Microsoft 365 - Parable

Sync data from Microsoft 365 (Teams, SharePoint, etc.).

Overview
Setup Guide
Permissions
Troubleshooting

Create an Azure AD app registration to connect Parable to Microsoft 365 using OAuth 2.0 client credentials. This enables secure, automated access without user sign-in.

Data streams

This Provider Plugin defines 15 data streams.

Stream	Description	Sync
`users`	Microsoft Entra ID users	full
`calendar_events`	Calendar events by user	incremental
`messages`	Mailbox messages by user	incremental
`teams`	Microsoft Teams represented as groups	full
`team_details`	Detailed settings for each team	full
`team_calendar_events`	Team calendar events by group	incremental
`sign_in_logs`	Microsoft Entra sign-in logs	incremental
`audit_logs`	Microsoft Purview audit log records via the /beta async create-poll-fetch pattern. Uses recordTypeFilters [sharePointFileOperation, oneDrive] matching the legacy ingestion-service default.	incremental
`copilot_interactions`	Microsoft 365 Copilot user interaction audit records via the Purview /beta async create-poll-fetch pattern. Filters recordTypeFilters to CopilotInteraction (who/when/AppHost/AccessedResources). Does not include prompt or response text. Opt-in; requires AuditLogsQuery.Read.All.	incremental
`user_calendar_events`	DEPRECATED expansion tap. Duplicates the calendar_events tap with a narrower $select. The legacy ingestion-service only defines a single user-calendar tap (calendar_events). Disabled by default; retained for backward compatibility.	incremental
`channels`	Channels within each Microsoft Team	full
`channel_messages`	All channel messages across a team (including thread replies) via Teams export API	incremental
`channel_members`	Members of each Teams channel	full
`organization`	Entra organization (tenant) metadata	full
`groups`	Microsoft Entra groups (all group types, including non-Teams). Overlaps with the teams tap for groups that have resourceProvisioningOptions Team; teams remains the filtered source for Teams child fan-out.	full

App registration

What You’ll Need

Credential	What it is
Tenant ID	Azure AD tenant identifier
Client ID	Application (client) ID
Client Secret	Generated client secret

Info: Setup access in Azure. These steps require Administrator, or a colleague with equivalent permissions who can create credentials for you. If that is not you, ask your Azure administrator.

Global Administrator or Application Administrator role in Azure AD
Permission to grant admin consent for API permissions

Step 1: Access Azure Portal

Navigate to Azure Portal
Go to Azure Active Directory → App registrations
Click New registration

Step 2: Register Application

Field	Value
Name	`Parable Integration`
Supported account types	Accounts in this organizational directory only
Redirect URI	Leave blank (not needed for client credentials)

Click Register

Step 3: Note Application Details

From the Overview page, copy:

Application (client) ID
Directory (tenant) ID

Step 4: Create Client Secret

Go to Certificates & secrets
Click New client secret
Add description: Parable Integration Secret
Select expiration (recommend: 24 months)
Click Add

Warning: Copy the secret Value immediately - it won’t be shown again!

Step 5: Configure API Permissions

Go to API permissions
Click Add a permission → Microsoft Graph
Select Application permissions
Add these permissions:

Permission	Purpose
`User.Read.All`	Read all user profiles
`Directory.Read.All`	Read directory data (also covers org metadata and channel list when present)
`Team.ReadBasic.All`	Read Microsoft Teams details
`Channel.ReadBasic.All`	List Teams channels (required if Directory.Read.All is not granted)
`ChannelMessage.Read.All`	Read Teams channel messages via the Teams export API
`ChannelMember.Read.All`	Read Teams channel membership
`AuditLog.Read.All`	Read sign-in and directory audit logs
`AuditLogsQuery.Read.All`	Read Microsoft Purview audit log queries
`Mail.Read`	Read mail (if needed)
`Calendars.Read`	Read calendars (if needed)

Warning: ChannelMessage.Read.All is a protected Teams export permission. Admin consent alone is not enough: Microsoft must also approve protected-API access for your app, and your tenant needs Teams message export eligibility. See Microsoft’s Export content with the Microsoft Teams export APIs guide. Until that is in place, leave the Parable channel_messages tap disabled (it ships opt-in).

Click Grant admin consent for [Your Org]
Confirm the consent dialog

Info: All permissions should show a green checkmark indicating consent was granted. Channel / message taps that ship disabled stay off until you enable them in Parable after consent and protected-API approval succeed.

Step 7: Enter values in the form

Tenant ID, Client ID, and Client Secret: Paste the Directory (tenant) ID, Application (client) ID, and client secret value.
Click Save & test connection.

By default, Microsoft Graph application permissions can cover every user in the directory. Use Microsoft’s mailbox access guidance when your organization needs to restrict the app to an approved population.

Get Access Token

curl -X POST "https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id={CLIENT_ID}" \
  -d "client_secret={CLIENT_SECRET}" \
  -d "scope=https://graph.microsoft.com/.default" \
  -d "grant_type=client_credentials"

Test API Access

curl -H "Authorization: Bearer {ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/users?\$top=5"

Success: Success! If you received a 200 OK response with valid data, your credentials are configured correctly. You can now configure this Provider in Parable.

Tip: Enter Tenant ID, Client ID, and Client Secret in the Provider form, then click Save & test connection.

App registration

Permission	Data Accessed
`User.Read.All`	User profiles, managers, photos
`Directory.Read.All`	Groups, org hierarchy, devices; sufficient for listing channels when granted
`Team.ReadBasic.All`	Microsoft Teams names, settings, and membership counts
`Channel.ReadBasic.All`	Channel list (standard / private / shared) when Directory.Read.All is not used
`ChannelMessage.Read.All`	Channel message content via Teams export APIs (protected API; Global cloud only - not US Gov L4/L5 or China 21Vianet)
`ChannelMember.Read.All`	Teams channel member lists
`AuditLog.Read.All`	Sign-in logs, directory audits
`AuditLogsQuery.Read.All`	Purview audit log records (SharePoint/OneDrive file operations)
`Mail.Read`	Email metadata and content
`Calendars.Read`	Calendar events and availability

Info: Channel message export covers public and private channels. Shared-channel coverage follows Microsoft Graph’s getAllMessages behavior and may omit some shared-channel traffic. 1:1 and group chats are not included in this Provider version.

Tip: Rate Limits: Microsoft Graph enforces rate limits of 10,000 requests per 10 minutes per app; throttling returns 429 with Retry-After header. Parable handles rate limiting automatically with exponential backoff, but initial syncs of large datasets may take longer due to these limits.

Audit Logs

Developer identifier: audit_logsAudit Logs. Microsoft Purview audit log records via the /beta async create-poll-fetch pattern. Uses recordTypeFilters [sharePointFileOperation, oneDrive] matching the legacy ingestion-service default.

Enables: Trace SharePoint and OneDrive audit operations to the reported user, resource, operation, and event time.
Scope: Reads the records selected by Microsoft 365’s /beta/security/auditLog/queries operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The query is restricted to SharePoint file operations and OneDrive record types rather than the tenant’s complete Purview audit corpus. This stream supplies no reliable deletion signal.

Administrative Units

Developer identifier: audit_logs.administrativeUnitsAdministrative Units. Administrative units associated with the record. It preserves the nested context needed to interpret the parent audit log.

Enables: Attribute every returned administrative unit value in audit_logs.administrativeUnits to its parent audit log; keep each relationship distinct and distinguish an absent array from an explicitly empty one.
Interpretation: Microsoft 365 returns administrative units as an array of administrative unit value entries on each audit log; missing, empty, and permission-redacted arrays are not equivalent.

Audit Data

Developer identifier: audit_logs.auditDataAudit Data. Raw service-specific audit payload as a JSON object. It preserves the nested context needed to interpret the parent audit log.

Enables: Attribute audit data in audit_logs.auditData to the parent audit log; identify parent records where that nested audit data object is absent.
Interpretation: Microsoft 365 reports audit data as a nested object on each audit log; optional children may be absent from a valid response.

Audit Log Record Type

Developer identifier: audit_logs.auditLogRecordTypeAudit Log Record Type. Audit log record type (e.g. SharePointFileOperation, OneDrive). It distinguishes the provider-defined audit log record type state or classification for the audit log.

Enables: Segment audit log entries in Audit Logs by audit log record type in audit_logs.auditLogRecordType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports audit log record type as a label from its own taxonomy on each audit log; preserve unknown labels rather than mapping them by assumption.

Client IP

Developer identifier: audit_logs.clientIpClient IP. Client IP address from which the operation was performed. It supplies the provider-reported address or location facet for the audit log, not a residency determination.

Enables: Correlate audit log records that report the same network address in audit_logs.clientIp during an authorized investigation; account for shared, proxied, or translated addresses.
Interpretation: Microsoft 365 reports this as an IP network address on each audit log. It is not verified geolocation, does not identify a person by itself, and does not establish data residency.

Created Date Time

Developer identifier: audit_logs.createdDateTimeCreated Date Time. Timestamp when the audited operation occurred. It anchors the audit log on the provider’s reported timeline.

Enables: Order Audit Logs by created date time in audit_logs.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each audit log; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.

Developer identifier: audit_logs.idID. Unique identifier of the audit log record. It provides the reference needed to connect the audit log to the corresponding provider object.

Enables: Match repeated audit log entries on ID in audit_logs.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its audit log namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Object ID

Developer identifier: audit_logs.objectIdObject ID. Identifier of the object the operation acted on (e.g. file URL). It provides the reference needed to connect the audit log to the corresponding provider object.

Enables: Connect each audit log in Audit Logs to the referenced object through audit_logs.objectId; flag object ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports object ID as an identifier in its object namespace; it is not a universal identity outside Microsoft 365.

Operation

Developer identifier: audit_logs.operationOperation. Operation name (e.g. FileAccessed, FileModified). It distinguishes the provider-defined operation state or classification for the audit log.

Enables: Filter Audit Logs by the exact Microsoft 365-defined operation in audit_logs.operation and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies operation from its own taxonomy on each audit log; preserve unknown and newly introduced labels.

Organization ID

Developer identifier: audit_logs.organizationIdOrganization ID. Microsoft tenant identifier. It provides the reference needed to connect the audit log to the corresponding provider object.

Enables: Connect each audit log in Audit Logs to the referenced organization through audit_logs.organizationId; flag organization ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports organization ID as an identifier in its organization namespace; it is not a universal identity outside Microsoft 365.

Service

Developer identifier: audit_logs.serviceService. Microsoft 365 service that produced the record (e.g. SharePoint, OneDrive). It distinguishes the provider-defined service state or classification for the audit log.

Enables: Filter Audit Logs by the exact Microsoft 365-defined service in audit_logs.service and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies service from its own taxonomy on each audit log; preserve unknown and newly introduced labels.

User ID

Developer identifier: audit_logs.userIdUser ID. Object ID of the user that performed the operation. It provides the reference needed to connect the audit log to the corresponding provider object.

Enables: Connect each audit log in Audit Logs to the referenced user through audit_logs.userId; flag user ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.

User Principal Name

Developer identifier: audit_logs.userPrincipalNameUser Principal Name. UPN of the user that performed the operation. It gives the audit log a human-readable provider label while its identifier remains the stable reference.

Enables: Label each audit log with user principal name from audit_logs.userPrincipalName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports user principal name as display text for each audit log; names are mutable and are not stable identities.

User Type

Developer identifier: audit_logs.userTypeUser Type. Type of user that performed the operation. It supplies the user type profile facet used to reconcile or attribute the audit log.

Enables: Segment audit log entries in Audit Logs by user type in audit_logs.userType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports user type as a label from its own taxonomy on each audit log; preserve unknown labels rather than mapping them by assumption.

Calendar Events

Developer identifier: calendar_eventsCalendar Events. Calendar events by user.

Enables: Attribute user calendar events to organizers, attendees, calendars, time intervals, recurrence, and response state.
Scope: Reads the records selected by Microsoft 365’s /v1.0/users/{id}/calendarView operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The selected fields include bodyPreview plus event and recurrence metadata, not the complete event body or attachment bytes. This stream supplies no reliable deletion signal.

Attendees

Developer identifier: calendar_events.attendeesAttendees. List of attendees with email, name, and response status. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute each returned attendee in calendar_events.attendees to the parent calendar event; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
Interpretation: Microsoft 365 returns attendees as an array of attendee entries on each calendar event; missing, empty, and permission-redacted arrays are not equivalent.

Email Address

Developer identifier: calendar_events.attendees.emailAddressEmail Address. Email address and display name of the attendee. It preserves the nested context needed to interpret the parent calendar event.

Enables: Match repeated attendee entries on email address in calendar_events.Attendee.emailAddress; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports email address as a nested object on each attendee; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.

Address

Developer identifier: calendar_events.attendees.emailAddress.addressAddress. Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

Enables: Attribute each email address to a person or account by the exact address in calendar_events.EmailAddress.address; identify addresses that do not match the Microsoft 365 directory.
Interpretation: Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match.

Name

Developer identifier: calendar_events.attendees.emailAddress.nameName. Display name of the person or entity. It gives the email address a human-readable provider label while its identifier remains the stable reference.

Enables: Label each email address with name from calendar_events.EmailAddress.name; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.

Proposed New Time

Developer identifier: calendar_events.attendees.proposedNewTimeProposed New Time. An alternate date/time proposed by the attendee. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute proposed new time in calendar_events.Attendee.proposedNewTime to the parent calendar event; identify parent records where that nested proposed new time object is absent.
Interpretation: Microsoft 365 reports proposed new time as a nested object on each attendee; optional children may be absent from a valid response.

End

Developer identifier: calendar_events.attendees.proposedNewTime.endEnd. End of the time slot. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute end in calendar_events.TimeSlot.end to the parent calendar event; identify parent records where that nested end object is absent.
Interpretation: Microsoft 365 reports end as a nested object on each time slot; optional children may be absent from a valid response.

Date Time

Developer identifier: calendar_events.attendees.proposedNewTime.end.dateTimeDate Time. Date and time in ISO 8601 format without timezone offset (e.g. 2024-01-15T09:00:00.0000000). It anchors the calendar event on the provider’s reported timeline.

Enables: Order Calendar Events by date time in calendar_events.DateTimeTimeZone.dateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports date time as a timestamp on each date time time zone; timezone and precision follow this API field, and absence is not an inferred event time.

Time Zone

Developer identifier: calendar_events.attendees.proposedNewTime.end.timeZoneTime Zone. IANA or Windows time zone identifier (e.g. Pacific Standard Time, America/New_York). It is needed to interpret companion dates and times for the date time time zone in the provider’s intended zone.

Enables: Apply the zone in calendar_events.DateTimeTimeZone.timeZone when converting the calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports time zone as a timezone identifier for each date time time zone; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Start

Developer identifier: calendar_events.attendees.proposedNewTime.startStart. Start of the time slot. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute start in calendar_events.TimeSlot.start to the parent calendar event; identify parent records where that nested start object is absent.
Interpretation: Microsoft 365 reports start as a nested object on each time slot; optional children may be absent from a valid response.

Status

Developer identifier: calendar_events.attendees.statusStatus. The attendee’s response status for the event. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute status in calendar_events.Attendee.status to the parent calendar event; identify parent records where that nested status object is absent.
Interpretation: Microsoft 365 reports status as a nested object on each attendee; optional children may be absent from a valid response.

Response

Developer identifier: calendar_events.attendees.status.responseResponse. The response type. It distinguishes the provider-defined response state or classification for the response status.

Enables: Segment response status entries in Calendar Events by response in calendar_events.ResponseStatus.response; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports response as a label from its own taxonomy on each response status; preserve unknown labels rather than mapping them by assumption.

Time

Developer identifier: calendar_events.attendees.status.timeTime. Date and time the response was submitted. It anchors the calendar event on the provider’s reported timeline.

