaults to `false`.

        > Only Office 365, Exchange Online and Sharepoint Online support application enforced restrictions.
        """
        return pulumi.get(self, "application_enforced_restrictions_enabled")

    @application_enforced_restrictions_enabled.setter
    def application_enforced_restrictions_enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "application_enforced_restrictions_enabled", value)

    @property
    @pulumi.getter(name="cloudAppSecurityPolicy")
    def cloud_app_security_policy(self) -> Optional[pulumi.Input[str]]:
        """
        Enables cloud app security and specifies the cloud app security policy to use. Possible values are: `blockDownloads`, `mcasConfigured`, `monitorOnly` or `unknownFutureValue`.
        """
        return pulumi.get(self, "cloud_app_security_policy")

    @cloud_app_security_policy.setter
    def cloud_app_security_policy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "cloud_app_security_policy", value)

    @property
    @pulumi.getter(name="disableResilienceDefaults")
    def disable_resilience_defaults(self) -> Optional[pulumi.Input[bool]]:
        """
        Disables [resilience defaults](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/resilience-defaults). Defaults to `false`.
        """
        return pulumi.get(self, "disable_resilience_defaults")

    @disable_resilience_defaults.setter
    def disable_resilience_defaults(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "disable_resilience_defaults", value)

    @property
    @pulumi.getter(name="persistentBrowserMode")
    def persistent_browser_mode(self) -> Optional[pulumi.Input[str]]:
        """
        Session control to define whether to persist cookies. Possible values are: `always` or `never`.
        """
        return pulumi.get(self, "persistent_browser_mode")

    @persistent_browser_mode.setter
    def persistent_browser_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "persistent_browser_mode", value)

    @property
    @pulumi.getter(name="signInFrequency")
    def sign_in_frequency(self) -> Optional[pulumi.Input[int]]:
        """
        Number of days or hours to enforce sign-in frequency. Required when `sign_in_frequency_period` is specified.
        """
        return pulumi.get(self, "sign_in_frequency")

    @sign_in_frequency.setter
    def sign_in_frequency(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "sign_in_frequency", value)

    @property
    @pulumi.getter(name="signInFrequencyAuthenticationType")
    def sign_in_frequency_authentication_type(self) -> Optional[pulumi.Input[str]]:
        """
        Authentication type for enforcing sign-in frequency. Possible values are: `primaryAndSecondaryAuthentication` or `secondaryAuthentication`. Defaults to `primaryAndSecondaryAuthentication`.
        """
        return pulumi.get(self, "sign_in_frequency_authentication_type")

    @sign_in_frequency_authentication_type.setter
    def sign_in_frequency_authentication_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "sign_in_frequency_authentication_type", value)

    @property
    @pulumi.getter(name="signInFrequencyInterval")
    def sign_in_frequency_interval(self) -> Optional[pulumi.Input[str]]:
        """
        The interval to apply to sign-in frequency control. Possible values are: `timeBased` or `everyTime`. Defaults to `timeBased`.
        """
        return pulumi.get(self, "sign_in_frequency_interval")

    @sign_in_frequency_interval.setter
    def sign_in_frequency_interval(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "sign_in_frequency_interval", value)

    @property
    @pulumi.getter(name="signInFrequencyPeriod")
    def sign_in_frequency_period(self) -> Optional[pulumi.Input[str]]:
        """
        The time period to enforce sign-in frequency. Possible values are: `hours` or `days`. Required when `sign_in_frequency_period` is specified.
        """
        return pulumi.get(self, "sign_in_frequency_period")

    @sign_in_frequency_period.setter
    def sign_in_frequency_period(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "sign_in_frequency_period", value)


if not MYPY:
    class CustomDirectoryRolePermissionArgsDict(TypedDict):
        allowed_resource_actions: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        A set of tasks that can be performed on a resource. For more information, see the [Permissions Reference](https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference) documentation.
        """
elif False:
    CustomDirectoryRolePermissionArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class CustomDirectoryRolePermissionArgs:
    def __init__(__self__, *,
                 allowed_resource_actions: pulumi.Input[Sequence[pulumi.Input[str]]]):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_resource_actions: A set of tasks that can be performed on a resource. For more information, see the [Permissions Reference](https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference) documentation.
        """
        pulumi.set(__self__, "allowed_resource_actions", allowed_resource_actions)

    @property
    @pulumi.getter(name="allowedResourceActions")
    def allowed_resource_actions(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        A set of tasks that can be performed on a resource. For more information, see the [Permissions Reference](https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference) documentation.
        """
        return pulumi.get(self, "allowed_resource_actions")

    @allowed_resource_actions.setter
    def allowed_resource_actions(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "allowed_resource_actions", value)


if not MYPY:
    class GroupDynamicMembershipArgsDict(TypedDict):
        enabled: pulumi.Input[bool]
        """
        Whether rule processing is "On" (true) or "Paused" (false).
        """
        rule: pulumi.Input[str]
        """
        The rule that determines membership of this group. For more information, see official documentation on [membership rules syntax](https://docs.microsoft.com/en-gb/azure/active-directory/enterprise-users/groups-dynamic-membership).

        > **Dynamic Group Memberships** Remember to include `DynamicMembership` in the set of `types` for the group when configuring a dynamic membership rule. Dynamic membership is a premium feature which requires an Azure Active Directory P1 or P2 license.
        """
elif False:
    GroupDynamicMembershipArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupDynamicMembershipArgs:
    def __init__(__self__, *,
                 enabled: pulumi.Input[bool],
                 rule: pulumi.Input[str]):
        """
        :param pulumi.Input[bool] enabled: Whether rule processing is "On" (true) or "Paused" (false).
        :param pulumi.Input[str] rule: The rule that determines membership of this group. For more information, see official documentation on [membership rules syntax](https://docs.microsoft.com/en-gb/azure/active-directory/enterprise-users/groups-dynamic-membership).
               
               > **Dynamic Group Memberships** Remember to include `DynamicMembership` in the set of `types` for the group when configuring a dynamic membership rule. Dynamic membership is a premium feature which requires an Azure Active Directory P1 or P2 license.
        """
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "rule", rule)

    @property
    @pulumi.getter
    def enabled(self) -> pulumi.Input[bool]:
        """
        Whether rule processing is "On" (true) or "Paused" (false).
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: pulumi.Input[bool]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def rule(self) -> pulumi.Input[str]:
        """
        The rule that determines membership of this group. For more information, see official documentation on [membership rules syntax](https://docs.microsoft.com/en-gb/azure/active-directory/enterprise-users/groups-dynamic-membership).