Enables: Order Calendar Events by time in calendar_events.ResponseStatus.time and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports time as a timestamp on each response status; timezone and precision follow this API field, and absence is not an inferred event time.

Type

Developer identifier: calendar_events.attendees.typeType. Attendee type: required, optional, or resource. It distinguishes the provider-defined type state or classification for the attendee.

Enables: Segment attendee entries in Calendar Events by type in calendar_events.Attendee.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each attendee; preserve unknown labels rather than mapping them by assumption.

Body Preview

Developer identifier: calendar_events.bodyPreviewBody Preview. Short text preview of the event body content. It defines the content surface available for this calendar event.

Enables: Locate calendar event records whose body preview in calendar_events.bodyPreview contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
Interpretation: This is an excerpt supplied by the provider, not the complete body or an attachment.

Calendar

Developer identifier: calendar_events.calendarCalendar. The calendar navigation property or calendar ID associated with the event. It identifies the related provider object that gives the calendar event its parent, owner, or container context.

Enables: Connect each calendar event to the related calendar in calendar_events.calendar and verify that the referenced provider object resolves in the expected parent or container.
Interpretation: Microsoft 365 reports calendar as relationship context on each calendar event; resolve it in the named provider namespace rather than by display text alone.

Categories

Developer identifier: calendar_events.categoriesCategories. User-assigned categories/labels on the event. It preserves the nested context needed to interpret the parent calendar event.

Enables: Compare the exact Microsoft 365-configured categories set in calendar_events.categories for each calendar event; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns categories as an array of category value entries on each calendar event; missing, empty, and permission-redacted arrays are not equivalent.

Change Key

Developer identifier: calendar_events.changeKeyChange Key. Version identifier of the event; changes each time the event is modified. It provides the reference needed to connect the calendar event to the corresponding provider object.

Enables: Connect each calendar event in Calendar Events to the referenced change through calendar_events.changeKey; flag change key values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports change key as an identifier in its change namespace; it is not a universal identity outside Microsoft 365.

Created Date Time

Developer identifier: calendar_events.createdDateTimeCreated Date Time. Date and time the event was created in ISO 8601 format. It anchors the calendar event on the provider’s reported timeline.

Enables: Order Calendar Events by created date time in calendar_events.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each calendar event; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.

End

Developer identifier: calendar_events.endEnd. End date/time and timezone of the event. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute end in calendar_events.end to the parent calendar event; identify parent records where that nested end object is absent.
Interpretation: Microsoft 365 reports end as a nested object on each calendar event; optional children may be absent from a valid response.

I Cal U ID

Developer identifier: calendar_events.iCalUIdI Cal U ID. Unique identifier for the event across calendars. Stable when the event moves between calendars, unlike ID. It provides the reference needed to connect the calendar event to the corresponding provider object.

Enables: Connect each calendar event in Calendar Events to the referenced i cal u through calendar_events.iCalUId; flag i cal u ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports i cal u ID as an identifier in its i cal u namespace; it is not a universal identity outside Microsoft 365.

Developer identifier: calendar_events.idID. Unique identifier for the event. It provides the reference needed to connect the calendar event to the corresponding provider object.

Enables: Match repeated calendar event entries on ID in calendar_events.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its calendar event namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Importance

Developer identifier: calendar_events.importanceImportance. Importance level of the event. It distinguishes the provider-defined importance state or classification for the calendar event.

Enables: Segment calendar event entries in Calendar Events by importance in calendar_events.importance; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports importance as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.

Is All Day

Developer identifier: calendar_events.isAllDayIs All Day. Whether the event lasts all day. It distinguishes the provider-defined is all day state or classification for the calendar event.

Enables: Filter Calendar Events by whether the event lasts all day in calendar_events.isAllDay; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the event lasts all day as a boolean on each calendar event; a missing field is unknown, not false.

Is Cancelled

Developer identifier: calendar_events.isCancelledIs Cancelled. Whether the event has been cancelled. It distinguishes the provider-defined is cancelled state or classification for the calendar event.

Enables: Filter Calendar Events by whether the event has been cancelled in calendar_events.isCancelled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the event has been cancelled as a boolean on each calendar event; a missing field is unknown, not false.

Is Online Meeting

Developer identifier: calendar_events.isOnlineMeetingIs Online Meeting. Whether the event is an online meeting. It distinguishes the provider-defined is online meeting state or classification for the calendar event.

Enables: Filter Calendar Events by whether the event is an online meeting in calendar_events.isOnlineMeeting; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the event is an online meeting as a boolean on each calendar event; a missing field is unknown, not false.

Last Modified Date Time

Developer identifier: calendar_events.lastModifiedDateTimeLast Modified Date Time. Date and time the event was last modified in ISO 8601 format. Used as incremental sync cursor. It anchors the calendar event on the provider’s reported timeline.

Enables: Order Calendar Events by last modified date time in calendar_events.lastModifiedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports last modified date time as a timestamp on each calendar event; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.

Location

Developer identifier: calendar_events.locationLocation. Location of the event. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute location in calendar_events.location to the parent calendar event; identify parent records where that nested location object is absent.
Interpretation: Microsoft 365 reports location as a nested object on each calendar event; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.

Address

Developer identifier: calendar_events.location.addressAddress. Physical street address of the location. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute address in calendar_events.Location.address to the parent calendar event; identify parent records where that nested address object is absent.
Interpretation: Microsoft 365 reports address as a nested object on each location; optional children may be absent from a valid response.

City

Developer identifier: calendar_events.location.address.cityCity. City. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Calendar Events by city in calendar_events.PhysicalAddress.city without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports city as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.

Country Or Region

Developer identifier: calendar_events.location.address.countryOrRegionCountry Or Region. Country or region. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Calendar Events by country or region in calendar_events.PhysicalAddress.countryOrRegion without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports country or region as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.

Postal Code

Developer identifier: calendar_events.location.address.postalCodePostal Code. Postal/ZIP code. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Calendar Events by the exact postal code in calendar_events.PhysicalAddress.postalCode while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports postal code as an address or location facet on each physical address; it does not establish verified geolocation or data residency.

State

Developer identifier: calendar_events.location.address.stateState. State or province. It distinguishes the provider-defined state state or classification for the physical address.

Enables: Group Calendar Events by state in calendar_events.PhysicalAddress.state without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports state as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.

Street

Developer identifier: calendar_events.location.address.streetStreet. Street address. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Calendar Events by the exact street in calendar_events.PhysicalAddress.street while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports street as an address or location facet on each physical address; it does not establish verified geolocation or data residency.

Coordinates

Developer identifier: calendar_events.location.coordinatesCoordinates. Geographic coordinates and elevation of the location. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute coordinates in calendar_events.Location.coordinates to the parent calendar event; identify parent records where that nested coordinates object is absent.
Interpretation: Microsoft 365 reports coordinates as a nested object on each location; optional children may be absent from a valid response.

Accuracy

Developer identifier: calendar_events.location.coordinates.accuracyAccuracy. Accuracy of the coordinates in meters. It supplies the accuracy measure for the geo coordinate at the provider’s declared unit and grain.

Enables: Measure accuracy through calendar_events.GeoCoordinates.accuracy for each geo coordinate and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.

Altitude

Developer identifier: calendar_events.location.coordinates.altitudeAltitude. Altitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Calendar Events by the exact altitude in calendar_events.GeoCoordinates.altitude while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports altitude as an address or location facet on each geo coordinate; it does not establish verified geolocation or data residency.

Altitude Accuracy

Developer identifier: calendar_events.location.coordinates.altitudeAccuracyAltitude Accuracy. Accuracy of the altitude in meters. It supplies the altitude accuracy measure for the geo coordinate at the provider’s declared unit and grain.

Enables: Measure altitude accuracy through calendar_events.GeoCoordinates.altitudeAccuracy for each geo coordinate and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports altitude accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.

Latitude

Developer identifier: calendar_events.location.coordinates.latitudeLatitude. Latitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Calendar Events by latitude in calendar_events.GeoCoordinates.latitude without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports latitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.

Longitude

Developer identifier: calendar_events.location.coordinates.longitudeLongitude. Longitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Calendar Events by longitude in calendar_events.GeoCoordinates.longitude without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports longitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.

Display Name

Developer identifier: calendar_events.location.displayNameDisplay Name. Display name of the location. It distinguishes the provider-defined display name state or classification for the location.

Enables: Label each location with display name from calendar_events.Location.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each location; names are mutable and are not stable identities.

Location Email Address

Developer identifier: calendar_events.location.locationEmailAddressLocation Email Address. Email address associated with the location (e.g. a conference room). It supplies the provider-reported address or location facet for the location, not a residency determination.

Enables: Attribute each location to a person or account by the exact location email address in calendar_events.Location.locationEmailAddress; identify addresses that do not match the Microsoft 365 directory.
Interpretation: Microsoft 365 reports location email address as an address on each location; aliases, casing, and unverified addresses can prevent a one-to-one person match.

Location Type

Developer identifier: calendar_events.location.locationTypeLocation Type. Type of location. It distinguishes the provider-defined location type state or classification for the location.

Enables: Segment location entries in Calendar Events by location type in calendar_events.Location.locationType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports location type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.

Location URI

Developer identifier: calendar_events.location.locationUriLocation URI. URI representing the location. It supplies the provider-reported address or location facet for the location, not a residency determination.

Enables: Associate each location with the resource identified by location URI in calendar_events.Location.locationUri; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports location URI as a resource locator for each location; access still depends on viewer permissions and the URL may expire or change.

Unique ID

Developer identifier: calendar_events.location.uniqueIdUnique ID. Unique identifier of the location, if available. It provides the reference needed to connect the calendar event to the corresponding provider object.

Enables: Connect each location in Calendar Events to the referenced unique through calendar_events.Location.uniqueId; flag unique ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports unique ID as an identifier in its unique namespace; it is not a universal identity outside Microsoft 365.

Unique ID Type

Developer identifier: calendar_events.location.uniqueIdTypeUnique ID Type. Type of the unique ID for the location. It distinguishes the provider-defined unique ID type state or classification for the location.

Enables: Segment location entries in Calendar Events by unique ID type in calendar_events.Location.uniqueIdType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports unique ID type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.

Online Meeting

Developer identifier: calendar_events.onlineMeetingOnline Meeting. Details for joining an online meeting, including join URL and conference ID. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute online meeting in calendar_events.onlineMeeting to the parent calendar event; identify parent records where that nested online meeting object is absent.
Interpretation: Microsoft 365 reports online meeting as a nested object on each calendar event; optional children may be absent from a valid response.

Conference ID

Developer identifier: calendar_events.onlineMeeting.conferenceIdConference ID. Conference ID for dial-in access. It provides the reference needed to connect the calendar event to the corresponding provider object.

Enables: Connect each online meeting info in Calendar Events to the referenced conference through calendar_events.OnlineMeetingInfo.conferenceId; flag conference ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports conference ID as an identifier in its conference namespace; it is not a universal identity outside Microsoft 365.

Dialin URL

Developer identifier: calendar_events.onlineMeeting.dialinUrlDialin URL. URL with dial-in information. It locates the provider resource or path associated with the online meeting info.

Enables: Associate each online meeting info with the resource identified by dialin URL in calendar_events.OnlineMeetingInfo.dialinUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports dialin URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.

Join URL

Developer identifier: calendar_events.onlineMeeting.joinUrlJoin URL. URL to join the online meeting. It locates the provider resource or path associated with the online meeting info.

Enables: Associate each online meeting info with the resource identified by join URL in calendar_events.OnlineMeetingInfo.joinUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports join URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.

Phones

Developer identifier: calendar_events.onlineMeeting.phonesPhones. Phone numbers associated with the online meeting. It preserves the nested context needed to interpret the parent calendar event.

Enables: Reconcile each returned online meeting phone in calendar_events.OnlineMeetingInfo.phones with the parent calendar event’s provider profile; preserve distinct aliases, contact points, and organization attributes.
Interpretation: Microsoft 365 returns phones as an array of online meeting phone entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.

Number

Developer identifier: calendar_events.onlineMeeting.phones.numberNumber. The phone number. It supplies the number measure for the online meeting phone at the provider’s declared unit and grain.

Enables: Measure number through calendar_events.OnlineMeetingPhone.number for each online meeting phone and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports number as a measure on each online meeting phone; compare only records with the same unit and aggregation grain.

Type

Developer identifier: calendar_events.onlineMeeting.phones.typeType. Type of phone number (e.g. toll, tollFree). It distinguishes the provider-defined type state or classification for the online meeting phone.

Enables: Segment online meeting phone entries in Calendar Events by type in calendar_events.OnlineMeetingPhone.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each online meeting phone; preserve unknown labels rather than mapping them by assumption.

Quick Dial

Developer identifier: calendar_events.onlineMeeting.quickDialQuick Dial. Quick dial code for the meeting. It supplies the sensitive provider access code needed to join the online meeting info, not a stable record identifier.

Enables: Reconcile calendar_events.OnlineMeetingInfo.quickDial with the same conference entry point or meeting instructions when validating join access; handle it as sensitive access metadata.
Interpretation: Microsoft 365 returns quick dial as meeting or conference access metadata on each online meeting info; it can rotate and does not identify the meeting by itself.

Toll Free Numbers

Developer identifier: calendar_events.onlineMeeting.tollFreeNumbersToll Free Numbers. List of toll-free phone numbers for dial-in. It preserves the nested context needed to interpret the parent calendar event.

Enables: Reconcile each returned toll free number value in calendar_events.OnlineMeetingInfo.tollFreeNumbers with the parent calendar event’s provider profile; preserve distinct aliases, contact points, and organization attributes.
Interpretation: Microsoft 365 returns toll free numbers as an array of toll free number value entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.

Toll Number

Developer identifier: calendar_events.onlineMeeting.tollNumberToll Number. Toll phone number for dial-in. It supplies the toll number measure for the online meeting info at the provider’s declared unit and grain.

Enables: Measure toll number through calendar_events.OnlineMeetingInfo.tollNumber for each online meeting info and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports toll number as a measure on each online meeting info; compare only records with the same unit and aggregation grain.

Online Meeting URL

Developer identifier: calendar_events.onlineMeetingUrlOnline Meeting URL. URL for joining the online meeting (legacy property). It locates the provider resource or path associated with the calendar event.

Enables: Associate each calendar event with the resource identified by online meeting URL in calendar_events.onlineMeetingUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports online meeting URL as a resource locator for each calendar event; access still depends on viewer permissions and the URL may expire or change.

Organizer

Developer identifier: calendar_events.organizerOrganizer. Organizer of the event with email and name. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute organizer in calendar_events.organizer to the parent calendar event; identify parent records where that nested organizer object is absent.
Interpretation: Microsoft 365 reports organizer as a nested object on each calendar event; optional children may be absent from a valid response.

Email Address

Developer identifier: calendar_events.organizer.emailAddressEmail Address. Email address and display name of the recipient. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute email address in calendar_events.Recipient.emailAddress to the parent calendar event; identify parent records where that nested email address object is absent.
Interpretation: Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response.

Original End Time Zone

Developer identifier: calendar_events.originalEndTimeZoneOriginal End Time Zone. End time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the calendar event in the provider’s intended zone.

Enables: Apply the zone in calendar_events.originalEndTimeZone when converting the calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports original end time zone as a timezone identifier for each calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Original Start Time Zone

Developer identifier: calendar_events.originalStartTimeZoneOriginal Start Time Zone. Start time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the calendar event in the provider’s intended zone.

Enables: Apply the zone in calendar_events.originalStartTimeZone when converting the calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports original start time zone as a timezone identifier for each calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Recurrence

Developer identifier: calendar_events.recurrenceRecurrence. Recurrence pattern and range for recurring events. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute recurrence in calendar_events.recurrence to the parent calendar event; identify parent records where that nested recurrence object is absent.
Interpretation: Microsoft 365 reports recurrence as a nested object on each calendar event; optional children may be absent from a valid response.

Pattern

Developer identifier: calendar_events.recurrence.patternPattern. The frequency and rules of the recurrence. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute pattern in calendar_events.PatternedRecurrence.pattern to the parent calendar event; identify parent records where that nested pattern object is absent.
Interpretation: Microsoft 365 reports pattern as a nested object on each patterned recurrence; optional children may be absent from a valid response.

Day Of Month

Developer identifier: calendar_events.recurrence.pattern.dayOfMonthDay Of Month. Day of the month for absoluteMonthly/absoluteYearly patterns. It supplies the day of month measure for the recurrence pattern at the provider’s declared unit and grain.

Enables: Measure day of month through calendar_events.RecurrencePattern.dayOfMonth for each recurrence pattern and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports day of month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.

Days Of Week

Developer identifier: calendar_events.recurrence.pattern.daysOfWeekDays Of Week. Days of the week the event occurs on. It preserves the nested context needed to interpret the parent calendar event.

Enables: Compare the exact Microsoft 365-configured days of week set in calendar_events.RecurrencePattern.daysOfWeek for each recurrence pattern; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns days of week as an array of recurrence pattern day of week enum entries on each recurrence pattern; missing, empty, and permission-redacted arrays are not equivalent.

First Day Of Week

Developer identifier: calendar_events.recurrence.pattern.firstDayOfWeekFirst Day Of Week. First day of the week for weekly patterns. It distinguishes the provider-defined first day of week state or classification for the recurrence pattern.

Enables: Segment recurrence pattern entries in Calendar Events by first day of week in calendar_events.RecurrencePattern.firstDayOfWeek; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports first day of week as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.

Index

Developer identifier: calendar_events.recurrence.pattern.indexIndex. Week index for relativeMonthly/relativeYearly patterns. It distinguishes the provider-defined index state or classification for the recurrence pattern.

Enables: Segment recurrence pattern entries in Calendar Events by index in calendar_events.RecurrencePattern.index; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports index as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.

Interval

Developer identifier: calendar_events.recurrence.pattern.intervalInterval. Number of units between occurrences (e.g. every 2 weeks). It supplies the interval boundary, band, or unit needed to interpret the companion measure.

Enables: Interpret calendar_events.RecurrencePattern.interval with its companion minimum, maximum, interval, or unit before comparing the interval across like-for-like records.
Interpretation: Microsoft 365 reports interval as a boundary, band, interval, or unit on each recurrence pattern; it is meaningful only with its companion measure and provider scale.

Month

Developer identifier: calendar_events.recurrence.pattern.monthMonth. Month in which the event occurs (1-12), for yearly patterns. It supplies the month measure for the recurrence pattern at the provider’s declared unit and grain.

Enables: Measure month through calendar_events.RecurrencePattern.month for each recurrence pattern and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.

Type

Developer identifier: calendar_events.recurrence.pattern.typeType. The recurrence pattern type. It distinguishes the provider-defined type state or classification for the recurrence pattern.

Enables: Segment recurrence pattern entries in Calendar Events by type in calendar_events.RecurrencePattern.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.

Range

Developer identifier: calendar_events.recurrence.rangeRange. The duration/bounds of the recurrence. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute range in calendar_events.PatternedRecurrence.range to the parent calendar event; identify parent records where that nested range object is absent.
Interpretation: Microsoft 365 reports range as a nested object on each patterned recurrence; optional children may be absent from a valid response.

End Date

Developer identifier: calendar_events.recurrence.range.endDateEnd Date. End date of the recurrence range (YYYY-MM-DD). Used when type is endDate. It anchors the calendar event on the provider’s reported timeline.

Enables: Filter Calendar Events by end date in calendar_events.RecurrenceRange.endDate; pair that boundary with the corresponding start before measuring elapsed time.
Interpretation: Microsoft 365 reports end date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.

Number Of Occurrences

Developer identifier: calendar_events.recurrence.range.numberOfOccurrencesNumber Of Occurrences. Number of occurrences. Used when type is numbered. It supplies the number of occurrences measure for the recurrence range at the provider’s declared unit and grain.

Enables: Measure number of occurrences through calendar_events.RecurrenceRange.numberOfOccurrences for each recurrence range and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports number of occurrences as a measure on each recurrence range; compare only records with the same unit and aggregation grain.

Recurrence Time Zone

Developer identifier: calendar_events.recurrence.range.recurrenceTimeZoneRecurrence Time Zone. Time zone for the start and end dates. It is needed to interpret companion dates and times for the recurrence range in the provider’s intended zone.

Enables: Apply the zone in calendar_events.RecurrenceRange.recurrenceTimeZone when converting the calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports recurrence time zone as a timezone identifier for each recurrence range; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Start Date

Developer identifier: calendar_events.recurrence.range.startDateStart Date. Start date of the recurrence range (YYYY-MM-DD). It anchors the calendar event on the provider’s reported timeline.

Enables: Filter Calendar Events by start date in calendar_events.RecurrenceRange.startDate; pair that boundary with the corresponding end before measuring elapsed time.
Interpretation: Microsoft 365 reports start date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.

Type

Developer identifier: calendar_events.recurrence.range.typeType. The recurrence range type. It distinguishes the provider-defined type state or classification for the recurrence range.

Enables: Segment recurrence range entries in Calendar Events by type in calendar_events.RecurrenceRange.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each recurrence range; preserve unknown labels rather than mapping them by assumption.

Response Status

Developer identifier: calendar_events.responseStatusResponse Status. The response status and time of the current user for this event. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute response status in calendar_events.responseStatus to the parent calendar event; identify parent records where that nested response status object is absent.
Interpretation: Microsoft 365 reports response status as a nested object on each calendar event; optional children may be absent from a valid response.

Sensitivity

Developer identifier: calendar_events.sensitivitySensitivity. Sensitivity level of the event. It distinguishes the provider-defined sensitivity state or classification for the calendar event.

Enables: Segment calendar event entries in Calendar Events by sensitivity in calendar_events.sensitivity; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports sensitivity as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.

Series Master ID

Developer identifier: calendar_events.seriesMasterIdSeries Master ID. The ID of the recurring series master event, if this event is part of a recurring series. It provides the reference needed to connect the calendar event to the corresponding provider object.

Enables: Connect each calendar event in Calendar Events to the referenced series master through calendar_events.seriesMasterId; flag series master ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports series master ID as an identifier in its series master namespace; it is not a universal identity outside Microsoft 365.

Show As

Developer identifier: calendar_events.showAsShow As. Free/busy status shown during the event. It distinguishes the provider-defined show as state or classification for the calendar event.

Enables: Segment calendar event entries in Calendar Events by show as in calendar_events.showAs; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports show as as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.

Start

Developer identifier: calendar_events.startStart. Start date/time and timezone of the event. It preserves the nested context needed to interpret the parent calendar event.

Enables: Attribute start in calendar_events.start to the parent calendar event; identify parent records where that nested start object is absent.
Interpretation: Microsoft 365 reports start as a nested object on each calendar event; optional children may be absent from a valid response.

Subject

Developer identifier: calendar_events.subjectSubject. Subject/title of the calendar event. It defines the content surface available for this calendar event.

Enables: Locate calendar event records by subject in calendar_events.subject; attribute each text match to its parent calendar event and, when present, its reported author.
Interpretation: Microsoft 365 supplies subject as text on each calendar event; referenced files or media are not implied unless explicitly represented.

Type

Developer identifier: calendar_events.typeType. The event type: singleInstance, occurrence, exception, or seriesMaster. It distinguishes the provider-defined type state or classification for the calendar event.

Enables: Segment calendar event entries in Calendar Events by type in calendar_events.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.

User ID

Developer identifier: calendar_events.user_idUser ID. Parent user reference copied into each calendar event because the child operation does not return that relationship. It provides the reference needed to connect the calendar event to the corresponding provider object.

Enables: Connect each calendar event in Calendar Events to the referenced user through calendar_events.user_id; flag user ID values that do not resolve in that provider namespace.
Interpretation: Parable copies user ID from the parent traversal record into each calendar event; the child Microsoft 365 operation does not return it.

Web Link

Developer identifier: calendar_events.webLinkWeb Link. URL to open the event in Outlook on the web. It locates the provider resource or path associated with the calendar event.

Enables: Associate each calendar event with the resource identified by web link in calendar_events.webLink; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports web link as a resource locator for each calendar event; access still depends on viewer permissions and the URL may expire or change.

Channel Members

Developer identifier: channel_membersChannel Members. Members of each Teams channel.

Enables: Match each Teams channel membership to the channel, user, roles, and provider membership identifier.
Scope: Reads the records selected by Microsoft 365’s /v1.0/teams/{team_id}/channels/{id}/members operation as a snapshot stream using full synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

Channel ID

Developer identifier: channel_members.channel_idChannel ID. Parent channel reference copied into each channel member because the child operation does not return that relationship. It provides the reference needed to connect the channel member to the corresponding provider object.

Enables: Connect each channel member in Channel Members to the referenced channel through channel_members.channel_id; flag channel ID values that do not resolve in that provider namespace.
Interpretation: Parable copies channel ID from the parent traversal record into each channel member; the child Microsoft 365 operation does not return it.

Display Name

Developer identifier: channel_members.displayNameDisplay Name. Display name of the member. It distinguishes the provider-defined display name state or classification for the channel member.

Enables: Label each channel member with display name from channel_members.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each channel member; names are mutable and are not stable identities.

Developer identifier: channel_members.emailEmail. Email address of the member when present. It supplies the provider-reported address or location facet for the channel member, not a residency determination.

Enables: Attribute each channel member to a person or account by the exact email in channel_members.email; identify addresses that do not match the Microsoft 365 directory.
Interpretation: Microsoft 365 reports email as an address on each channel member; aliases, casing, and unverified addresses can prevent a one-to-one person match. A connector directive maps this field to a person’s email identity.

Developer identifier: channel_members.idID. Opaque membership ID. It provides the reference needed to connect the channel member to the corresponding provider object.

Enables: Connect each channel member in Channel Members to the referenced channel member through channel_members.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its channel member namespace; it is not a universal identity outside Microsoft 365.

Membership Key

Developer identifier: channel_members.membership_keyMembership Key. Synthetic primary key hashing injected channel_id and wire membership ID. Graph membership IDs are opaque and can collide across channels for the same user. It provides the reference needed to connect the channel member to the corresponding provider object.

Enables: Match repeated channel member entries on membership key in channel_members.membership_key; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports membership key as an identifier in its membership namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Roles

Developer identifier: channel_members.rolesRoles. Roles of the member in the channel (e.g. owner, guest). It preserves the nested context needed to interpret the parent channel member.

Enables: Compare the exact Microsoft 365-configured roles set in channel_members.roles for each channel member; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns roles as an array of role value entries on each channel member; missing, empty, and permission-redacted arrays are not equivalent.

Team ID

Developer identifier: channel_members.team_idTeam ID. Parent team reference copied into each channel member because the child operation does not return that relationship. It provides the reference needed to connect the channel member to the corresponding provider object.

Enables: Connect each channel member in Channel Members to the referenced team through channel_members.team_id; flag team ID values that do not resolve in that provider namespace.
Interpretation: Parable copies team ID from the parent traversal record into each channel member; the child Microsoft 365 operation does not return it.

Tenant ID

Developer identifier: channel_members.tenantIdTenant ID. Tenant ID of the member. It provides the reference needed to connect the channel member to the corresponding provider object.

Enables: Connect each channel member in Channel Members to the referenced tenant through channel_members.tenantId; flag tenant ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.

User ID

Developer identifier: channel_members.userIdUser ID. Entra user ID of the member. It provides the reference needed to connect the channel member to the corresponding provider object.

Enables: Connect each channel member in Channel Members to the referenced user through channel_members.userId; flag user ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365. A connector directive maps this field to account identity.

Visible History Start Date Time

Developer identifier: channel_members.visibleHistoryStartDateTimeVisible History Start Date Time. Earliest message history visible to this member, when set. It anchors the channel member on the provider’s reported timeline.

Enables: Filter Channel Members by visible history start date time in channel_members.visibleHistoryStartDateTime; pair that boundary with the corresponding end before measuring elapsed time.
Interpretation: Microsoft 365 reports visible history start date time as a timestamp on each channel member; timezone and precision follow this API field, and absence is not an inferred event time.

Channel Messages

Developer identifier: channel_messagesChannel Messages. All channel messages across a team (including thread replies) via Teams export API.

Enables: Attribute Teams channel posts and thread replies to their channel, author, mentions, and timestamps.
Scope: Reads the records selected by Microsoft 365’s /v1.0/teams/{id}/channels/getAllMessages operation as an event stream using incremental synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. Message bodies and message-level attachment or mention metadata may be present, but binary attachment content is not fetched. This stream supplies no reliable deletion signal.

Attachments

Developer identifier: channel_messages.attachmentsAttachments. Attachments on the message. It preserves the nested context needed to interpret the parent channel message.

Enables: Associate each returned chat message attachment metadata entry in channel_messages.attachments with the parent channel message; inventory the reference without assuming file, recording, or attachment bytes are present.
Interpretation: Microsoft 365 returns attachments as file, recording, or attachment metadata on each channel message; the array does not imply that binary content was collected. This field is metadata or a reference for the file or attachment; it does not by itself include binary content.

Content

Developer identifier: channel_messages.attachments.contentContent. The provider-reported content for each chat message attachment in Channel Messages. It defines the content surface available for this channel message.

Enables: Locate chat message attachment records by content in channel_messages.ChatMessageAttachment.content; attribute each text match to its parent channel message and, when present, its reported author.
Interpretation: This is attachment or file metadata; it does not by itself include the referenced file bytes. This stream treats the file or attachment as metadata and references; binary bytes are not included.

Content Type

Developer identifier: channel_messages.attachments.contentTypeContent Type. The provider-reported content type for each chat message attachment in Channel Messages. It supplies the returned content type text needed to understand the chat message attachment in context.

Enables: Segment chat message attachment entries in Channel Messages by content type in channel_messages.ChatMessageAttachment.contentType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports content type as a label from its own taxonomy on each chat message attachment; preserve unknown labels rather than mapping them by assumption. This stream treats the file or attachment as metadata and references; binary bytes are not included.

Content URL

Developer identifier: channel_messages.attachments.contentUrlContent URL. ContentUrl for the attachment. It locates the provider resource or path associated with the chat message attachment.

Enables: Associate each chat message attachment with the resource identified by content URL in channel_messages.ChatMessageAttachment.contentUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports content URL as a resource locator for each chat message attachment; access still depends on viewer permissions and the URL may expire or change. This stream treats the file or attachment as metadata and references; binary bytes are not included.

Developer identifier: channel_messages.attachments.idID. The provider-reported ID for each chat message attachment in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Match repeated chat message attachment entries on ID in channel_messages.ChatMessageAttachment.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its chat message attachment namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key. This stream treats the file or attachment as metadata and references; binary bytes are not included.

Name

Developer identifier: channel_messages.attachments.nameName. The provider-reported name for each chat message attachment in Channel Messages. It gives the chat message attachment a human-readable provider label while its identifier remains the stable reference.

Enables: Label each chat message attachment with name from channel_messages.ChatMessageAttachment.name; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports name as display text for each chat message attachment; names are mutable and are not stable identities. This stream treats the file or attachment as metadata and references; binary bytes are not included.

Thumbnail URL

Developer identifier: channel_messages.attachments.thumbnailUrlThumbnail URL. ThumbnailUrl for the attachment. It locates the provider resource or path associated with the chat message attachment.