        > **Dynamic Group Memberships** Remember to include `DynamicMembership` in the set of `types` for the group when configuring a dynamic membership rule. Dynamic membership is a premium feature which requires an Azure Active Directory P1 or P2 license.
        """
        return pulumi.get(self, "rule")

    @rule.setter
    def rule(self, value: pulumi.Input[str]):
        pulumi.set(self, "rule", value)


if not MYPY:
    class GroupRoleManagementPolicyActivationRulesArgsDict(TypedDict):
        approval_stage: NotRequired[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStageArgsDict']]
        """
        An `approval_stage` block as defined below.
        """
        maximum_duration: NotRequired[pulumi.Input[str]]
        """
        The maximum length of time an activated role can be valid, in an ISO8601 Duration format (e.g. `PT8H`). Valid range is `PT30M` to `PT23H30M`, in 30 minute increments, or `PT1D`.
        """
        require_approval: NotRequired[pulumi.Input[bool]]
        """
        Is approval required for activation. If `true` an `approval_stage` block must be provided.
        """
        require_justification: NotRequired[pulumi.Input[bool]]
        """
        Is a justification required during activation of the role.
        """
        require_multifactor_authentication: NotRequired[pulumi.Input[bool]]
        """
        Is multi-factor authentication required to activate the role. Conflicts with `required_conditional_access_authentication_context`.
        """
        require_ticket_info: NotRequired[pulumi.Input[bool]]
        """
        Is ticket information requrired during activation of the role.
        """
        required_conditional_access_authentication_context: NotRequired[pulumi.Input[str]]
        """
        The Entra ID Conditional Access context that must be present for activation (e.g `c1`). Conflicts with `require_multifactor_authentication`.
        """
elif False:
    GroupRoleManagementPolicyActivationRulesArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyActivationRulesArgs:
    def __init__(__self__, *,
                 approval_stage: Optional[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStageArgs']] = None,
                 maximum_duration: Optional[pulumi.Input[str]] = None,
                 require_approval: Optional[pulumi.Input[bool]] = None,
                 require_justification: Optional[pulumi.Input[bool]] = None,
                 require_multifactor_authentication: Optional[pulumi.Input[bool]] = None,
                 require_ticket_info: Optional[pulumi.Input[bool]] = None,
                 required_conditional_access_authentication_context: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStageArgs'] approval_stage: An `approval_stage` block as defined below.
        :param pulumi.Input[str] maximum_duration: The maximum length of time an activated role can be valid, in an ISO8601 Duration format (e.g. `PT8H`). Valid range is `PT30M` to `PT23H30M`, in 30 minute increments, or `PT1D`.
        :param pulumi.Input[bool] require_approval: Is approval required for activation. If `true` an `approval_stage` block must be provided.
        :param pulumi.Input[bool] require_justification: Is a justification required during activation of the role.
        :param pulumi.Input[bool] require_multifactor_authentication: Is multi-factor authentication required to activate the role. Conflicts with `required_conditional_access_authentication_context`.
        :param pulumi.Input[bool] require_ticket_info: Is ticket information requrired during activation of the role.
        :param pulumi.Input[str] required_conditional_access_authentication_context: The Entra ID Conditional Access context that must be present for activation (e.g `c1`). Conflicts with `require_multifactor_authentication`.
        """
        if approval_stage is not None:
            pulumi.set(__self__, "approval_stage", approval_stage)
        if maximum_duration is not None:
            pulumi.set(__self__, "maximum_duration", maximum_duration)
        if require_approval is not None:
            pulumi.set(__self__, "require_approval", require_approval)
        if require_justification is not None:
            pulumi.set(__self__, "require_justification", require_justification)
        if require_multifactor_authentication is not None:
            pulumi.set(__self__, "require_multifactor_authentication", require_multifactor_authentication)
        if require_ticket_info is not None:
            pulumi.set(__self__, "require_ticket_info", require_ticket_info)
        if required_conditional_access_authentication_context is not None:
            pulumi.set(__self__, "required_conditional_access_authentication_context", required_conditional_access_authentication_context)

    @property
    @pulumi.getter(name="approvalStage")
    def approval_stage(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStageArgs']]:
        """
        An `approval_stage` block as defined below.
        """
        return pulumi.get(self, "approval_stage")

    @approval_stage.setter
    def approval_stage(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStageArgs']]):
        pulumi.set(self, "approval_stage", value)

    @property
    @pulumi.getter(name="maximumDuration")
    def maximum_duration(self) -> Optional[pulumi.Input[str]]:
        """
        The maximum length of time an activated role can be valid, in an ISO8601 Duration format (e.g. `PT8H`). Valid range is `PT30M` to `PT23H30M`, in 30 minute increments, or `PT1D`.
        """
        return pulumi.get(self, "maximum_duration")

    @maximum_duration.setter
    def maximum_duration(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "maximum_duration", value)

    @property
    @pulumi.getter(name="requireApproval")
    def require_approval(self) -> Optional[pulumi.Input[bool]]:
        """
        Is approval required for activation. If `true` an `approval_stage` block must be provided.
        """
        return pulumi.get(self, "require_approval")

    @require_approval.setter
    def require_approval(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "require_approval", value)

    @property
    @pulumi.getter(name="requireJustification")
    def require_justification(self) -> Optional[pulumi.Input[bool]]:
        """
        Is a justification required during activation of the role.
        """
        return pulumi.get(self, "require_justification")

    @require_justification.setter
    def require_justification(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "require_justification", value)

    @property
    @pulumi.getter(name="requireMultifactorAuthentication")
    def require_multifactor_authentication(self) -> Optional[pulumi.Input[bool]]:
        """
        Is multi-factor authentication required to activate the role. Conflicts with `required_conditional_access_authentication_context`.
        """
        return pulumi.get(self, "require_multifactor_authentication")

    @require_multifactor_authentication.setter
    def require_multifactor_authentication(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "require_multifactor_authentication", value)

    @property
    @pulumi.getter(name="requireTicketInfo")
    def require_ticket_info(self) -> Optional[pulumi.Input[bool]]:
        """
        Is ticket information requrired during activation of the role.
        """
        return pulumi.get(self, "require_ticket_info")

    @require_ticket_info.setter
    def require_ticket_info(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "require_ticket_info", value)

    @property
    @pulumi.getter(name="requiredConditionalAccessAuthenticationContext")
    def required_conditional_access_authentication_context(self) -> Optional[pulumi.Input[str]]:
        """
        The Entra ID Conditional Access context that must be present for activation (e.g `c1`). Conflicts with `require_multifactor_authentication`.
        """
        return pulumi.get(self, "required_conditional_access_authentication_context")

    @required_conditional_access_authentication_context.setter
    def required_conditional_access_authentication_context(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "required_conditional_access_authentication_context", value)


if not MYPY:
    class GroupRoleManagementPolicyActivationRulesApprovalStageArgsDict(TypedDict):
        primary_approvers: pulumi.Input[Sequence[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgsDict']]]
        """
        The IDs of the users or groups who can approve the activation
        """
elif False:
    GroupRoleManagementPolicyActivationRulesApprovalStageArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyActivationRulesApprovalStageArgs:
    def __init__(__self__, *,
                 primary_approvers: pulumi.Input[Sequence[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgs']]]):
        """
        :param pulumi.Input[Sequence[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgs']]] primary_approvers: The IDs of the users or groups who can approve the activation
        """
        pulumi.set(__self__, "primary_approvers", primary_approvers)

    @property
    @pulumi.getter(name="primaryApprovers")
    def primary_approvers(self) -> pulumi.Input[Sequence[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgs']]]:
        """
        The IDs of the users or groups who can approve the activation
        """
        return pulumi.get(self, "primary_approvers")

    @primary_approvers.setter
    def primary_approvers(self, value: pulumi.Input[Sequence[pulumi.Input['GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgs']]]):
        pulumi.set(self, "primary_approvers", value)


if not MYPY:
    class GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgsDict(TypedDict):
        object_id: pulumi.Input[str]
        """
        The ID of the object which will act as an approver.
        """
        type: NotRequired[pulumi.Input[str]]
        """
        The type of object acting as an approver. Possible options are `singleUser` and `groupMembers`.
        """
elif False:
    GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyActivationRulesApprovalStagePrimaryApproverArgs:
    def __init__(__self__, *,
                 object_id: pulumi.Input[str],
                 type: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] object_id: The ID of the object which will act as an approver.
        :param pulumi.Input[str] type: The type of object acting as an approver. Possible options are `singleUser` and `groupMembers`.
        """
        pulumi.set(__self__, "object_id", object_id)
        if type is not None:
            pulumi.set(__self__, "type", type)