Enables: Associate each chat message attachment with the resource identified by thumbnail URL in channel_messages.ChatMessageAttachment.thumbnailUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports thumbnail URL as a resource locator for each chat message attachment; access still depends on viewer permissions and the URL may expire or change. This stream treats the file or attachment as metadata and references; binary bytes are not included.

Body

Developer identifier: channel_messages.bodyBody. Message body content. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute body in channel_messages.body to the parent channel message; identify parent records where that nested body object is absent.
Interpretation: Microsoft 365 reports body as a nested object on each channel message; optional children may be absent from a valid response.

Content

Developer identifier: channel_messages.body.contentContent. Body content. It defines the content surface available for this channel message.

Enables: Locate chat message body records by content in channel_messages.ChatMessageBody.content; attribute each text match to its parent channel message and, when present, its reported author.
Interpretation: Microsoft 365 supplies content as text on each chat message body; referenced files or media are not implied unless explicitly represented.

Content Type

Developer identifier: channel_messages.body.contentTypeContent Type. Content type: text or html. It supplies the returned content type text needed to understand the chat message body in context.

Enables: Segment chat message body entries in Channel Messages by content type in channel_messages.ChatMessageBody.contentType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports content type as a label from its own taxonomy on each chat message body; preserve unknown labels rather than mapping them by assumption.

Channel Identity

Developer identifier: channel_messages.channelIdentityChannel Identity. Team and channel identity for this message. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute channel identity in channel_messages.channelIdentity to the parent channel message; identify parent records where that nested channel identity object is absent.
Interpretation: Microsoft 365 reports channel identity as a nested object on each channel message; optional children may be absent from a valid response.

Channel ID

Developer identifier: channel_messages.channelIdentity.channelIdChannel ID. Channel ID (opaque thread ID). It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each channel identity in Channel Messages to the referenced channel through channel_messages.ChannelIdentity.channelId; flag channel ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports channel ID as an identifier in its channel namespace; it is not a universal identity outside Microsoft 365.

Team ID

Developer identifier: channel_messages.channelIdentity.teamIdTeam ID. Team ID. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each channel identity in Channel Messages to the referenced team through channel_messages.ChannelIdentity.teamId; flag team ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports team ID as an identifier in its team namespace; it is not a universal identity outside Microsoft 365.

Chat ID

Developer identifier: channel_messages.chatIdChat ID. Chat ID when the message belongs to a chat rather than a channel; null for channel messages. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each channel message in Channel Messages to the referenced chat through channel_messages.chatId; flag chat ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports chat ID as an identifier in its chat namespace; it is not a universal identity outside Microsoft 365.

Created Date Time

Developer identifier: channel_messages.createdDateTimeCreated Date Time. When the message was created. It anchors the channel message on the provider’s reported timeline.

Enables: Order Channel Messages by created date time in channel_messages.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.

Deleted Date Time

Developer identifier: channel_messages.deletedDateTimeDeleted Date Time. When the message was soft-deleted, if ever. It anchors the channel message on the provider’s reported timeline.

Enables: Order Channel Messages by deleted date time in channel_messages.deletedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports deleted date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time.

ETag

Developer identifier: channel_messages.etagETag. Version stamp for the message. It is needed for conditional reads and provider-version checks, not as a stable business identifier.

Enables: Use channel_messages.etag for conditional provider reads and revision checks; pair the ETag with the channel message ID rather than joining on it.
Interpretation: Microsoft 365 returns this ETag as an opaque revision token for each channel message; it can change when the resource changes and is not a universal identifier.

From

Developer identifier: channel_messages.fromFrom. Identity of the sender. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute from in channel_messages.from to the parent channel message; identify parent records where that nested from object is absent.
Interpretation: Microsoft 365 reports from as a nested object on each channel message; optional children may be absent from a valid response.

Application

Developer identifier: channel_messages.from.applicationApplication. Application identity when the sender is an app. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute application in channel_messages.ChatMessageFrom.application to the parent channel message; identify parent records where that nested application object is absent.
Interpretation: Microsoft 365 reports application as a nested object on each chat message from; optional children may be absent from a valid response.

Application Identity Type

Developer identifier: channel_messages.from.application.applicationIdentityTypeApplication Identity Type. The provider-reported application identity type for each application in Channel Messages. It distinguishes the provider-defined application identity type state or classification for the application.

Enables: Segment application entries in Channel Messages by application identity type in channel_messages.ChatMessageFrom.application.applicationIdentityType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports application identity type as a label from its own taxonomy on each application; preserve unknown labels rather than mapping them by assumption.

Display Name

Developer identifier: channel_messages.from.application.displayNameDisplay Name. The provider-reported display name for each application in Channel Messages. It distinguishes the provider-defined display name state or classification for the application.

Enables: Label each application with display name from channel_messages.ChatMessageFrom.application.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each application; names are mutable and are not stable identities.

Developer identifier: channel_messages.from.application.idID. The provider-reported ID for each application in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each application in Channel Messages to the referenced application through channel_messages.ChatMessageFrom.application.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its application namespace; it is not a universal identity outside Microsoft 365.

Device

Developer identifier: channel_messages.from.deviceDevice. Device identity when the sender is a device. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute device in channel_messages.ChatMessageFrom.device to the parent channel message; identify parent records where that nested device object is absent.
Interpretation: Microsoft 365 reports device as a nested object on each chat message from; optional children may be absent from a valid response.

Display Name

Developer identifier: channel_messages.from.device.displayNameDisplay Name. The provider-reported display name for each device in Channel Messages. It distinguishes the provider-defined display name state or classification for the device.

Enables: Label each device with display name from channel_messages.ChatMessageFrom.device.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each device; names are mutable and are not stable identities.

Developer identifier: channel_messages.from.device.idID. The provider-reported ID for each device in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each device in Channel Messages to the referenced device through channel_messages.ChatMessageFrom.device.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its device namespace; it is not a universal identity outside Microsoft 365.

User

Developer identifier: channel_messages.from.userUser. User identity when the sender is a user. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute user in channel_messages.ChatMessageFrom.user to the parent channel message; identify parent records where that nested user object is absent.
Interpretation: Microsoft 365 reports user as a nested object on each chat message from; optional children may be absent from a valid response.

Display Name

Developer identifier: channel_messages.from.user.displayNameDisplay Name. Display name of the sender. It distinguishes the provider-defined display name state or classification for the user.

Enables: Label each user with display name from channel_messages.ChatMessageFrom.user.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each user; names are mutable and are not stable identities.

Developer identifier: channel_messages.from.user.idID. Entra user ID of the sender. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each user in Channel Messages to the referenced user through channel_messages.ChatMessageFrom.user.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.

Tenant ID

Developer identifier: channel_messages.from.user.tenantIdTenant ID. Tenant ID of the sender when present. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each user in Channel Messages to the referenced tenant through channel_messages.ChatMessageFrom.user.tenantId; flag tenant ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.

User Identity Type

Developer identifier: channel_messages.from.user.userIdentityTypeUser Identity Type. User identity type (e.g. aadUser). It supplies the user identity type profile facet used to reconcile or attribute the user.

Enables: Segment user entries in Channel Messages by user identity type in channel_messages.ChatMessageFrom.user.userIdentityType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports user identity type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.

Developer identifier: channel_messages.idID. Wire chatMessage ID (unique within its channel). It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each channel message in Channel Messages to the referenced channel message through channel_messages.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its channel message namespace; it is not a universal identity outside Microsoft 365.

Importance

Developer identifier: channel_messages.importanceImportance. Message importance: normal, high, urgent, or unknownFutureValue. It supplies the returned importance text needed to understand the channel message in context.

Enables: Search the returned importance text in channel_messages.importance and attribute each match to its parent channel message and reported author when available.
Interpretation: Microsoft 365 supplies importance as returned text on each channel message; truncation, formatting, and access boundaries can limit completeness.

Last Edited Date Time

Developer identifier: channel_messages.lastEditedDateTimeLast Edited Date Time. When the message body was last edited, if ever. It anchors the channel message on the provider’s reported timeline.

Enables: Order Channel Messages by last edited date time in channel_messages.lastEditedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports last edited date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time.

Last Modified Date Time

Developer identifier: channel_messages.lastModifiedDateTimeLast Modified Date Time. When the message was last modified. Used as incremental sync cursor. It anchors the channel message on the provider’s reported timeline.

Enables: Order Channel Messages by last modified date time in channel_messages.lastModifiedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports last modified date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.

Locale

Developer identifier: channel_messages.localeLocale. Locale of the message body. It supplies the returned locale text needed to understand the channel message in context.

Enables: Search the returned locale text in channel_messages.locale and attribute each match to its parent channel message and reported author when available.
Interpretation: Microsoft 365 supplies locale as returned text on each channel message; truncation, formatting, and access boundaries can limit completeness.

Mentions

Developer identifier: channel_messages.mentionsMentions. Mentions in the message. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute each returned chat message mention in channel_messages.mentions to the parent channel message and reconcile the reacting or mentioned users and provider symbol.
Interpretation: Microsoft 365 returns mentions as an array of chat message mention entries on each channel message; missing, empty, and permission-redacted arrays are not equivalent.

Developer identifier: channel_messages.mentions.idID. Mention index within the message. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Match repeated chat message mention entries on ID in channel_messages.ChatMessageMention.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its chat message mention namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Mentioned

Developer identifier: channel_messages.mentions.mentionedMentioned. Identity that was mentioned. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute mentioned in channel_messages.ChatMessageMention.mentioned to the parent channel message; identify parent records where that nested mentioned object is absent.
Interpretation: Microsoft 365 reports mentioned as a nested object on each chat message mention; optional children may be absent from a valid response.

Application

Developer identifier: channel_messages.mentions.mentioned.applicationApplication. The structured application details attached to each mentioned in Channel Messages. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute application in channel_messages.ChatMessageMention.mentioned.application to the parent channel message; identify parent records where that nested application object is absent.
Interpretation: Microsoft 365 reports application as a nested object on each mentioned; optional children may be absent from a valid response.

Application Identity Type

Developer identifier: channel_messages.mentions.mentioned.application.applicationIdentityTypeApplication Identity Type. The provider-reported application identity type for each application in Channel Messages. It distinguishes the provider-defined application identity type state or classification for the application.

Enables: Segment application entries in Channel Messages by application identity type in channel_messages.ChatMessageMention.mentioned.application.applicationIdentityType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports application identity type as a label from its own taxonomy on each application; preserve unknown labels rather than mapping them by assumption.

Display Name

Developer identifier: channel_messages.mentions.mentioned.application.displayNameDisplay Name. The provider-reported display name for each application in Channel Messages. It distinguishes the provider-defined display name state or classification for the application.

Enables: Label each application with display name from channel_messages.ChatMessageMention.mentioned.application.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each application; names are mutable and are not stable identities.

Developer identifier: channel_messages.mentions.mentioned.application.idID. The provider-reported ID for each application in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each application in Channel Messages to the referenced application through channel_messages.ChatMessageMention.mentioned.application.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its application namespace; it is not a universal identity outside Microsoft 365.

Conversation

Developer identifier: channel_messages.mentions.mentioned.conversationConversation. The structured conversation details attached to each mentioned in Channel Messages. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute conversation in channel_messages.ChatMessageMention.mentioned.conversation to the parent channel message; identify parent records where that nested conversation object is absent.
Interpretation: Microsoft 365 reports conversation as a nested object on each mentioned; optional children may be absent from a valid response.

Conversation Identity Type

Developer identifier: channel_messages.mentions.mentioned.conversation.conversationIdentityTypeConversation Identity Type. The provider-reported conversation identity type for each conversation in Channel Messages. It distinguishes the provider-defined conversation identity type state or classification for the conversation.

Enables: Segment conversation entries in Channel Messages by conversation identity type in channel_messages.ChatMessageMention.mentioned.conversation.conversationIdentityType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports conversation identity type as a label from its own taxonomy on each conversation; preserve unknown labels rather than mapping them by assumption.

Display Name

Developer identifier: channel_messages.mentions.mentioned.conversation.displayNameDisplay Name. The provider-reported display name for each conversation in Channel Messages. It distinguishes the provider-defined display name state or classification for the conversation.

Enables: Label each conversation with display name from channel_messages.ChatMessageMention.mentioned.conversation.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each conversation; names are mutable and are not stable identities.

Developer identifier: channel_messages.mentions.mentioned.conversation.idID. The provider-reported ID for each conversation in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each conversation in Channel Messages to the referenced conversation through channel_messages.ChatMessageMention.mentioned.conversation.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its conversation namespace; it is not a universal identity outside Microsoft 365.

User

Developer identifier: channel_messages.mentions.mentioned.userUser. The structured user details attached to each mentioned in Channel Messages. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute user in channel_messages.ChatMessageMention.mentioned.user to the parent channel message; identify parent records where that nested user object is absent.
Interpretation: Microsoft 365 reports user as a nested object on each mentioned; optional children may be absent from a valid response.

Display Name

Developer identifier: channel_messages.mentions.mentioned.user.displayNameDisplay Name. The provider-reported display name for each user in Channel Messages. It distinguishes the provider-defined display name state or classification for the user.

Enables: Label each user with display name from channel_messages.ChatMessageMention.mentioned.user.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each user; names are mutable and are not stable identities.

Developer identifier: channel_messages.mentions.mentioned.user.idID. The provider-reported ID for each user in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each user in Channel Messages to the referenced user through channel_messages.ChatMessageMention.mentioned.user.id; flag ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.

User Identity Type

Developer identifier: channel_messages.mentions.mentioned.user.userIdentityTypeUser Identity Type. The provider-reported user identity type for each user in Channel Messages. It supplies the user identity type profile facet used to reconcile or attribute the user.

Enables: Segment user entries in Channel Messages by user identity type in channel_messages.ChatMessageMention.mentioned.user.userIdentityType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports user identity type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.

Mention Text

Developer identifier: channel_messages.mentions.mentionTextMention Text. Display text of the mention. It defines the content surface available for this channel message.

Enables: Locate chat message mention records by mention text in channel_messages.ChatMessageMention.mentionText; attribute each text match to its parent channel message and, when present, its reported author.
Interpretation: Microsoft 365 supplies mention text as text on each chat message mention; referenced files or media are not implied unless explicitly represented.

Message Key

Developer identifier: channel_messages.message_keyMessage Key. Synthetic primary key hashing channelIdentity.channelId and wire ID. Graph message IDs are unique within a channel, not across channels. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Match repeated channel message entries on message key in channel_messages.message_key; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports message key as an identifier in its message namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Message Type

Developer identifier: channel_messages.messageTypeMessage Type. Message type (message, chatEvent, typing, unknownFutureValue, systemEventMessage). It supplies the returned message type text needed to understand the channel message in context.

Enables: Segment channel message entries in Channel Messages by message type in channel_messages.messageType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports message type as a label from its own taxonomy on each channel message; preserve unknown labels rather than mapping them by assumption.

Reactions

Developer identifier: channel_messages.reactionsReactions. Reactions on the message. Stored as Generic.JSON because Graph emits one object per (user, emoji); a typed child table keyed only on reactionType would silently collapse multi-user reactions. It preserves the nested context needed to interpret the parent channel message.

Enables: Attribute each returned reaction in channel_messages.reactions to the parent channel message and reconcile the reacting or mentioned users and provider symbol.
Interpretation: Microsoft 365 returns reactions as an array of reaction entries on each channel message; missing, empty, and permission-redacted arrays are not equivalent.

Reply To ID

Developer identifier: channel_messages.replyToIdReply To ID. ID of the parent root message when this record is a thread reply. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each channel message in Channel Messages to the referenced reply to through channel_messages.replyToId; flag reply to ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports reply to ID as an identifier in its reply to namespace; it is not a universal identity outside Microsoft 365.

Subject

Developer identifier: channel_messages.subjectSubject. Plaintext subject of the message. It defines the content surface available for this channel message.

Enables: Locate channel message records by subject in channel_messages.subject; attribute each text match to its parent channel message and, when present, its reported author.
Interpretation: Microsoft 365 supplies subject as text on each channel message; referenced files or media are not implied unless explicitly represented.

Summary

Developer identifier: channel_messages.summarySummary. Summary text for notifications or fallback views. It defines the content surface available for this channel message.

Enables: Locate channel message records by summary in channel_messages.summary; attribute each text match to its parent channel message and, when present, its reported author.
Interpretation: Microsoft 365 supplies summary as text on each channel message; referenced files or media are not implied unless explicitly represented. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.

Team ID

Developer identifier: channel_messages.team_idTeam ID. Parent team reference copied into each channel message because the child operation does not return that relationship. It provides the reference needed to connect the channel message to the corresponding provider object.

Enables: Connect each channel message in Channel Messages to the referenced team through channel_messages.team_id; flag team ID values that do not resolve in that provider namespace.
Interpretation: Parable copies team ID from the parent traversal record into each channel message; the child Microsoft 365 operation does not return it.

Web URL

Developer identifier: channel_messages.webUrlWeb URL. Deep link URL to the message in Microsoft Teams. It locates the provider resource or path associated with the channel message.

Enables: Associate each channel message with the resource identified by web URL in channel_messages.webUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports web URL as a resource locator for each channel message; access still depends on viewer permissions and the URL may expire or change.

Channels

Developer identifier: channelsChannels. Channels within each Microsoft Team.

Enables: Match channels to their parent Team and compare channel name, description, type, membership mode, and lifecycle state.
Scope: Reads the records selected by Microsoft 365’s /v1.0/teams/{id}/channels operation as a snapshot stream using full synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

Created Date Time

Developer identifier: channels.createdDateTimeCreated Date Time. When the channel was created. It anchors the channel on the provider’s reported timeline.

Enables: Order Channels by created date time in channels.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each channel; timezone and precision follow this API field, and absence is not an inferred event time.

Description

Developer identifier: channels.descriptionDescription. Optional channel description. It defines the content surface available for this channel.

Enables: Locate channel records by description in channels.description; attribute each text match to its parent channel and, when present, its reported author.
Interpretation: Microsoft 365 supplies description as text on each channel; referenced files or media are not implied unless explicitly represented.

Display Name

Developer identifier: channels.displayNameDisplay Name. Display name of the channel. It distinguishes the provider-defined display name state or classification for the channel.

Enables: Label each channel with display name from channels.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each channel; names are mutable and are not stable identities.

Developer identifier: channels.idID. Channel ID (opaque thread ID, e.g. 19:…@thread.tacv2). Not an RFC UUID. It provides the reference needed to connect the channel to the corresponding provider object.

Enables: Match repeated channel entries on ID in channels.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its channel namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Is Archived

Developer identifier: channels.isArchivedIs Archived. Whether the channel is archived. It distinguishes the provider-defined is archived state or classification for the channel.

Enables: Filter Channels by whether the channel is archived in channels.isArchived; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the channel is archived as a boolean on each channel; a missing field is unknown, not false.

Is Favorite By Default

Developer identifier: channels.isFavoriteByDefaultIs Favorite By Default. Whether the channel is favorited by default for team members. It distinguishes the provider-defined is favorite by default state or classification for the channel.

Enables: Filter Channels by whether the channel is favorited by default for team members in channels.isFavoriteByDefault; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the channel is favorited by default for team members as a boolean on each channel; a missing field is unknown, not false.

Membership Type

Developer identifier: channels.membershipTypeMembership Type. Channel membership type: standard, private, shared, or unknownFutureValue. It identifies the related provider object that gives the channel its parent, owner, or container context.

Enables: Segment channel entries in Channels by membership type in channels.membershipType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports membership type as a label from its own taxonomy on each channel; preserve unknown labels rather than mapping them by assumption.

Team ID

Developer identifier: channels.team_idTeam ID. Parent team reference copied into each channel because the child operation does not return that relationship. It provides the reference needed to connect the channel to the corresponding provider object.

Enables: Connect each channel in Channels to the referenced team through channels.team_id; flag team ID values that do not resolve in that provider namespace.
Interpretation: Parable copies team ID from the parent traversal record into each channel; the child Microsoft 365 operation does not return it.

Tenant ID

Developer identifier: channels.tenantIdTenant ID. Entra tenant ID that owns the channel. It provides the reference needed to connect the channel to the corresponding provider object.

Enables: Connect each channel in Channels to the referenced tenant through channels.tenantId; flag tenant ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.

Web URL

Developer identifier: channels.webUrlWeb URL. Deep link URL to the channel in Microsoft Teams. It locates the provider resource or path associated with the channel.

Enables: Associate each channel with the resource identified by web URL in channels.webUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports web URL as a resource locator for each channel; access still depends on viewer permissions and the URL may expire or change.

Copilot Interactions

Developer identifier: copilot_interactionsCopilot Interactions. Microsoft 365 Copilot user interaction audit records via the Purview /beta async create-poll-fetch pattern. Filters recordTypeFilters to CopilotInteraction (who/when/AppHost/AccessedResources). Does not include prompt or response text. Opt-in; requires AuditLogsQuery.Read.All.

Enables: Attribute Microsoft-reported Copilot interaction events to users, host applications, accessed resources, and timestamps.
Scope: Reads the records selected by Microsoft 365’s /beta/security/auditLog/queries operation as an event stream using incremental synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The filtered Purview records include who, when, host application, and accessed-resource metadata; prompt and response text are excluded. This stream supplies no reliable deletion signal.

Administrative Units

Developer identifier: copilot_interactions.administrativeUnitsAdministrative Units. Administrative units associated with the record. It preserves the nested context needed to interpret the parent copilot interaction.

Enables: Attribute every returned administrative unit value in copilot_interactions.administrativeUnits to its parent copilot interaction; keep each relationship distinct and distinguish an absent array from an explicitly empty one.
Interpretation: Microsoft 365 returns administrative units as an array of administrative unit value entries on each copilot interaction; missing, empty, and permission-redacted arrays are not equivalent.

Audit Data

Developer identifier: copilot_interactions.auditDataAudit Data. Raw Copilot audit payload as a JSON object, including CopilotEventData (AppHost, Contexts, AccessedResources, Messages, ThreadId). Does not contain prompt or response text. It preserves the nested context needed to interpret the parent copilot interaction.

Enables: Attribute audit data in copilot_interactions.auditData to the parent copilot interaction; identify parent records where that nested audit data object is absent.
Interpretation: Microsoft 365 reports audit data as a nested object on each copilot interaction; optional children may be absent from a valid response.

Audit Log Record Type

Developer identifier: copilot_interactions.auditLogRecordTypeAudit Log Record Type. Audit log record type (CopilotInteraction for this tap). It distinguishes the provider-defined audit log record type state or classification for the copilot interaction.

Enables: Segment copilot interaction entries in Copilot Interactions by audit log record type in copilot_interactions.auditLogRecordType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports audit log record type as a label from its own taxonomy on each copilot interaction; preserve unknown labels rather than mapping them by assumption.

Client IP

Developer identifier: copilot_interactions.clientIpClient IP. Client IP address from which the operation was performed. It supplies the provider-reported address or location facet for the copilot interaction, not a residency determination.

Enables: Correlate copilot interaction records that report the same network address in copilot_interactions.clientIp during an authorized investigation; account for shared, proxied, or translated addresses.
Interpretation: Microsoft 365 reports this as an IP network address on each copilot interaction. It is not verified geolocation, does not identify a person by itself, and does not establish data residency.

Created Date Time

Developer identifier: copilot_interactions.createdDateTimeCreated Date Time. Timestamp when the Copilot interaction occurred. It anchors the copilot interaction on the provider’s reported timeline.

Enables: Order Copilot Interactions by created date time in copilot_interactions.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each copilot interaction; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.

Developer identifier: copilot_interactions.idID. Unique identifier of the audit log record. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

Enables: Match repeated copilot interaction entries on ID in copilot_interactions.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its copilot interaction namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Object ID

Developer identifier: copilot_interactions.objectIdObject ID. Identifier of the object the operation acted on, when present. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

Enables: Connect each copilot interaction in Copilot Interactions to the referenced object through copilot_interactions.objectId; flag object ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports object ID as an identifier in its object namespace; it is not a universal identity outside Microsoft 365.

Operation

Developer identifier: copilot_interactions.operationOperation. Operation name (typically CopilotInteraction). It distinguishes the provider-defined operation state or classification for the copilot interaction.

Enables: Filter Copilot Interactions by the exact Microsoft 365-defined operation in copilot_interactions.operation and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies operation from its own taxonomy on each copilot interaction; preserve unknown and newly introduced labels.

Organization ID

Developer identifier: copilot_interactions.organizationIdOrganization ID. Microsoft tenant identifier. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

Enables: Connect each copilot interaction in Copilot Interactions to the referenced organization through copilot_interactions.organizationId; flag organization ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports organization ID as an identifier in its organization namespace; it is not a universal identity outside Microsoft 365.

Service

Developer identifier: copilot_interactions.serviceService. Microsoft 365 service that produced the record (typically Copilot). It distinguishes the provider-defined service state or classification for the copilot interaction.

Enables: Filter Copilot Interactions by the exact Microsoft 365-defined service in copilot_interactions.service and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies service from its own taxonomy on each copilot interaction; preserve unknown and newly introduced labels.

User ID

Developer identifier: copilot_interactions.userIdUser ID. Object ID of the user that performed the Copilot interaction. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

Enables: Connect each copilot interaction in Copilot Interactions to the referenced user through copilot_interactions.userId; flag user ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.

User Principal Name

Developer identifier: copilot_interactions.userPrincipalNameUser Principal Name. UPN of the user that performed the Copilot interaction. It gives the copilot interaction a human-readable provider label while its identifier remains the stable reference.

Enables: Label each copilot interaction with user principal name from copilot_interactions.userPrincipalName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports user principal name as display text for each copilot interaction; names are mutable and are not stable identities.

User Type

Developer identifier: copilot_interactions.userTypeUser Type. Type of user that performed the operation. It supplies the user type profile facet used to reconcile or attribute the copilot interaction.

Enables: Segment copilot interaction entries in Copilot Interactions by user type in copilot_interactions.userType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports user type as a label from its own taxonomy on each copilot interaction; preserve unknown labels rather than mapping them by assumption.

Groups

Developer identifier: groupsGroups. Microsoft Entra groups (all group types, including non-Teams). Overlaps with the teams tap for groups that have resourceProvisioningOptions Team; teams remains the filtered source for Teams child fan-out.

Enables: Inventory all Entra group types and distinguish Teams-enabled groups from groups not used for Teams child traversal.
Scope: Reads the records selected by Microsoft 365’s /v1.0/groups operation as a snapshot stream using full synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

Classification

Developer identifier: groups.classificationClassification. Classification of the group (e.g. Low, Medium, High) when classifications are configured for the organization. It distinguishes the provider-defined classification state or classification for the group.

Enables: Segment group entries in Groups by classification in groups.classification; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports classification as a label from its own taxonomy on each group; preserve unknown labels rather than mapping them by assumption. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.

Created Date Time

Developer identifier: groups.createdDateTimeCreated Date Time. When the group was created. It anchors the group on the provider’s reported timeline.

Enables: Order Groups by created date time in groups.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.

Deleted Date Time

Developer identifier: groups.deletedDateTimeDeleted Date Time. When the group was soft-deleted, if it is in the deleted items. It anchors the group on the provider’s reported timeline.

Enables: Order Groups by deleted date time in groups.deletedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports deleted date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.

Description

Developer identifier: groups.descriptionDescription. Description of the group. It defines the content surface available for this group.

Enables: Locate group records by description in groups.description; attribute each text match to its parent group and, when present, its reported author.
Interpretation: Microsoft 365 supplies description as text on each group; referenced files or media are not implied unless explicitly represented.

Display Name

Developer identifier: groups.displayNameDisplay Name. Display name of the group. It distinguishes the provider-defined display name state or classification for the group.

Enables: Label each group with display name from groups.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each group; names are mutable and are not stable identities.

Expiration Date Time

Developer identifier: groups.expirationDateTimeExpiration Date Time. When the group is set to expire under the group lifecycle policy. It anchors the group on the provider’s reported timeline.

Enables: Order Groups by expiration date time in groups.expirationDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports expiration date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.

Group Types

Developer identifier: groups.groupTypesGroup Types. Group type markers (e.g. Unified for M365 groups, DynamicMembership). It preserves the nested context needed to interpret the parent group.

Enables: Compare the exact Microsoft 365-configured group types set in groups.groupTypes for each group; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns group types as an array of group type value entries on each group; missing, empty, and permission-redacted arrays are not equivalent.

Developer identifier: groups.idID. Unique identifier for the group. It provides the reference needed to connect the group to the corresponding provider object.

Enables: Match repeated group entries on ID in groups.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its group namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Mail

Developer identifier: groups.mailMail. SMTP address for the group. It supplies the provider-reported address or location facet for the group, not a residency determination.

Enables: Group Groups by the exact mail in groups.mail while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports mail as an address or location facet on each group; it does not establish verified geolocation or data residency.

Mail Enabled

Developer identifier: groups.mailEnabledMail Enabled. Whether the group is mail-enabled. It distinguishes the provider-defined mail enabled state or classification for the group.

Enables: Filter Groups by whether the group is mail-enabled in groups.mailEnabled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the group is mail-enabled as a boolean on each group; a missing field is unknown, not false.

Mail Nickname

Developer identifier: groups.mailNicknameMail Nickname. Mail alias for the group. It supplies the mail nickname profile facet used to reconcile or attribute the group.

Enables: Reconcile the group’s mail nickname in groups.mailNickname with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
Interpretation: Microsoft 365 reports mail nickname as a mutable profile or directory attribute on each group; it may be absent, shared, or non-unique.

Renewed Date Time

Developer identifier: groups.renewedDateTimeRenewed Date Time. When the group was last renewed under the group lifecycle policy. It anchors the group on the provider’s reported timeline.

Enables: Order Groups by renewed date time in groups.renewedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports renewed date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.

Resource Provisioning Options

Developer identifier: groups.resourceProvisioningOptionsResource Provisioning Options. Provisioned resources for the group (e.g. Team). It preserves the nested context needed to interpret the parent group.

Enables: Compare the exact Microsoft 365-configured resource provisioning options set in groups.resourceProvisioningOptions for each group; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns resource provisioning options as an array of resource provisioning option value entries on each group; missing, empty, and permission-redacted arrays are not equivalent.

Security Enabled

Developer identifier: groups.securityEnabledSecurity Enabled. Whether the group is a security group. It distinguishes the provider-defined security enabled state or classification for the group.

Enables: Filter Groups by whether the group is a security group in groups.securityEnabled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the group is a security group as a boolean on each group; a missing field is unknown, not false.

Visibility

Developer identifier: groups.visibilityVisibility. Group visibility: Public, Private, or HiddenMembership. It distinguishes the provider-defined visibility state or classification for the group.

Enables: Segment group entries in Groups by visibility in groups.visibility; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports visibility as a label from its own taxonomy on each group; preserve unknown labels rather than mapping them by assumption.

Messages

Developer identifier: messagesMessages. Mailbox messages by user.

Enables: Attribute mailbox message metadata, recipient headers, and body previews to the owning user and conversation.
Scope: Reads the records selected by Microsoft 365’s /v1.0/users/{id}/messages operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The selected fields include bodyPreview, not the full message body; expanded attachments provide metadata only unless the response explicitly contains content bytes. This stream supplies no reliable deletion signal.