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> pulumi.Input[str]:
        """
        The ID of the object which will act as an approver.
        """
        return pulumi.get(self, "object_id")

    @object_id.setter
    def object_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "object_id", value)

    @property
    @pulumi.getter
    def type(self) -> Optional[pulumi.Input[str]]:
        """
        The type of object acting as an approver. Possible options are `singleUser` and `groupMembers`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "type", value)


if not MYPY:
    class GroupRoleManagementPolicyActiveAssignmentRulesArgsDict(TypedDict):
        expiration_required: NotRequired[pulumi.Input[bool]]
        """
        Must an assignment have an expiry date. `false` allows permanent assignment.
        """
        expire_after: NotRequired[pulumi.Input[str]]
        """
        The maximum length of time an assignment can be valid, as an ISO8601 duration. Permitted values: `P15D`, `P30D`, `P90D`, `P180D`, or `P365D`.
        """
        require_justification: NotRequired[pulumi.Input[bool]]
        """
        Is a justification required to create new assignments.
        """
        require_multifactor_authentication: NotRequired[pulumi.Input[bool]]
        """
        Is multi-factor authentication required to create new assignments.
        """
        require_ticket_info: NotRequired[pulumi.Input[bool]]
        """
        Is ticket information required to create new assignments.

        One of `expiration_required` or `expire_after` must be provided.
        """
elif False:
    GroupRoleManagementPolicyActiveAssignmentRulesArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyActiveAssignmentRulesArgs:
    def __init__(__self__, *,
                 expiration_required: Optional[pulumi.Input[bool]] = None,
                 expire_after: Optional[pulumi.Input[str]] = None,
                 require_justification: Optional[pulumi.Input[bool]] = None,
                 require_multifactor_authentication: Optional[pulumi.Input[bool]] = None,
                 require_ticket_info: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] expiration_required: Must an assignment have an expiry date. `false` allows permanent assignment.
        :param pulumi.Input[str] expire_after: The maximum length of time an assignment can be valid, as an ISO8601 duration. Permitted values: `P15D`, `P30D`, `P90D`, `P180D`, or `P365D`.
        :param pulumi.Input[bool] require_justification: Is a justification required to create new assignments.
        :param pulumi.Input[bool] require_multifactor_authentication: Is multi-factor authentication required to create new assignments.
        :param pulumi.Input[bool] require_ticket_info: Is ticket information required to create new assignments.
               
               One of `expiration_required` or `expire_after` must be provided.
        """
        if expiration_required is not None:
            pulumi.set(__self__, "expiration_required", expiration_required)
        if expire_after is not None:
            pulumi.set(__self__, "expire_after", expire_after)
        if require_justification is not None:
            pulumi.set(__self__, "require_justification", require_justification)
        if require_multifactor_authentication is not None:
            pulumi.set(__self__, "require_multifactor_authentication", require_multifactor_authentication)
        if require_ticket_info is not None:
            pulumi.set(__self__, "require_ticket_info", require_ticket_info)

    @property
    @pulumi.getter(name="expirationRequired")
    def expiration_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Must an assignment have an expiry date. `false` allows permanent assignment.
        """
        return pulumi.get(self, "expiration_required")

    @expiration_required.setter
    def expiration_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "expiration_required", value)

    @property
    @pulumi.getter(name="expireAfter")
    def expire_after(self) -> Optional[pulumi.Input[str]]:
        """
        The maximum length of time an assignment can be valid, as an ISO8601 duration. Permitted values: `P15D`, `P30D`, `P90D`, `P180D`, or `P365D`.
        """
        return pulumi.get(self, "expire_after")

    @expire_after.setter
    def expire_after(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "expire_after", value)

    @property
    @pulumi.getter(name="requireJustification")
    def require_justification(self) -> Optional[pulumi.Input[bool]]:
        """
        Is a justification required to create new assignments.
        """
        return pulumi.get(self, "require_justification")

    @require_justification.setter
    def require_justification(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "require_justification", value)

    @property
    @pulumi.getter(name="requireMultifactorAuthentication")
    def require_multifactor_authentication(self) -> Optional[pulumi.Input[bool]]:
        """
        Is multi-factor authentication required to create new assignments.
        """
        return pulumi.get(self, "require_multifactor_authentication")

    @require_multifactor_authentication.setter
    def require_multifactor_authentication(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "require_multifactor_authentication", value)

    @property
    @pulumi.getter(name="requireTicketInfo")
    def require_ticket_info(self) -> Optional[pulumi.Input[bool]]:
        """
        Is ticket information required to create new assignments.

        One of `expiration_required` or `expire_after` must be provided.
        """
        return pulumi.get(self, "require_ticket_info")

    @require_ticket_info.setter
    def require_ticket_info(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "require_ticket_info", value)


if not MYPY:
    class GroupRoleManagementPolicyEligibleAssignmentRulesArgsDict(TypedDict):
        expiration_required: NotRequired[pulumi.Input[bool]]
        """
        Must an assignment have an expiry date. `false` allows permanent assignment.
        """
        expire_after: NotRequired[pulumi.Input[str]]
        """
        The maximum length of time an assignment can be valid, as an ISO8601 duration. Permitted values: `P15D`, `P30D`, `P90D`, `P180D`, or `P365D`.

        One of `expiration_required` or `expire_after` must be provided.
        """
elif False:
    GroupRoleManagementPolicyEligibleAssignmentRulesArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyEligibleAssignmentRulesArgs:
    def __init__(__self__, *,
                 expiration_required: Optional[pulumi.Input[bool]] = None,
                 expire_after: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[bool] expiration_required: Must an assignment have an expiry date. `false` allows permanent assignment.
        :param pulumi.Input[str] expire_after: The maximum length of time an assignment can be valid, as an ISO8601 duration. Permitted values: `P15D`, `P30D`, `P90D`, `P180D`, or `P365D`.
               
               One of `expiration_required` or `expire_after` must be provided.
        """
        if expiration_required is not None:
            pulumi.set(__self__, "expiration_required", expiration_required)
        if expire_after is not None:
            pulumi.set(__self__, "expire_after", expire_after)

    @property
    @pulumi.getter(name="expirationRequired")
    def expiration_required(self) -> Optional[pulumi.Input[bool]]:
        """
        Must an assignment have an expiry date. `false` allows permanent assignment.
        """
        return pulumi.get(self, "expiration_required")

    @expiration_required.setter
    def expiration_required(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "expiration_required", value)

    @property
    @pulumi.getter(name="expireAfter")
    def expire_after(self) -> Optional[pulumi.Input[str]]:
        """
        The maximum length of time an assignment can be valid, as an ISO8601 duration. Permitted values: `P15D`, `P30D`, `P90D`, `P180D`, or `P365D`.

        One of `expiration_required` or `expire_after` must be provided.
        """
        return pulumi.get(self, "expire_after")

    @expire_after.setter
    def expire_after(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "expire_after", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesArgsDict(TypedDict):
        active_assignments: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgsDict']]
        """
        A `notification_target` block as defined below to configure notfications on active role assignments.
        """
        eligible_activations: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgsDict']]
        """
        A `notification_target` block as defined below for configuring notifications on activation of eligible role.
        """
        eligible_assignments: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgsDict']]
        """
        A `notification_target` block as defined below to configure notification on eligible role assignments.