Bcc Recipients

Developer identifier: messages.bccRecipientsBcc Recipients. Recipients on the Bcc line of the message. It preserves the nested context needed to interpret the parent message.

Enables: Attribute each returned recipient in messages.bccRecipients to the parent message; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
Interpretation: Microsoft 365 returns bcc recipients as an array of recipient entries on each message; missing, empty, and permission-redacted arrays are not equivalent.

Email Address

Developer identifier: messages.bccRecipients.emailAddressEmail Address. Email address and display name of the recipient. It preserves the nested context needed to interpret the parent message.

Enables: Match repeated recipient entries on email address in messages.Recipient.emailAddress; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.

Address

Developer identifier: messages.bccRecipients.emailAddress.addressAddress. Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

Enables: Match repeated email address entries on address in messages.EmailAddress.address; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match. The connector explicitly marks this field as a transform deduplication key.

Name

Developer identifier: messages.bccRecipients.emailAddress.nameName. Display name of the person or entity. It gives the email address a human-readable provider label while its identifier remains the stable reference.

Enables: Label each email address with name from messages.EmailAddress.name; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.

Body Preview

Developer identifier: messages.bodyPreviewBody Preview. Short text preview of the message body. It defines the content surface available for this message.

Enables: Locate message records whose body preview in messages.bodyPreview contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
Interpretation: This is an excerpt supplied by the provider, not the complete body or an attachment.

Cc Recipients

Developer identifier: messages.ccRecipientsCc Recipients. Recipients on the Cc line of the message. It preserves the nested context needed to interpret the parent message.

Enables: Attribute each returned recipient in messages.ccRecipients to the parent message; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
Interpretation: Microsoft 365 returns cc recipients as an array of recipient entries on each message; missing, empty, and permission-redacted arrays are not equivalent.

Conversation ID

Developer identifier: messages.conversationIdConversation ID. ID of the conversation the message belongs to. It provides the reference needed to connect the message to the corresponding provider object.

Enables: Connect each message in Messages to the referenced conversation through messages.conversationId; flag conversation ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports conversation ID as an identifier in its conversation namespace; it is not a universal identity outside Microsoft 365.

Created Date Time

Developer identifier: messages.createdDateTimeCreated Date Time. Date and time the message was created in ISO 8601 format. It anchors the message on the provider’s reported timeline.

Enables: Order Messages by created date time in messages.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time.

From

Developer identifier: messages.fromFrom. Mailbox owner and sender of the message (the From header). It preserves the nested context needed to interpret the parent message.

Enables: Attribute from in messages.from to the parent message; identify parent records where that nested from object is absent.
Interpretation: Microsoft 365 reports from as a nested object on each message; optional children may be absent from a valid response.

Has Attachments

Developer identifier: messages.hasAttachmentsHas Attachments. Whether the message has file attachments (excludes inline attachments). It distinguishes the provider-defined has attachments state or classification for the message.

Enables: Filter Messages by whether the message has file attachments (excludes inline attachments) in messages.hasAttachments; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the message has file attachments (excludes inline attachments) as a boolean on each message; a missing field is unknown, not false. This stream treats the file or attachment as metadata and references; binary bytes are not included.

Developer identifier: messages.idID. Unique identifier for the message. It provides the reference needed to connect the message to the corresponding provider object.

Enables: Match repeated message entries on ID in messages.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its message namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Importance

Developer identifier: messages.importanceImportance. Importance of the message: low, normal, or high. It distinguishes the provider-defined importance state or classification for the message.

Enables: Segment message entries in Messages by importance in messages.importance; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports importance as a label from its own taxonomy on each message; preserve unknown labels rather than mapping them by assumption.

Internet Message ID

Developer identifier: messages.internetMessageIdInternet Message ID. RFC 2822 Internet message ID of the message (Message-ID header). It provides the reference needed to connect the message to the corresponding provider object.

Enables: Connect each message in Messages to the referenced internet message through messages.internetMessageId; flag internet message ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports internet message ID as an identifier in its internet message namespace; it is not a universal identity outside Microsoft 365.

Is Draft

Developer identifier: messages.isDraftIs Draft. Whether the message is a draft that has not yet been sent. It distinguishes the provider-defined is draft state or classification for the message.

Enables: Filter Messages by whether the message is a draft that has not yet been sent in messages.isDraft; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the message is a draft that has not yet been sent as a boolean on each message; a missing field is unknown, not false.

Is Read

Developer identifier: messages.isReadIs Read. Whether the message has been read. It distinguishes the provider-defined is read state or classification for the message.

Enables: Filter Messages by whether the message has been read in messages.isRead; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the message has been read as a boolean on each message; a missing field is unknown, not false.

Last Modified Date Time

Developer identifier: messages.lastModifiedDateTimeLast Modified Date Time. Date and time the message was last modified in ISO 8601 format. It anchors the message on the provider’s reported timeline.

Enables: Order Messages by last modified date time in messages.lastModifiedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports last modified date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time.

Parent Folder ID

Developer identifier: messages.parentFolderIdParent Folder ID. Unique identifier for the mailbox folder that contains the message. It provides the reference needed to connect the message to the corresponding provider object.

Enables: Connect each message in Messages to the referenced parent folder through messages.parentFolderId; flag parent folder ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports parent folder ID as an identifier in its parent folder namespace; it is not a universal identity outside Microsoft 365.

Received Date Time

Developer identifier: messages.receivedDateTimeReceived Date Time. Date and time the message was received in ISO 8601 format. Used as incremental sync cursor. It anchors the message on the provider’s reported timeline.

Enables: Order Messages by received date time in messages.receivedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports received date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.

Sender

Developer identifier: messages.senderSender. Account actually used to generate the message. Differs from from when sending on behalf of another mailbox. It preserves the nested context needed to interpret the parent message.

Enables: Attribute sender in messages.sender to the parent message; identify parent records where that nested sender object is absent.
Interpretation: Microsoft 365 reports sender as a nested object on each message; optional children may be absent from a valid response.

Sent Date Time

Developer identifier: messages.sentDateTimeSent Date Time. Date and time the message was sent in ISO 8601 format. It anchors the message on the provider’s reported timeline.

Enables: Order Messages by sent date time in messages.sentDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports sent date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time.

Subject

Developer identifier: messages.subjectSubject. Subject line of the message. It defines the content surface available for this message.

Enables: Locate message records by subject in messages.subject; attribute each text match to its parent message and, when present, its reported author.
Interpretation: Microsoft 365 supplies subject as text on each message; referenced files or media are not implied unless explicitly represented.

To Recipients

Developer identifier: messages.toRecipientsTo Recipients. Recipients on the To line of the message. It preserves the nested context needed to interpret the parent message.

Enables: Attribute each returned recipient in messages.toRecipients to the parent message; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
Interpretation: Microsoft 365 returns to recipients as an array of recipient entries on each message; missing, empty, and permission-redacted arrays are not equivalent.

User ID

Developer identifier: messages.user_idUser ID. Parent user reference copied into each message because the child operation does not return that relationship. It provides the reference needed to connect the message to the corresponding provider object.

Enables: Connect each message in Messages to the referenced user through messages.user_id; flag user ID values that do not resolve in that provider namespace.
Interpretation: Parable copies user ID from the parent traversal record into each message; the child Microsoft 365 operation does not return it.

Organization

Developer identifier: organizationOrganization. Entra organization (tenant) metadata.

Enables: Inventory the Entra organization’s identity, verified domains, directory settings, and synchronization metadata.
Scope: Reads the records selected by Microsoft 365’s /v1.0/organization operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

Country Letter Code

Developer identifier: organization.countryLetterCodeCountry Letter Code. Country letter code. It supplies the provider-reported address or location facet for the organization, not a residency determination.

Enables: Group Organization by country letter code in organization.countryLetterCode without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports country letter code as a user, device, request, or resource location attribute on each organization; it does not establish where data is stored or processed.

Created Date Time

Developer identifier: organization.createdDateTimeCreated Date Time. When the organization was created. It anchors the organization on the provider’s reported timeline.

Enables: Order Organization by created date time in organization.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each organization; timezone and precision follow this API field, and absence is not an inferred event time.

Deleted Date Time

Developer identifier: organization.deletedDateTimeDeleted Date Time. When the organization was soft-deleted, if ever. It anchors the organization on the provider’s reported timeline.

Enables: Order Organization by deleted date time in organization.deletedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports deleted date time as a timestamp on each organization; timezone and precision follow this API field, and absence is not an inferred event time.

Display Name

Developer identifier: organization.displayNameDisplay Name. Display name of the organization. It distinguishes the provider-defined display name state or classification for the organization.

Enables: Label each organization with display name from organization.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each organization; names are mutable and are not stable identities.

Developer identifier: organization.idID. Tenant ID. It provides the reference needed to connect the organization to the corresponding provider object.

Enables: Match repeated organization entries on ID in organization.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its organization namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Preferred Language

Developer identifier: organization.preferredLanguagePreferred Language. Preferred language for the organization. It supplies the preferred language profile facet used to reconcile or attribute the organization.

Enables: Reconcile the organization’s preferred language in organization.preferredLanguage with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
Interpretation: Microsoft 365 reports preferred language as a mutable profile or directory attribute on each organization; it may be absent, shared, or non-unique.

Tenant Type

Developer identifier: organization.tenantTypeTenant Type. Tenant type. It distinguishes the provider-defined tenant type state or classification for the organization.

Enables: Segment organization entries in Organization by tenant type in organization.tenantType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports tenant type as a label from its own taxonomy on each organization; preserve unknown labels rather than mapping them by assumption.

Verified Domains

Developer identifier: organization.verifiedDomainsVerified Domains. Verified domains for the organization. It preserves the nested context needed to interpret the parent organization.

Enables: Reconcile each returned verified domain in organization.verifiedDomains with the parent organization’s provider profile; preserve distinct aliases, contact points, and organization attributes.
Interpretation: Microsoft 365 returns verified domains as an array of verified domain entries on each organization; missing, empty, and permission-redacted arrays are not equivalent.

Capabilities

Developer identifier: organization.verifiedDomains.capabilitiesCapabilities. The provider-reported capabilities for each verified domain in Organization. It distinguishes the provider-defined capabilities state or classification for the verified domain.

Enables: Filter Organization by the exact Microsoft 365-defined capabilities in organization.VerifiedDomain.capabilities and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies capabilities from its own taxonomy on each verified domain; preserve unknown and newly introduced labels.

Is Default

Developer identifier: organization.verifiedDomains.isDefaultIs Default. The provider-reported is default for each verified domain in Organization. It distinguishes the provider-defined is default state or classification for the verified domain.

Enables: Filter Organization by whether is default in organization.VerifiedDomain.isDefault; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports is default as a boolean on each verified domain; a missing field is unknown, not false.

Is Initial

Developer identifier: organization.verifiedDomains.isInitialIs Initial. The provider-reported is initial for each verified domain in Organization. It distinguishes the provider-defined is initial state or classification for the verified domain.

Enables: Filter Organization by whether is initial in organization.VerifiedDomain.isInitial; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports is initial as a boolean on each verified domain; a missing field is unknown, not false.

Name

Developer identifier: organization.verifiedDomains.nameName. Verified domain name. It gives the verified domain a human-readable provider label while its identifier remains the stable reference.

Enables: Match repeated verified domain entries on name in organization.VerifiedDomain.name; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports name as display text for each verified domain; names are mutable and are not stable identities. The connector explicitly marks this field as a transform deduplication key.

Type

Developer identifier: organization.verifiedDomains.typeType. The provider-reported type for each verified domain in Organization. It distinguishes the provider-defined type state or classification for the verified domain.

Enables: Segment verified domain entries in Organization by type in organization.VerifiedDomain.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each verified domain; preserve unknown labels rather than mapping them by assumption.

Developer identifier: sign_in_logsSign In Logs. Microsoft Entra sign-in logs.

Enables: Trace Microsoft Entra sign-in attempts to users, applications, devices, network attributes, and provider outcomes.
Scope: Reads the records selected by Microsoft 365’s /v1.0/auditLogs/signIns operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. This stream supplies no reliable deletion signal.

Developer identifier: sign_in_logs.appDisplayNameApp Display Name. Name of the application the user signed into. It distinguishes the provider-defined app display name state or classification for the sign in log.

Enables: Label each sign in log with app display name from sign_in_logs.appDisplayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports app display name as display text for each sign in log; names are mutable and are not stable identities.

Developer identifier: sign_in_logs.appIdApp ID. Application ID of the app signed into. It provides the reference needed to connect the sign in log to the corresponding provider object.

Enables: Connect each sign in log in Sign In Logs to the referenced app through sign_in_logs.appId; flag app ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports app ID as an identifier in its app namespace; it is not a universal identity outside Microsoft 365.

Developer identifier: sign_in_logs.clientAppUsedClient App Used. Client app used for sign-in (e.g., Browser, Mobile Apps). It distinguishes the provider-defined client app used state or classification for the sign in log.

Enables: Filter Sign In Logs by the exact Microsoft 365-defined client app used in sign_in_logs.clientAppUsed and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies client app used from its own taxonomy on each sign in log; preserve unknown and newly introduced labels.

Developer identifier: sign_in_logs.conditionalAccessStatusConditional Access Status. Status of conditional access policies applied. It distinguishes the provider-defined conditional access status state or classification for the sign in log.

Enables: Segment sign in log entries in Sign In Logs by conditional access status in sign_in_logs.conditionalAccessStatus; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports conditional access status as a label from its own taxonomy on each sign in log; preserve unknown labels rather than mapping them by assumption.

Developer identifier: sign_in_logs.correlationIdCorrelation ID. Identifier that correlates all sign-in activity for a single sign-in flow. It provides the reference needed to connect the sign in log to the corresponding provider object.

Enables: Connect each sign in log in Sign In Logs to the referenced correlation through sign_in_logs.correlationId; flag correlation ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports correlation ID as an identifier in its correlation namespace; it is not a universal identity outside Microsoft 365.

Developer identifier: sign_in_logs.createdDateTimeCreated Date Time. When the sign-in occurred. It anchors the sign in log on the provider’s reported timeline.

Enables: Order Sign In Logs by created date time in sign_in_logs.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each sign in log; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.

Developer identifier: sign_in_logs.deviceDetailDevice Detail. Device information including device ID, OS, browser, and management state. It preserves the nested context needed to interpret the parent sign in log.

Enables: Attribute device detail in sign_in_logs.deviceDetail to the parent sign in log; identify parent records where that nested device detail object is absent.
Interpretation: Microsoft 365 reports device detail as a nested object on each sign in log; optional children may be absent from a valid response.

Developer identifier: sign_in_logs.deviceDetail.browserBrowser. Browser used for the sign-in. It distinguishes the provider-defined browser state or classification for the device detail.

Enables: Filter Sign In Logs by the exact Microsoft 365-defined browser in sign_in_logs.DeviceDetail.browser and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies browser from its own taxonomy on each device detail; preserve unknown and newly introduced labels.

Developer identifier: sign_in_logs.deviceDetail.deviceIdDevice ID. Identifier of the device used for the sign-in. It provides the reference needed to connect the sign in log to the corresponding provider object.

Enables: Connect each device detail in Sign In Logs to the referenced device through sign_in_logs.DeviceDetail.deviceId; flag device ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports device ID as an identifier in its device namespace; it is not a universal identity outside Microsoft 365.

Developer identifier: sign_in_logs.deviceDetail.displayNameDisplay Name. Display name of the device. It distinguishes the provider-defined display name state or classification for the device detail.

Enables: Label each device detail with display name from sign_in_logs.DeviceDetail.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each device detail; names are mutable and are not stable identities.