        At least one `notification_target` block must be provided.
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesArgs:
    def __init__(__self__, *,
                 active_assignments: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgs']] = None,
                 eligible_activations: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgs']] = None,
                 eligible_assignments: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgs']] = None):
        """
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgs'] active_assignments: A `notification_target` block as defined below to configure notfications on active role assignments.
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgs'] eligible_activations: A `notification_target` block as defined below for configuring notifications on activation of eligible role.
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgs'] eligible_assignments: A `notification_target` block as defined below to configure notification on eligible role assignments.
               
               At least one `notification_target` block must be provided.
        """
        if active_assignments is not None:
            pulumi.set(__self__, "active_assignments", active_assignments)
        if eligible_activations is not None:
            pulumi.set(__self__, "eligible_activations", eligible_activations)
        if eligible_assignments is not None:
            pulumi.set(__self__, "eligible_assignments", eligible_assignments)

    @property
    @pulumi.getter(name="activeAssignments")
    def active_assignments(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgs']]:
        """
        A `notification_target` block as defined below to configure notfications on active role assignments.
        """
        return pulumi.get(self, "active_assignments")

    @active_assignments.setter
    def active_assignments(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgs']]):
        pulumi.set(self, "active_assignments", value)

    @property
    @pulumi.getter(name="eligibleActivations")
    def eligible_activations(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgs']]:
        """
        A `notification_target` block as defined below for configuring notifications on activation of eligible role.
        """
        return pulumi.get(self, "eligible_activations")

    @eligible_activations.setter
    def eligible_activations(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgs']]):
        pulumi.set(self, "eligible_activations", value)

    @property
    @pulumi.getter(name="eligibleAssignments")
    def eligible_assignments(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgs']]:
        """
        A `notification_target` block as defined below to configure notification on eligible role assignments.

        At least one `notification_target` block must be provided.
        """
        return pulumi.get(self, "eligible_assignments")

    @eligible_assignments.setter
    def eligible_assignments(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgs']]):
        pulumi.set(self, "eligible_assignments", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgsDict(TypedDict):
        admin_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgsDict']]
        """
        Admin notification settings
        """
        approver_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgsDict']]
        """
        Approver notification settings
        """
        assignee_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgsDict']]
        """
        Assignee notification settings
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsArgs:
    def __init__(__self__, *,
                 admin_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgs']] = None,
                 approver_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgs']] = None,
                 assignee_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgs']] = None):
        """
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgs'] admin_notifications: Admin notification settings
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgs'] approver_notifications: Approver notification settings
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgs'] assignee_notifications: Assignee notification settings
        """
        if admin_notifications is not None:
            pulumi.set(__self__, "admin_notifications", admin_notifications)
        if approver_notifications is not None:
            pulumi.set(__self__, "approver_notifications", approver_notifications)
        if assignee_notifications is not None:
            pulumi.set(__self__, "assignee_notifications", assignee_notifications)

    @property
    @pulumi.getter(name="adminNotifications")
    def admin_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgs']]:
        """
        Admin notification settings
        """
        return pulumi.get(self, "admin_notifications")

    @admin_notifications.setter
    def admin_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgs']]):
        pulumi.set(self, "admin_notifications", value)

    @property
    @pulumi.getter(name="approverNotifications")
    def approver_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgs']]:
        """
        Approver notification settings
        """
        return pulumi.get(self, "approver_notifications")

    @approver_notifications.setter
    def approver_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgs']]):
        pulumi.set(self, "approver_notifications", value)

    @property
    @pulumi.getter(name="assigneeNotifications")
    def assignee_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgs']]:
        """
        Assignee notification settings
        """
        return pulumi.get(self, "assignee_notifications")

    @assignee_notifications.setter
    def assignee_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgs']]):
        pulumi.set(self, "assignee_notifications", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAdminNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsApproverNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesActiveAssignmentsAssigneeNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgsDict(TypedDict):
        admin_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgsDict']]
        """
        Admin notification settings
        """
        approver_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgsDict']]
        """
        Approver notification settings
        """
        assignee_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgsDict']]
        """
        Assignee notification settings
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleActivationsArgs:
    def __init__(__self__, *,
                 admin_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgs']] = None,
                 approver_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgs']] = None,
                 assignee_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgs']] = None):
        """
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgs'] admin_notifications: Admin notification settings
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgs'] approver_notifications: Approver notification settings
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgs'] assignee_notifications: Assignee notification settings
        """
        if admin_notifications is not None:
            pulumi.set(__self__, "admin_notifications", admin_notifications)
        if approver_notifications is not None:
            pulumi.set(__self__, "approver_notifications", approver_notifications)
        if assignee_notifications is not None:
            pulumi.set(__self__, "assignee_notifications", assignee_notifications)

    @property
    @pulumi.getter(name="adminNotifications")
    def admin_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgs']]:
        """
        Admin notification settings
        """
        return pulumi.get(self, "admin_notifications")

    @admin_notifications.setter
    def admin_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgs']]):
        pulumi.set(self, "admin_notifications", value)

    @property
    @pulumi.getter(name="approverNotifications")
    def approver_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgs']]:
        """
        Approver notification settings
        """
        return pulumi.get(self, "approver_notifications")

    @approver_notifications.setter
    def approver_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgs']]):
        pulumi.set(self, "approver_notifications", value)

    @property
    @pulumi.getter(name="assigneeNotifications")
    def assignee_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgs']]:
        """
        Assignee notification settings
        """
        return pulumi.get(self, "assignee_notifications")

    @assignee_notifications.setter
    def assignee_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgs']]):
        pulumi.set(self, "assignee_notifications", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleActivationsAdminNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleActivationsApproverNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleActivationsAssigneeNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgsDict(TypedDict):
        admin_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgsDict']]
        """
        Admin notification settings
        """
        approver_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgsDict']]
        """
        Approver notification settings
        """
        assignee_notifications: NotRequired[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgsDict']]
        """
        Assignee notification settings
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsArgs:
    def __init__(__self__, *,
                 admin_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgs']] = None,
                 approver_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgs']] = None,
                 assignee_notifications: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgs']] = None):
        """
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgs'] admin_notifications: Admin notification settings
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgs'] approver_notifications: Approver notification settings
        :param pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgs'] assignee_notifications: Assignee notification settings
        """
        if admin_notifications is not None:
            pulumi.set(__self__, "admin_notifications", admin_notifications)
        if approver_notifications is not None:
            pulumi.set(__self__, "approver_notifications", approver_notifications)
        if assignee_notifications is not None:
            pulumi.set(__self__, "assignee_notifications", assignee_notifications)

    @property
    @pulumi.getter(name="adminNotifications")
    def admin_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgs']]:
        """
        Admin notification settings
        """
        return pulumi.get(self, "admin_notifications")

    @admin_notifications.setter
    def admin_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgs']]):
        pulumi.set(self, "admin_notifications", value)

    @property
    @pulumi.getter(name="approverNotifications")
    def approver_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgs']]:
        """
        Approver notification settings
        """
        return pulumi.get(self, "approver_notifications")

    @approver_notifications.setter
    def approver_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgs']]):
        pulumi.set(self, "approver_notifications", value)

    @property
    @pulumi.getter(name="assigneeNotifications")
    def assignee_notifications(self) -> Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgs']]:
        """
        Assignee notification settings
        """
        return pulumi.get(self, "assignee_notifications")

    @assignee_notifications.setter
    def assignee_notifications(self, value: Optional[pulumi.Input['GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgs']]):
        pulumi.set(self, "assignee_notifications", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAdminNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsApproverNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgsDict(TypedDict):
        default_recipients: pulumi.Input[bool]
        """
        Whether the default recipients are notified
        """
        notification_level: pulumi.Input[str]
        """
        What level of notifications are sent
        """
        additional_recipients: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        The additional recipients to notify
        """
elif False:
    GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class GroupRoleManagementPolicyNotificationRulesEligibleAssignmentsAssigneeNotificationsArgs:
    def __init__(__self__, *,
                 default_recipients: pulumi.Input[bool],
                 notification_level: pulumi.Input[str],
                 additional_recipients: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[bool] default_recipients: Whether the default recipients are notified
        :param pulumi.Input[str] notification_level: What level of notifications are sent
        :param pulumi.Input[Sequence[pulumi.Input[str]]] additional_recipients: The additional recipients to notify
        """
        pulumi.set(__self__, "default_recipients", default_recipients)
        pulumi.set(__self__, "notification_level", notification_level)
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)

    @property
    @pulumi.getter(name="defaultRecipients")
    def default_recipients(self) -> pulumi.Input[bool]:
        """
        Whether the default recipients are notified
        """
        return pulumi.get(self, "default_recipients")

    @default_recipients.setter
    def default_recipients(self, value: pulumi.Input[bool]):
        pulumi.set(self, "default_recipients", value)

    @property
    @pulumi.getter(name="notificationLevel")
    def notification_level(self) -> pulumi.Input[str]:
        """
        What level of notifications are sent
        """
        return pulumi.get(self, "notification_level")

    @notification_level.setter
    def notification_level(self, value: pulumi.Input[str]):
        pulumi.set(self, "notification_level", value)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The additional recipients to notify
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "additional_recipients", value)


if not MYPY:
    class InvitationMessageArgsDict(TypedDict):
        additional_recipients: NotRequired[pulumi.Input[str]]
        """
        Email addresses of additional recipients the invitation message should be sent to. Only 1 additional recipient is currently supported by Azure.
        """
        body: NotRequired[pulumi.Input[str]]
        """
        Customized message body you want to send if you don't want to send the default message. Cannot be specified with `language`.
        """
        language: NotRequired[pulumi.Input[str]]
        """
        The language you want to send the default message in. The value specified must be in ISO 639 format. Defaults to `en-US`. Cannot be specified with `body`.
        """
elif False:
    InvitationMessageArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class InvitationMessageArgs:
    def __init__(__self__, *,
                 additional_recipients: Optional[pulumi.Input[str]] = None,
                 body: Optional[pulumi.Input[str]] = None,
                 language: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] additional_recipients: Email addresses of additional recipients the invitation message should be sent to. Only 1 additional recipient is currently supported by Azure.
        :param pulumi.Input[str] body: Customized message body you want to send if you don't want to send the default message. Cannot be specified with `language`.
        :param pulumi.Input[str] language: The language you want to send the default message in. The value specified must be in ISO 639 format. Defaults to `en-US`. Cannot be specified with `body`.
        """
        if additional_recipients is not None:
            pulumi.set(__self__, "additional_recipients", additional_recipients)
        if body is not None:
            pulumi.set(__self__, "body", body)
        if language is not None:
            pulumi.set(__self__, "language", language)

    @property
    @pulumi.getter(name="additionalRecipients")
    def additional_recipients(self) -> Optional[pulumi.Input[str]]:
        """
        Email addresses of additional recipients the invitation message should be sent to. Only 1 additional recipient is currently supported by Azure.
        """
        return pulumi.get(self, "additional_recipients")

    @additional_recipients.setter
    def additional_recipients(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "additional_recipients", value)

    @property
    @pulumi.getter
    def body(self) -> Optional[pulumi.Input[str]]:
        """
        Customized message body you want to send if you don't want to send the default message. Cannot be specified with `language`.
        """
        return pulumi.get(self, "body")

    @body.setter
    def body(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "body", value)

    @property
    @pulumi.getter
    def language(self) -> Optional[pulumi.Input[str]]:
        """
        The language you want to send the default message in. The value specified must be in ISO 639 format. Defaults to `en-US`. Cannot be specified with `body`.
        """
        return pulumi.get(self, "language")

    @language.setter
    def language(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "language", value)


if not MYPY:
    class NamedLocationCountryArgsDict(TypedDict):
        countries_and_regions: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        List of countries and/or regions in two-letter format specified by ISO 3166-2.
        """
        country_lookup_method: NotRequired[pulumi.Input[str]]
        """
        Method of detecting country the user is located in. Possible values are `clientIpAddress` for IP-based location and `authenticatorAppGps` for Authenticator app GPS-based location.  Defaults to `clientIpAddress`.
        """
        include_unknown_countries_and_regions: NotRequired[pulumi.Input[bool]]
        """
        Whether IP addresses that don't map to a country or region should be included in the named location. Defaults to `false`.
        """
elif False:
    NamedLocationCountryArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class NamedLocationCountryArgs:
    def __init__(__self__, *,
                 countries_and_regions: pulumi.Input[Sequence[pulumi.Input[str]]],
                 country_lookup_method: Optional[pulumi.Input[str]] = None,
                 include_unknown_countries_and_regions: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] countries_and_regions: List of countries and/or regions in two-letter format specified by ISO 3166-2.
        :param pulumi.Input[str] country_lookup_method: Method of detecting country the user is located in. Possible values are `clientIpAddress` for IP-based location and `authenticatorAppGps` for Authenticator app GPS-based location.  Defaults to `clientIpAddress`.
        :param pulumi.Input[bool] include_unknown_countries_and_regions: Whether IP addresses that don't map to a country or region should be included in the named location. Defaults to `false`.
        """
        pulumi.set(__self__, "countries_and_regions", countries_and_regions)
        if country_lookup_method is not None:
            pulumi.set(__self__, "country_lookup_method", country_lookup_method)
        if include_unknown_countries_and_regions is not None:
            pulumi.set(__self__, "include_unknown_countries_and_regions", include_unknown_countries_and_regions)

    @property
    @pulumi.getter(name="countriesAndRegions")
    def countries_and_regions(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        List of countries and/or regions in two-letter format specified by ISO 3166-2.
        """
        return pulumi.get(self, "countries_and_regions")

    @countries_and_regions.setter
    def countries_and_regions(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "countries_and_regions", value)

    @property
    @pulumi.getter(name="countryLookupMethod")
    def country_lookup_method(self) -> Optional[pulumi.Input[str]]:
        """
        Method of detecting country the user is located in. Possible values are `clientIpAddress` for IP-based location and `authenticatorAppGps` for Authenticator app GPS-based location.  Defaults to `clientIpAddress`.
        """
        return pulumi.get(self, "country_lookup_method")

    @country_lookup_method.setter
    def country_lookup_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "country_lookup_method", value)

    @property
    @pulumi.getter(name="includeUnknownCountriesAndRegions")
    def include_unknown_countries_and_regions(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether IP addresses that don't map to a country or region should be included in the named location. Defaults to `false`.
        """
        return pulumi.get(self, "include_unknown_countries_and_regions")