Developer identifier: sign_in_logs.deviceDetail.isCompliantIs Compliant. Whether the device is compliant with organization policy. It distinguishes the provider-defined is compliant state or classification for the device detail.

Enables: Filter Sign In Logs by whether the device is compliant with organization policy in sign_in_logs.DeviceDetail.isCompliant; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the device is compliant with organization policy as a boolean on each device detail; a missing field is unknown, not false.

Developer identifier: sign_in_logs.deviceDetail.isManagedIs Managed. Whether the device is managed by the organization. It distinguishes the provider-defined is managed state or classification for the device detail.

Enables: Filter Sign In Logs by whether the device is managed by the organization in sign_in_logs.DeviceDetail.isManaged; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the device is managed by the organization as a boolean on each device detail; a missing field is unknown, not false.

Developer identifier: sign_in_logs.deviceDetail.operatingSystemOperating System. Operating system name and version of the device. It distinguishes the provider-defined operating system state or classification for the device detail.

Enables: Filter Sign In Logs by the exact Microsoft 365-defined operating system in sign_in_logs.DeviceDetail.operatingSystem and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies operating system from its own taxonomy on each device detail; preserve unknown and newly introduced labels.

Developer identifier: sign_in_logs.deviceDetail.trustTypeTrust Type. Trust type of the device (e.g. AzureAd, ServerAd, Workplace). It distinguishes the provider-defined trust type state or classification for the device detail.

Enables: Segment device detail entries in Sign In Logs by trust type in sign_in_logs.DeviceDetail.trustType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports trust type as a label from its own taxonomy on each device detail; preserve unknown labels rather than mapping them by assumption.

Developer identifier: sign_in_logs.idID. Unique identifier for the sign-in event. It provides the reference needed to connect the sign in log to the corresponding provider object.

Enables: Match repeated sign in log entries on ID in sign_in_logs.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its sign in log namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Developer identifier: sign_in_logs.ipAddressIP Address. IP address of the client used for sign-in. It supplies the provider-reported address or location facet for the sign in log, not a residency determination.

Enables: Correlate sign in log records that report the same network address in sign_in_logs.ipAddress during an authorized investigation; account for shared, proxied, or translated addresses.
Interpretation: Microsoft 365 reports this as an IP network address on each sign in log. It is not verified geolocation, does not identify a person by itself, and does not establish data residency.

Developer identifier: sign_in_logs.isInteractiveIs Interactive. Whether the sign-in was interactive or non-interactive. It distinguishes the provider-defined is interactive state or classification for the sign in log.

Enables: Filter Sign In Logs by whether the sign-in was interactive or non-interactive in sign_in_logs.isInteractive; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the sign-in was interactive or non-interactive as a boolean on each sign in log; a missing field is unknown, not false.

Developer identifier: sign_in_logs.locationLocation. City, state, country, and geo-coordinates from which the sign-in occurred. It preserves the nested context needed to interpret the parent sign in log.

Enables: Attribute location in sign_in_logs.location to the parent sign in log; identify parent records where that nested location object is absent.
Interpretation: Microsoft 365 reports location as a nested object on each sign in log; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.

Developer identifier: sign_in_logs.location.cityCity. City the sign-in originated from. It supplies the provider-reported address or location facet for the sign in location, not a residency determination.

Enables: Group Sign In Logs by city in sign_in_logs.SignInLocation.city without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports city as a user, device, request, or resource location attribute on each sign in location; it does not establish where data is stored or processed.

Developer identifier: sign_in_logs.location.countryOrRegionCountry Or Region. Country or region code the sign-in originated from. It supplies the provider-reported address or location facet for the sign in location, not a residency determination.

Enables: Group Sign In Logs by country or region in sign_in_logs.SignInLocation.countryOrRegion without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports country or region as a user, device, request, or resource location attribute on each sign in location; it does not establish where data is stored or processed.

Developer identifier: sign_in_logs.location.geoCoordinatesGeo Coordinates. Latitude, longitude, and altitude of the sign-in location. It preserves the nested context needed to interpret the parent sign in log.

Enables: Attribute geo coordinates in sign_in_logs.SignInLocation.geoCoordinates to the parent sign in log; identify parent records where that nested geo coordinates object is absent.
Interpretation: Microsoft 365 reports geo coordinates as a nested object on each sign in location; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.

Developer identifier: sign_in_logs.location.geoCoordinates.altitudeAltitude. Altitude of the location, in meters. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Sign In Logs by the exact altitude in sign_in_logs.GeoCoordinates.altitude while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports altitude as an address or location facet on each geo coordinate; it does not establish verified geolocation or data residency.

Developer identifier: sign_in_logs.location.geoCoordinates.latitudeLatitude. Latitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Sign In Logs by latitude in sign_in_logs.GeoCoordinates.latitude without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports latitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.

Developer identifier: sign_in_logs.location.geoCoordinates.longitudeLongitude. Longitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Sign In Logs by longitude in sign_in_logs.GeoCoordinates.longitude without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports longitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.

Developer identifier: sign_in_logs.location.stateState. State or province the sign-in originated from. It distinguishes the provider-defined state state or classification for the sign in location.

Enables: Group Sign In Logs by state in sign_in_logs.SignInLocation.state without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports state as a user, device, request, or resource location attribute on each sign in location; it does not establish where data is stored or processed.

Developer identifier: sign_in_logs.resourceDisplayNameResource Display Name. Display name of the resource the user signed into. It distinguishes the provider-defined resource display name state or classification for the sign in log.

Enables: Label each sign in log with resource display name from sign_in_logs.resourceDisplayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports resource display name as display text for each sign in log; names are mutable and are not stable identities.

Developer identifier: sign_in_logs.resourceIdResource ID. Identifier of the resource the user signed into. It provides the reference needed to connect the sign in log to the corresponding provider object.

Enables: Connect each sign in log in Sign In Logs to the referenced resource through sign_in_logs.resourceId; flag resource ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports resource ID as an identifier in its resource namespace; it is not a universal identity outside Microsoft 365.

Developer identifier: sign_in_logs.riskDetailRisk Detail. Reason behind the sign-in risk state (evolvable enum, e.g. none, hidden, adminConfirmedSigninSafe). Stored as string because Microsoft may add values. It supplies the returned risk detail text needed to understand the sign in log in context.

Enables: Search the returned risk detail text in sign_in_logs.riskDetail and attribute each match to its parent sign in log and reported author when available.
Interpretation: Microsoft 365 supplies risk detail as returned text on each sign in log; truncation, formatting, and access boundaries can limit completeness.

Developer identifier: sign_in_logs.riskEventTypes_v2Risk Event Types V2. Risk event types associated with the sign-in. It preserves the nested context needed to interpret the parent sign in log.

Enables: Compare the exact Microsoft 365-configured risk event types v2 set in sign_in_logs.riskEventTypes_v2 for each sign in log; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns risk event types v2 as an array of risk event types v2 value entries on each sign in log; missing, empty, and permission-redacted arrays are not equivalent.

Developer identifier: sign_in_logs.riskLevelAggregatedRisk Level Aggregated. Aggregated risk level of the sign-in (evolvable enum: none, low, medium, high, hidden). Stored as string because Microsoft may add values. It distinguishes the provider-defined risk level aggregated state or classification for the sign in log.

Enables: Filter Sign In Logs by the exact Microsoft 365-defined risk level aggregated in sign_in_logs.riskLevelAggregated and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies risk level aggregated from its own taxonomy on each sign in log; preserve unknown and newly introduced labels.

Developer identifier: sign_in_logs.riskLevelDuringSignInRisk Level During Sign In. Risk level during the sign-in (evolvable enum: none, low, medium, high, hidden). Stored as string because Microsoft may add values. It distinguishes the provider-defined risk level during sign in state or classification for the sign in log.

Enables: Filter Sign In Logs by the exact Microsoft 365-defined risk level during sign in in sign_in_logs.riskLevelDuringSignIn and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies risk level during sign in from its own taxonomy on each sign in log; preserve unknown and newly introduced labels.

Developer identifier: sign_in_logs.riskStateRisk State. Risk state of the sign-in (evolvable enum: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised). Stored as string because Microsoft may add values. It distinguishes the provider-defined risk state state or classification for the sign in log.

Enables: Segment sign in log entries in Sign In Logs by risk state in sign_in_logs.riskState; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports risk state as a label from its own taxonomy on each sign in log; preserve unknown labels rather than mapping them by assumption.

Developer identifier: sign_in_logs.statusStatus. Sign-in status including error code, failure reason, and additional details. It preserves the nested context needed to interpret the parent sign in log.

Enables: Attribute status in sign_in_logs.status to the parent sign in log; identify parent records where that nested status object is absent.
Interpretation: Microsoft 365 reports status as a nested object on each sign in log; optional children may be absent from a valid response.

Developer identifier: sign_in_logs.status.additionalDetailsAdditional Details. Additional details about the sign-in status. It supplies the returned additional details text needed to understand the sign in status in context.

Enables: Search the returned additional details text in sign_in_logs.SignInStatus.additionalDetails and attribute each match to its parent sign in log and reported author when available.
Interpretation: Microsoft 365 supplies additional details as returned text on each sign in status; truncation, formatting, and access boundaries can limit completeness.

Developer identifier: sign_in_logs.status.errorCodeError Code. Sign-in error code. 0 indicates success. It distinguishes the provider-defined error code state or classification for the sign in status.

Enables: Filter Sign In Logs by the exact Microsoft 365-defined error code in sign_in_logs.SignInStatus.errorCode and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies error code from its own taxonomy on each sign in status; preserve unknown and newly introduced labels.

Developer identifier: sign_in_logs.status.failureReasonFailure Reason. Human-readable failure reason when the sign-in did not succeed. It supplies the returned failure reason text needed to understand the sign in status in context.

Enables: Search the returned failure reason text in sign_in_logs.SignInStatus.failureReason and attribute each match to its parent sign in log and reported author when available.
Interpretation: Microsoft 365 supplies failure reason as returned text on each sign in status; truncation, formatting, and access boundaries can limit completeness.

Developer identifier: sign_in_logs.userDisplayNameUser Display Name. Display name of the user who signed in. It distinguishes the provider-defined user display name state or classification for the sign in log.

Enables: Label each sign in log with user display name from sign_in_logs.userDisplayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports user display name as display text for each sign in log; names are mutable and are not stable identities.

Developer identifier: sign_in_logs.userIdUser ID. Entra ID object ID of the user. It provides the reference needed to connect the sign in log to the corresponding provider object.

Enables: Connect each sign in log in Sign In Logs to the referenced user through sign_in_logs.userId; flag user ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.

Developer identifier: sign_in_logs.userPrincipalNameUser Principal Name. UPN of the user who signed in. It gives the sign in log a human-readable provider label while its identifier remains the stable reference.

Enables: Label each sign in log with user principal name from sign_in_logs.userPrincipalName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports user principal name as display text for each sign in log; names are mutable and are not stable identities.

Team Calendar Events

Developer identifier: team_calendar_eventsTeam Calendar Events. Team calendar events by group.

Enables: Attribute group calendar events to the parent Team, organizer, attendees, recurrence, and time interval.
Scope: Reads the records selected by Microsoft 365’s /v1.0/groups/{id}/calendar/calendarView operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The selected fields are event, organizer, attendee, and time metadata; full body and attachment bytes are not fetched. This stream supplies no reliable deletion signal.

Attendees

Developer identifier: team_calendar_events.attendeesAttendees. List of attendees with email, name, and response status. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute each returned attendee in team_calendar_events.attendees to the parent team calendar event; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
Interpretation: Microsoft 365 returns attendees as an array of attendee entries on each team calendar event; missing, empty, and permission-redacted arrays are not equivalent.

Email Address

Developer identifier: team_calendar_events.attendees.emailAddressEmail Address. Email address and display name of the attendee. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Match repeated attendee entries on email address in team_calendar_events.Attendee.emailAddress; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports email address as a nested object on each attendee; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.

Address

Developer identifier: team_calendar_events.attendees.emailAddress.addressAddress. Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

Enables: Attribute each email address to a person or account by the exact address in team_calendar_events.EmailAddress.address; identify addresses that do not match the Microsoft 365 directory.
Interpretation: Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match.

Name

Developer identifier: team_calendar_events.attendees.emailAddress.nameName. Display name of the person or entity. It gives the email address a human-readable provider label while its identifier remains the stable reference.

Enables: Label each email address with name from team_calendar_events.EmailAddress.name; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.

Proposed New Time

Developer identifier: team_calendar_events.attendees.proposedNewTimeProposed New Time. An alternate date/time proposed by the attendee. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute proposed new time in team_calendar_events.Attendee.proposedNewTime to the parent team calendar event; identify parent records where that nested proposed new time object is absent.
Interpretation: Microsoft 365 reports proposed new time as a nested object on each attendee; optional children may be absent from a valid response.

End

Developer identifier: team_calendar_events.attendees.proposedNewTime.endEnd. End of the time slot. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute end in team_calendar_events.TimeSlot.end to the parent team calendar event; identify parent records where that nested end object is absent.
Interpretation: Microsoft 365 reports end as a nested object on each time slot; optional children may be absent from a valid response.

Date Time

Developer identifier: team_calendar_events.attendees.proposedNewTime.end.dateTimeDate Time. Date and time in ISO 8601 format without timezone offset (e.g. 2024-01-15T09:00:00.0000000). It anchors the team calendar event on the provider’s reported timeline.

Enables: Order Team Calendar Events by date time in team_calendar_events.DateTimeTimeZone.dateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports date time as a timestamp on each date time time zone; timezone and precision follow this API field, and absence is not an inferred event time.

Time Zone

Developer identifier: team_calendar_events.attendees.proposedNewTime.end.timeZoneTime Zone. IANA or Windows time zone identifier (e.g. Pacific Standard Time, America/New_York). It is needed to interpret companion dates and times for the date time time zone in the provider’s intended zone.

Enables: Apply the zone in team_calendar_events.DateTimeTimeZone.timeZone when converting the team calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports time zone as a timezone identifier for each date time time zone; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Start

Developer identifier: team_calendar_events.attendees.proposedNewTime.startStart. Start of the time slot. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute start in team_calendar_events.TimeSlot.start to the parent team calendar event; identify parent records where that nested start object is absent.
Interpretation: Microsoft 365 reports start as a nested object on each time slot; optional children may be absent from a valid response.

Status

Developer identifier: team_calendar_events.attendees.statusStatus. The attendee’s response status for the event. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute status in team_calendar_events.Attendee.status to the parent team calendar event; identify parent records where that nested status object is absent.
Interpretation: Microsoft 365 reports status as a nested object on each attendee; optional children may be absent from a valid response.

Response

Developer identifier: team_calendar_events.attendees.status.responseResponse. The response type. It distinguishes the provider-defined response state or classification for the response status.

Enables: Segment response status entries in Team Calendar Events by response in team_calendar_events.ResponseStatus.response; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports response as a label from its own taxonomy on each response status; preserve unknown labels rather than mapping them by assumption.

Time

Developer identifier: team_calendar_events.attendees.status.timeTime. Date and time the response was submitted. It anchors the team calendar event on the provider’s reported timeline.

Enables: Order Team Calendar Events by time in team_calendar_events.ResponseStatus.time and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports time as a timestamp on each response status; timezone and precision follow this API field, and absence is not an inferred event time.

Type

Developer identifier: team_calendar_events.attendees.typeType. Attendee type: required, optional, or resource. It distinguishes the provider-defined type state or classification for the attendee.

Enables: Segment attendee entries in Team Calendar Events by type in team_calendar_events.Attendee.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each attendee; preserve unknown labels rather than mapping them by assumption.

Body Preview

Developer identifier: team_calendar_events.bodyPreviewBody Preview. Short text preview of the event body content. It defines the content surface available for this team calendar event.