    @include_unknown_countries_and_regions.setter
    def include_unknown_countries_and_regions(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_unknown_countries_and_regions", value)


if not MYPY:
    class NamedLocationIpArgsDict(TypedDict):
        ip_ranges: pulumi.Input[Sequence[pulumi.Input[str]]]
        """
        List of IP address ranges in IPv4 CIDR format (e.g. `1.2.3.4/32`) or any allowable IPv6 format from IETF RFC596. Each CIDR prefix must be `/8` or larger.
        """
        trusted: NotRequired[pulumi.Input[bool]]
        """
        Whether the named location is trusted. Defaults to `false`.
        """
elif False:
    NamedLocationIpArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class NamedLocationIpArgs:
    def __init__(__self__, *,
                 ip_ranges: pulumi.Input[Sequence[pulumi.Input[str]]],
                 trusted: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] ip_ranges: List of IP address ranges in IPv4 CIDR format (e.g. `1.2.3.4/32`) or any allowable IPv6 format from IETF RFC596. Each CIDR prefix must be `/8` or larger.
        :param pulumi.Input[bool] trusted: Whether the named location is trusted. Defaults to `false`.
        """
        pulumi.set(__self__, "ip_ranges", ip_ranges)
        if trusted is not None:
            pulumi.set(__self__, "trusted", trusted)

    @property
    @pulumi.getter(name="ipRanges")
    def ip_ranges(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        List of IP address ranges in IPv4 CIDR format (e.g. `1.2.3.4/32`) or any allowable IPv6 format from IETF RFC596. Each CIDR prefix must be `/8` or larger.
        """
        return pulumi.get(self, "ip_ranges")

    @ip_ranges.setter
    def ip_ranges(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "ip_ranges", value)

    @property
    @pulumi.getter
    def trusted(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the named location is trusted. Defaults to `false`.
        """
        return pulumi.get(self, "trusted")

    @trusted.setter
    def trusted(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "trusted", value)


if not MYPY:
    class ServicePrincipalAppRoleArgsDict(TypedDict):
        allowed_member_types: NotRequired[pulumi.Input[Sequence[pulumi.Input[str]]]]
        """
        Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are: `User` and `Application`, or both.
        """
        description: NotRequired[pulumi.Input[str]]
        """
        A description of the service principal provided for internal end-users.
        """
        display_name: NotRequired[pulumi.Input[str]]
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Specifies whether the permission scope is enabled.
        """
        id: NotRequired[pulumi.Input[str]]
        """
        The unique identifier of the delegated permission.
        """
        value: NotRequired[pulumi.Input[str]]
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
elif False:
    ServicePrincipalAppRoleArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ServicePrincipalAppRoleArgs:
    def __init__(__self__, *,
                 allowed_member_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 id: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_member_types: Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are: `User` and `Application`, or both.
        :param pulumi.Input[str] description: A description of the service principal provided for internal end-users.
        :param pulumi.Input[str] display_name: Display name for the app role that appears during app role assignment and in consent experiences.
        :param pulumi.Input[bool] enabled: Specifies whether the permission scope is enabled.
        :param pulumi.Input[str] id: The unique identifier of the delegated permission.
        :param pulumi.Input[str] value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        if allowed_member_types is not None:
            pulumi.set(__self__, "allowed_member_types", allowed_member_types)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if display_name is not None:
            pulumi.set(__self__, "display_name", display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="allowedMemberTypes")
    def allowed_member_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies whether this app role definition can be assigned to users and groups, or to other applications (that are accessing this application in a standalone scenario). Possible values are: `User` and `Application`, or both.
        """
        return pulumi.get(self, "allowed_member_types")

    @allowed_member_types.setter
    def allowed_member_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "allowed_member_types", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        A description of the service principal provided for internal end-users.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the app role that appears during app role assignment and in consent experiences.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Specifies whether the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def id(self) -> Optional[pulumi.Input[str]]:
        """
        The unique identifier of the delegated permission.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


if not MYPY:
    class ServicePrincipalFeatureArgsDict(TypedDict):
        custom_single_sign_on_app: NotRequired[pulumi.Input[bool]]
        """
        Whether this service principal represents a custom SAML application
        """
        enterprise_application: NotRequired[pulumi.Input[bool]]
        """
        Whether this service principal represents an Enterprise Application
        """
        gallery_application: NotRequired[pulumi.Input[bool]]
        """
        Whether this service principal represents a gallery application
        """
        visible_to_users: NotRequired[pulumi.Input[bool]]
        """
        Whether this app is visible to users in My Apps and Office 365 Launcher
        """
elif False:
    ServicePrincipalFeatureArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ServicePrincipalFeatureArgs:
    def __init__(__self__, *,
                 custom_single_sign_on_app: Optional[pulumi.Input[bool]] = None,
                 enterprise_application: Optional[pulumi.Input[bool]] = None,
                 gallery_application: Optional[pulumi.Input[bool]] = None,
                 visible_to_users: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] custom_single_sign_on_app: Whether this service principal represents a custom SAML application
        :param pulumi.Input[bool] enterprise_application: Whether this service principal represents an Enterprise Application
        :param pulumi.Input[bool] gallery_application: Whether this service principal represents a gallery application
        :param pulumi.Input[bool] visible_to_users: Whether this app is visible to users in My Apps and Office 365 Launcher
        """
        if custom_single_sign_on_app is not None:
            pulumi.set(__self__, "custom_single_sign_on_app", custom_single_sign_on_app)
        if enterprise_application is not None:
            pulumi.set(__self__, "enterprise_application", enterprise_application)
        if gallery_application is not None:
            pulumi.set(__self__, "gallery_application", gallery_application)
        if visible_to_users is not None:
            pulumi.set(__self__, "visible_to_users", visible_to_users)

    @property
    @pulumi.getter(name="customSingleSignOnApp")
    def custom_single_sign_on_app(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents a custom SAML application
        """
        return pulumi.get(self, "custom_single_sign_on_app")

    @custom_single_sign_on_app.setter
    def custom_single_sign_on_app(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "custom_single_sign_on_app", value)

    @property
    @pulumi.getter(name="enterpriseApplication")
    def enterprise_application(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents an Enterprise Application
        """
        return pulumi.get(self, "enterprise_application")

    @enterprise_application.setter
    def enterprise_application(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enterprise_application", value)

    @property
    @pulumi.getter(name="galleryApplication")
    def gallery_application(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents a gallery application
        """
        return pulumi.get(self, "gallery_application")

    @gallery_application.setter
    def gallery_application(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "gallery_application", value)

    @property
    @pulumi.getter(name="visibleToUsers")
    def visible_to_users(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this app is visible to users in My Apps and Office 365 Launcher
        """
        return pulumi.get(self, "visible_to_users")

    @visible_to_users.setter
    def visible_to_users(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "visible_to_users", value)


if not MYPY:
    class ServicePrincipalFeatureTagArgsDict(TypedDict):
        custom_single_sign_on: NotRequired[pulumi.Input[bool]]
        """
        Whether this service principal represents a custom SAML application. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        enterprise: NotRequired[pulumi.Input[bool]]
        """
        Whether this service principal represents an Enterprise Application. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        gallery: NotRequired[pulumi.Input[bool]]
        """
        Whether this service principal represents a gallery application. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        hide: NotRequired[pulumi.Input[bool]]
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
elif False:
    ServicePrincipalFeatureTagArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ServicePrincipalFeatureTagArgs:
    def __init__(__self__, *,
                 custom_single_sign_on: Optional[pulumi.Input[bool]] = None,
                 enterprise: Optional[pulumi.Input[bool]] = None,
                 gallery: Optional[pulumi.Input[bool]] = None,
                 hide: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[bool] custom_single_sign_on: Whether this service principal represents a custom SAML application. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        :param pulumi.Input[bool] enterprise: Whether this service principal represents an Enterprise Application. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        :param pulumi.Input[bool] gallery: Whether this service principal represents a gallery application. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        :param pulumi.Input[bool] hide: Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        if custom_single_sign_on is not None:
            pulumi.set(__self__, "custom_single_sign_on", custom_single_sign_on)
        if enterprise is not None:
            pulumi.set(__self__, "enterprise", enterprise)
        if gallery is not None:
            pulumi.set(__self__, "gallery", gallery)
        if hide is not None:
            pulumi.set(__self__, "hide", hide)

    @property
    @pulumi.getter(name="customSingleSignOn")
    def custom_single_sign_on(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents a custom SAML application. Enabling this will assign the `WindowsAzureActiveDirectoryCustomSingleSignOnApplication` tag. Defaults to `false`.
        """
        return pulumi.get(self, "custom_single_sign_on")

    @custom_single_sign_on.setter
    def custom_single_sign_on(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "custom_single_sign_on", value)

    @property
    @pulumi.getter
    def enterprise(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents an Enterprise Application. Enabling this will assign the `WindowsAzureActiveDirectoryIntegratedApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "enterprise")

    @enterprise.setter
    def enterprise(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enterprise", value)

    @property
    @pulumi.getter
    def gallery(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this service principal represents a gallery application. Enabling this will assign the `WindowsAzureActiveDirectoryGalleryApplicationNonPrimaryV1` tag. Defaults to `false`.
        """
        return pulumi.get(self, "gallery")

    @gallery.setter
    def gallery(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "gallery", value)

    @property
    @pulumi.getter
    def hide(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether this app is invisible to users in My Apps and Office 365 Launcher. Enabling this will assign the `HideApp` tag. Defaults to `false`.
        """
        return pulumi.get(self, "hide")

    @hide.setter
    def hide(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide", value)


if not MYPY:
    class ServicePrincipalOauth2PermissionScopeArgsDict(TypedDict):
        admin_consent_description: NotRequired[pulumi.Input[str]]
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        admin_consent_display_name: NotRequired[pulumi.Input[str]]
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        enabled: NotRequired[pulumi.Input[bool]]
        """
        Specifies whether the permission scope is enabled.
        """
        id: NotRequired[pulumi.Input[str]]
        """
        The unique identifier of the delegated permission.
        """
        type: NotRequired[pulumi.Input[str]]
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        """
        user_consent_description: NotRequired[pulumi.Input[str]]
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        user_consent_display_name: NotRequired[pulumi.Input[str]]
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        value: NotRequired[pulumi.Input[str]]
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
elif False:
    ServicePrincipalOauth2PermissionScopeArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ServicePrincipalOauth2PermissionScopeArgs:
    def __init__(__self__, *,
                 admin_consent_description: Optional[pulumi.Input[str]] = None,
                 admin_consent_display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 id: Optional[pulumi.Input[str]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 user_consent_description: Optional[pulumi.Input[str]] = None,
                 user_consent_display_name: Optional[pulumi.Input[str]] = None,
                 value: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] admin_consent_description: Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[str] admin_consent_display_name: Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        :param pulumi.Input[bool] enabled: Specifies whether the permission scope is enabled.
        :param pulumi.Input[str] id: The unique identifier of the delegated permission.
        :param pulumi.Input[str] type: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        :param pulumi.Input[str] user_consent_description: Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        :param pulumi.Input[str] user_consent_display_name: Display name for the delegated permission that appears in the end user consent experience.
        :param pulumi.Input[str] value: The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        if admin_consent_description is not None:
            pulumi.set(__self__, "admin_consent_description", admin_consent_description)
        if admin_consent_display_name is not None:
            pulumi.set(__self__, "admin_consent_display_name", admin_consent_display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if type is not None:
            pulumi.set(__self__, "type", type)
        if user_consent_description is not None:
            pulumi.set(__self__, "user_consent_description", user_consent_description)
        if user_consent_display_name is not None:
            pulumi.set(__self__, "user_consent_display_name", user_consent_display_name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter(name="adminConsentDescription")
    def admin_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in all tenant-wide admin consent experiences, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_description")

    @admin_consent_description.setter
    def admin_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_description", value)

    @property
    @pulumi.getter(name="adminConsentDisplayName")
    def admin_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission, intended to be read by an administrator granting the permission on behalf of all users.
        """
        return pulumi.get(self, "admin_consent_display_name")

    @admin_consent_display_name.setter
    def admin_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "admin_consent_display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Specifies whether the permission scope is enabled.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def id(self) -> Optional[pulumi.Input[str]]:
        """
        The unique identifier of the delegated permission.
        """
        return pulumi.get(self, "id")

    @id.setter
    def id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "id", value)

    @property
    @pulumi.getter
    def type(self) -> Optional[pulumi.Input[str]]:
        """
        Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions. Possible values are `User` or `Admin`.
        """
        return pulumi.get(self, "type")

    @type.setter
    def type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "type", value)

    @property
    @pulumi.getter(name="userConsentDescription")
    def user_consent_description(self) -> Optional[pulumi.Input[str]]:
        """
        Delegated permission description that appears in the end user consent experience, intended to be read by a user consenting on their own behalf.
        """
        return pulumi.get(self, "user_consent_description")

    @user_consent_description.setter
    def user_consent_description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_description", value)

    @property
    @pulumi.getter(name="userConsentDisplayName")
    def user_consent_display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name for the delegated permission that appears in the end user consent experience.
        """
        return pulumi.get(self, "user_consent_display_name")

    @user_consent_display_name.setter
    def user_consent_display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_consent_display_name", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input[str]]:
        """
        The value that is used for the `scp` claim in OAuth 2.0 access tokens.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "value", value)


if not MYPY:
    class ServicePrincipalSamlSingleSignOnArgsDict(TypedDict):
        relay_state: NotRequired[pulumi.Input[str]]
        """
        The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
elif False:
    ServicePrincipalSamlSingleSignOnArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class ServicePrincipalSamlSingleSignOnArgs:
    def __init__(__self__, *,
                 relay_state: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] relay_state: The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        if relay_state is not None:
            pulumi.set(__self__, "relay_state", relay_state)

    @property
    @pulumi.getter(name="relayState")
    def relay_state(self) -> Optional[pulumi.Input[str]]:
        """
        The relative URI the service provider would redirect to after completion of the single sign-on flow.
        """
        return pulumi.get(self, "relay_state")

    @relay_state.setter
    def relay_state(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "relay_state", value)


if not MYPY:
    class SynchronizationJobProvisionOnDemandParameterArgsDict(TypedDict):
        rule_id: pulumi.Input[str]
        """
        The identifier of the synchronization rule to be applied. This rule ID is defined in the schema for a given synchronization job or template.
        """
        subjects: pulumi.Input[Sequence[pulumi.Input['SynchronizationJobProvisionOnDemandParameterSubjectArgsDict']]]
        """
        One or more `subject` blocks as documented below.
        """
elif False:
    SynchronizationJobProvisionOnDemandParameterArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class SynchronizationJobProvisionOnDemandParameterArgs:
    def __init__(__self__, *,
                 rule_id: pulumi.Input[str],
                 subjects: pulumi.Input[Sequence[pulumi.Input['SynchronizationJobProvisionOnDemandParameterSubjectArgs']]]):
        """
        :param pulumi.Input[str] rule_id: The identifier of the synchronization rule to be applied. This rule ID is defined in the schema for a given synchronization job or template.
        :param pulumi.Input[Sequence[pulumi.Input['SynchronizationJobProvisionOnDemandParameterSubjectArgs']]] subjects: One or more `subject` blocks as documented below.
        """
        pulumi.set(__self__, "rule_id", rule_id)
        pulumi.set(__self__, "subjects", subjects)

    @property
    @pulumi.getter(name="ruleId")
    def rule_id(self) -> pulumi.Input[str]:
        """
        The identifier of the synchronization rule to be applied. This rule ID is defined in the schema for a given synchronization job or template.
        """
        return pulumi.get(self, "rule_id")

    @rule_id.setter
    def rule_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "rule_id", value)

    @property
    @pulumi.getter
    def subjects(self) -> pulumi.Input[Sequence[pulumi.Input['SynchronizationJobProvisionOnDemandParameterSubjectArgs']]]:
        """
        One or more `subject` blocks as documented below.
        """
        return pulumi.get(self, "subjects")

    @subjects.setter
    def subjects(self, value: pulumi.Input[Sequence[pulumi.Input['SynchronizationJobProvisionOnDemandParameterSubjectArgs']]]):
        pulumi.set(self, "subjects", value)


if not MYPY:
    class SynchronizationJobProvisionOnDemandParameterSubjectArgsDict(TypedDict):
        object_id: pulumi.Input[str]
        """
        The identifier of an object to which a synchronization job is to be applied. Can be one of the following: (1) An onPremisesDistinguishedName for synchronization from Active Directory to Azure AD. (2) The user ID for synchronization from Azure AD to a third-party. (3) The Worker ID of the Workday worker for synchronization from Workday to either Active Directory or Azure AD.
        """
        object_type_name: pulumi.Input[str]
        """
        The type of the object to which a synchronization job is to be applied. Can be one of the following: `user` for synchronizing between Active Directory and Azure AD, `User` for synchronizing a user between Azure AD and a third-party application, `Worker` for synchronization a user between Workday and either Active Directory or Azure AD, `Group` for synchronizing a group between Azure AD and a third-party application.
        """
elif False:
    SynchronizationJobProvisionOnDemandParameterSubjectArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class SynchronizationJobProvisionOnDemandParameterSubjectArgs:
    def __init__(__self__, *,
                 object_id: pulumi.Input[str],
                 object_type_name: pulumi.Input[str]):
        """
        :param pulumi.Input[str] object_id: The identifier of an object to which a synchronization job is to be applied. Can be one of the following: (1) An onPremisesDistinguishedName for synchronization from Active Directory to Azure AD. (2) The user ID for synchronization from Azure AD to a third-party. (3) The Worker ID of the Workday worker for synchronization from Workday to either Active Directory or Azure AD.
        :param pulumi.Input[str] object_type_name: The type of the object to which a synchronization job is to be applied. Can be one of the following: `user` for synchronizing between Active Directory and Azure AD, `User` for synchronizing a user between Azure AD and a third-party application, `Worker` for synchronization a user between Workday and either Active Directory or Azure AD, `Group` for synchronizing a group between Azure AD and a third-party application.
        """
        pulumi.set(__self__, "object_id", object_id)
        pulumi.set(__self__, "object_type_name", object_type_name)

    @property
    @pulumi.getter(name="objectId")
    def object_id(self) -> pulumi.Input[str]:
        """
        The identifier of an object to which a synchronization job is to be applied. Can be one of the following: (1) An onPremisesDistinguishedName for synchronization from Active Directory to Azure AD. (2) The user ID for synchronization from Azure AD to a third-party. (3) The Worker ID of the Workday worker for synchronization from Workday to either Active Directory or Azure AD.
        """
        return pulumi.get(self, "object_id")

    @object_id.setter
    def object_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "object_id", value)

    @property
    @pulumi.getter(name="objectTypeName")
    def object_type_name(self) -> pulumi.Input[str]:
        """
        The type of the object to which a synchronization job is to be applied. Can be one of the following: `user` for synchronizing between Active Directory and Azure AD, `User` for synchronizing a user between Azure AD and a third-party application, `Worker` for synchronization a user between Workday and either Active Directory or Azure AD, `Group` for synchronizing a group between Azure AD and a third-party application.
        """
        return pulumi.get(self, "object_type_name")

    @object_type_name.setter
    def object_type_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "object_type_name", value)


if not MYPY:
    class SynchronizationJobScheduleArgsDict(TypedDict):
        expiration: NotRequired[pulumi.Input[str]]
        """
        Date and time when this job will expire, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`).
        """
        interval: NotRequired[pulumi.Input[str]]
        """
        The interval between synchronization iterations ISO8601. E.g. PT40M run every 40 minutes.
        """
        state: NotRequired[pulumi.Input[str]]
        """
        State of the job.
        """
elif False:
    SynchronizationJobScheduleArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class SynchronizationJobScheduleArgs:
    def __init__(__self__, *,
                 expiration: Optional[pulumi.Input[str]] = None,
                 interval: Optional[pulumi.Input[str]] = None,
                 state: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] expiration: Date and time when this job will expire, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`).
        :param pulumi.Input[str] interval: The interval between synchronization iterations ISO8601. E.g. PT40M run every 40 minutes.
        :param pulumi.Input[str] state: State of the job.
        """
        if expiration is not None:
            pulumi.set(__self__, "expiration", expiration)
        if interval is not None:
            pulumi.set(__self__, "interval", interval)
        if state is not None:
            pulumi.set(__self__, "state", state)

    @property
    @pulumi.getter
    def expiration(self) -> Optional[pulumi.Input[str]]:
        """
        Date and time when this job will expire, formatted as an RFC3339 date string (e.g. `2018-01-01T01:02:03Z`).
        """
        return pulumi.get(self, "expiration")

    @expiration.setter
    def expiration(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "expiration", value)

    @property
    @pulumi.getter
    def interval(self) -> Optional[pulumi.Input[str]]:
        """
        The interval between synchronization iterations ISO8601. E.g. PT40M run every 40 minutes.
        """
        return pulumi.get(self, "interval")

    @interval.setter
    def interval(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "interval", value)

    @property
    @pulumi.getter
    def state(self) -> Optional[pulumi.Input[str]]:
        """
        State of the job.
        """
        return pulumi.get(self, "state")

    @state.setter
    def state(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "state", value)


if not MYPY:
    class SynchronizationSecretCredentialArgsDict(TypedDict):
        key: pulumi.Input[str]
        """
        The key of the secret.
        """
        value: pulumi.Input[str]
        """
        The value of the secret.
        """
elif False:
    SynchronizationSecretCredentialArgsDict: TypeAlias = Mapping[str, Any]

@pulumi.input_type
class SynchronizationSecretCredentialArgs:
    def __init__(__self__, *,
                 key: pulumi.Input[str],
                 value: pulumi.Input[str]):
        """
        :param pulumi.Input[str] key: The key of the secret.
        :param pulumi.Input[str] value: The value of the secret.
        """
        pulumi.set(__self__, "key", key)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def key(self) -> pulumi.Input[str]:
        """
        The key of the secret.
        """
        return pulumi.get(self, "key")

    @key.setter
    def key(self, value: pulumi.Input[str]):
        pulumi.set(self, "key", value)

    @property
    @pulumi.getter
    def value(self) -> pulumi.Input[str]:
        """
        The value of the secret.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: pulumi.Input[str]):
        pulumi.set(self, "value", value)