Enables: Locate team calendar event records whose body preview in team_calendar_events.bodyPreview contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
Interpretation: This is an excerpt supplied by the provider, not the complete body or an attachment.

Calendar

Developer identifier: team_calendar_events.calendarCalendar. The calendar navigation property or calendar ID associated with the event. It identifies the related provider object that gives the team calendar event its parent, owner, or container context.

Enables: Connect each team calendar event to the related calendar in team_calendar_events.calendar and verify that the referenced provider object resolves in the expected parent or container.
Interpretation: Microsoft 365 reports calendar as relationship context on each team calendar event; resolve it in the named provider namespace rather than by display text alone.

Categories

Developer identifier: team_calendar_events.categoriesCategories. User-assigned categories/labels on the event. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Compare the exact Microsoft 365-configured categories set in team_calendar_events.categories for each team calendar event; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns categories as an array of category value entries on each team calendar event; missing, empty, and permission-redacted arrays are not equivalent.

Change Key

Developer identifier: team_calendar_events.changeKeyChange Key. Version identifier of the event; changes each time the event is modified. It provides the reference needed to connect the team calendar event to the corresponding provider object.

Enables: Connect each team calendar event in Team Calendar Events to the referenced change through team_calendar_events.changeKey; flag change key values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports change key as an identifier in its change namespace; it is not a universal identity outside Microsoft 365.

Created Date Time

Developer identifier: team_calendar_events.createdDateTimeCreated Date Time. Date and time the event was created in ISO 8601 format. It anchors the team calendar event on the provider’s reported timeline.

Enables: Order Team Calendar Events by created date time in team_calendar_events.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each team calendar event; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.

End

Developer identifier: team_calendar_events.endEnd. End date/time and timezone of the event. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute end in team_calendar_events.end to the parent team calendar event; identify parent records where that nested end object is absent.
Interpretation: Microsoft 365 reports end as a nested object on each team calendar event; optional children may be absent from a valid response.

I Cal U ID

Developer identifier: team_calendar_events.iCalUIdI Cal U ID. Unique identifier for the event across calendars. Stable when the event moves between calendars, unlike ID. It provides the reference needed to connect the team calendar event to the corresponding provider object.

Enables: Connect each team calendar event in Team Calendar Events to the referenced i cal u through team_calendar_events.iCalUId; flag i cal u ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports i cal u ID as an identifier in its i cal u namespace; it is not a universal identity outside Microsoft 365.

Developer identifier: team_calendar_events.idID. Unique identifier for the event. It provides the reference needed to connect the team calendar event to the corresponding provider object.

Enables: Match repeated team calendar event entries on ID in team_calendar_events.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its team calendar event namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Importance

Developer identifier: team_calendar_events.importanceImportance. Importance level of the event. It distinguishes the provider-defined importance state or classification for the team calendar event.

Enables: Segment team calendar event entries in Team Calendar Events by importance in team_calendar_events.importance; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports importance as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.

Is All Day

Developer identifier: team_calendar_events.isAllDayIs All Day. Whether the event lasts all day. It distinguishes the provider-defined is all day state or classification for the team calendar event.

Enables: Filter Team Calendar Events by whether the event lasts all day in team_calendar_events.isAllDay; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the event lasts all day as a boolean on each team calendar event; a missing field is unknown, not false.

Is Cancelled

Developer identifier: team_calendar_events.isCancelledIs Cancelled. Whether the event has been cancelled. It distinguishes the provider-defined is cancelled state or classification for the team calendar event.

Enables: Filter Team Calendar Events by whether the event has been cancelled in team_calendar_events.isCancelled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the event has been cancelled as a boolean on each team calendar event; a missing field is unknown, not false.

Is Online Meeting

Developer identifier: team_calendar_events.isOnlineMeetingIs Online Meeting. Whether the event is an online meeting. It distinguishes the provider-defined is online meeting state or classification for the team calendar event.

Enables: Filter Team Calendar Events by whether the event is an online meeting in team_calendar_events.isOnlineMeeting; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the event is an online meeting as a boolean on each team calendar event; a missing field is unknown, not false.

Last Modified Date Time

Developer identifier: team_calendar_events.lastModifiedDateTimeLast Modified Date Time. Date and time the event was last modified in ISO 8601 format. Used as incremental sync cursor. It anchors the team calendar event on the provider’s reported timeline.

Enables: Order Team Calendar Events by last modified date time in team_calendar_events.lastModifiedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports last modified date time as a timestamp on each team calendar event; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.

Location

Developer identifier: team_calendar_events.locationLocation. Location of the event. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute location in team_calendar_events.location to the parent team calendar event; identify parent records where that nested location object is absent.
Interpretation: Microsoft 365 reports location as a nested object on each team calendar event; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.

Address

Developer identifier: team_calendar_events.location.addressAddress. Physical street address of the location. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute address in team_calendar_events.Location.address to the parent team calendar event; identify parent records where that nested address object is absent.
Interpretation: Microsoft 365 reports address as a nested object on each location; optional children may be absent from a valid response.

City

Developer identifier: team_calendar_events.location.address.cityCity. City. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Team Calendar Events by city in team_calendar_events.PhysicalAddress.city without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports city as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.

Country Or Region

Developer identifier: team_calendar_events.location.address.countryOrRegionCountry Or Region. Country or region. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Team Calendar Events by country or region in team_calendar_events.PhysicalAddress.countryOrRegion without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports country or region as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.

Postal Code

Developer identifier: team_calendar_events.location.address.postalCodePostal Code. Postal/ZIP code. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Team Calendar Events by the exact postal code in team_calendar_events.PhysicalAddress.postalCode while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports postal code as an address or location facet on each physical address; it does not establish verified geolocation or data residency.

State

Developer identifier: team_calendar_events.location.address.stateState. State or province. It distinguishes the provider-defined state state or classification for the physical address.

Enables: Group Team Calendar Events by state in team_calendar_events.PhysicalAddress.state without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports state as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.

Street

Developer identifier: team_calendar_events.location.address.streetStreet. Street address. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

Enables: Group Team Calendar Events by the exact street in team_calendar_events.PhysicalAddress.street while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports street as an address or location facet on each physical address; it does not establish verified geolocation or data residency.

Coordinates

Developer identifier: team_calendar_events.location.coordinatesCoordinates. Geographic coordinates and elevation of the location. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute coordinates in team_calendar_events.Location.coordinates to the parent team calendar event; identify parent records where that nested coordinates object is absent.
Interpretation: Microsoft 365 reports coordinates as a nested object on each location; optional children may be absent from a valid response.

Accuracy

Developer identifier: team_calendar_events.location.coordinates.accuracyAccuracy. Accuracy of the coordinates in meters. It supplies the accuracy measure for the geo coordinate at the provider’s declared unit and grain.

Enables: Measure accuracy through team_calendar_events.GeoCoordinates.accuracy for each geo coordinate and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.

Altitude

Developer identifier: team_calendar_events.location.coordinates.altitudeAltitude. Altitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Team Calendar Events by the exact altitude in team_calendar_events.GeoCoordinates.altitude while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports altitude as an address or location facet on each geo coordinate; it does not establish verified geolocation or data residency.

Altitude Accuracy

Developer identifier: team_calendar_events.location.coordinates.altitudeAccuracyAltitude Accuracy. Accuracy of the altitude in meters. It supplies the altitude accuracy measure for the geo coordinate at the provider’s declared unit and grain.

Enables: Measure altitude accuracy through team_calendar_events.GeoCoordinates.altitudeAccuracy for each geo coordinate and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports altitude accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.

Latitude

Developer identifier: team_calendar_events.location.coordinates.latitudeLatitude. Latitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Team Calendar Events by latitude in team_calendar_events.GeoCoordinates.latitude without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports latitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.

Longitude

Developer identifier: team_calendar_events.location.coordinates.longitudeLongitude. Longitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

Enables: Group Team Calendar Events by longitude in team_calendar_events.GeoCoordinates.longitude without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports longitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.

Display Name

Developer identifier: team_calendar_events.location.displayNameDisplay Name. Display name of the location. It distinguishes the provider-defined display name state or classification for the location.

Enables: Label each location with display name from team_calendar_events.Location.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each location; names are mutable and are not stable identities.

Location Email Address

Developer identifier: team_calendar_events.location.locationEmailAddressLocation Email Address. Email address associated with the location (e.g. a conference room). It supplies the provider-reported address or location facet for the location, not a residency determination.

Enables: Attribute each location to a person or account by the exact location email address in team_calendar_events.Location.locationEmailAddress; identify addresses that do not match the Microsoft 365 directory.
Interpretation: Microsoft 365 reports location email address as an address on each location; aliases, casing, and unverified addresses can prevent a one-to-one person match.

Location Type

Developer identifier: team_calendar_events.location.locationTypeLocation Type. Type of location. It distinguishes the provider-defined location type state or classification for the location.

Enables: Segment location entries in Team Calendar Events by location type in team_calendar_events.Location.locationType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports location type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.

Location URI

Developer identifier: team_calendar_events.location.locationUriLocation URI. URI representing the location. It supplies the provider-reported address or location facet for the location, not a residency determination.

Enables: Associate each location with the resource identified by location URI in team_calendar_events.Location.locationUri; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports location URI as a resource locator for each location; access still depends on viewer permissions and the URL may expire or change.

Unique ID

Developer identifier: team_calendar_events.location.uniqueIdUnique ID. Unique identifier of the location, if available. It provides the reference needed to connect the team calendar event to the corresponding provider object.

Enables: Connect each location in Team Calendar Events to the referenced unique through team_calendar_events.Location.uniqueId; flag unique ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports unique ID as an identifier in its unique namespace; it is not a universal identity outside Microsoft 365.

Unique ID Type

Developer identifier: team_calendar_events.location.uniqueIdTypeUnique ID Type. Type of the unique ID for the location. It distinguishes the provider-defined unique ID type state or classification for the location.

Enables: Segment location entries in Team Calendar Events by unique ID type in team_calendar_events.Location.uniqueIdType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports unique ID type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.

Online Meeting

Developer identifier: team_calendar_events.onlineMeetingOnline Meeting. Details for joining an online meeting, including join URL and conference ID. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute online meeting in team_calendar_events.onlineMeeting to the parent team calendar event; identify parent records where that nested online meeting object is absent.
Interpretation: Microsoft 365 reports online meeting as a nested object on each team calendar event; optional children may be absent from a valid response.

Conference ID

Developer identifier: team_calendar_events.onlineMeeting.conferenceIdConference ID. Conference ID for dial-in access. It provides the reference needed to connect the team calendar event to the corresponding provider object.

Enables: Connect each online meeting info in Team Calendar Events to the referenced conference through team_calendar_events.OnlineMeetingInfo.conferenceId; flag conference ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports conference ID as an identifier in its conference namespace; it is not a universal identity outside Microsoft 365.

Dialin URL

Developer identifier: team_calendar_events.onlineMeeting.dialinUrlDialin URL. URL with dial-in information. It locates the provider resource or path associated with the online meeting info.

Enables: Associate each online meeting info with the resource identified by dialin URL in team_calendar_events.OnlineMeetingInfo.dialinUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports dialin URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.

Join URL

Developer identifier: team_calendar_events.onlineMeeting.joinUrlJoin URL. URL to join the online meeting. It locates the provider resource or path associated with the online meeting info.

Enables: Associate each online meeting info with the resource identified by join URL in team_calendar_events.OnlineMeetingInfo.joinUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports join URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.

Phones

Developer identifier: team_calendar_events.onlineMeeting.phonesPhones. Phone numbers associated with the online meeting. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Reconcile each returned online meeting phone in team_calendar_events.OnlineMeetingInfo.phones with the parent team calendar event’s provider profile; preserve distinct aliases, contact points, and organization attributes.
Interpretation: Microsoft 365 returns phones as an array of online meeting phone entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.

Number

Developer identifier: team_calendar_events.onlineMeeting.phones.numberNumber. The phone number. It supplies the number measure for the online meeting phone at the provider’s declared unit and grain.

Enables: Measure number through team_calendar_events.OnlineMeetingPhone.number for each online meeting phone and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports number as a measure on each online meeting phone; compare only records with the same unit and aggregation grain.

Type

Developer identifier: team_calendar_events.onlineMeeting.phones.typeType. Type of phone number (e.g. toll, tollFree). It distinguishes the provider-defined type state or classification for the online meeting phone.

Enables: Segment online meeting phone entries in Team Calendar Events by type in team_calendar_events.OnlineMeetingPhone.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each online meeting phone; preserve unknown labels rather than mapping them by assumption.

Quick Dial

Developer identifier: team_calendar_events.onlineMeeting.quickDialQuick Dial. Quick dial code for the meeting. It supplies the sensitive provider access code needed to join the online meeting info, not a stable record identifier.

Enables: Reconcile team_calendar_events.OnlineMeetingInfo.quickDial with the same conference entry point or meeting instructions when validating join access; handle it as sensitive access metadata.
Interpretation: Microsoft 365 returns quick dial as meeting or conference access metadata on each online meeting info; it can rotate and does not identify the meeting by itself.

Toll Free Numbers

Developer identifier: team_calendar_events.onlineMeeting.tollFreeNumbersToll Free Numbers. List of toll-free phone numbers for dial-in. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Reconcile each returned toll free number value in team_calendar_events.OnlineMeetingInfo.tollFreeNumbers with the parent team calendar event’s provider profile; preserve distinct aliases, contact points, and organization attributes.
Interpretation: Microsoft 365 returns toll free numbers as an array of toll free number value entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.

Toll Number

Developer identifier: team_calendar_events.onlineMeeting.tollNumberToll Number. Toll phone number for dial-in. It supplies the toll number measure for the online meeting info at the provider’s declared unit and grain.

Enables: Measure toll number through team_calendar_events.OnlineMeetingInfo.tollNumber for each online meeting info and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports toll number as a measure on each online meeting info; compare only records with the same unit and aggregation grain.

Online Meeting URL

Developer identifier: team_calendar_events.onlineMeetingUrlOnline Meeting URL. URL for joining the online meeting (legacy property). It locates the provider resource or path associated with the team calendar event.

Enables: Associate each team calendar event with the resource identified by online meeting URL in team_calendar_events.onlineMeetingUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports online meeting URL as a resource locator for each team calendar event; access still depends on viewer permissions and the URL may expire or change.

Organizer

Developer identifier: team_calendar_events.organizerOrganizer. Organizer of the event with email and name. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute organizer in team_calendar_events.organizer to the parent team calendar event; identify parent records where that nested organizer object is absent.
Interpretation: Microsoft 365 reports organizer as a nested object on each team calendar event; optional children may be absent from a valid response.

Email Address

Developer identifier: team_calendar_events.organizer.emailAddressEmail Address. Email address and display name of the recipient. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute email address in team_calendar_events.Recipient.emailAddress to the parent team calendar event; identify parent records where that nested email address object is absent.
Interpretation: Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response.

Original End Time Zone

Developer identifier: team_calendar_events.originalEndTimeZoneOriginal End Time Zone. End time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the team calendar event in the provider’s intended zone.

Enables: Apply the zone in team_calendar_events.originalEndTimeZone when converting the team calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports original end time zone as a timezone identifier for each team calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Original Start Time Zone

Developer identifier: team_calendar_events.originalStartTimeZoneOriginal Start Time Zone. Start time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the team calendar event in the provider’s intended zone.

Enables: Apply the zone in team_calendar_events.originalStartTimeZone when converting the team calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports original start time zone as a timezone identifier for each team calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Recurrence

Developer identifier: team_calendar_events.recurrenceRecurrence. Recurrence pattern and range for recurring events. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute recurrence in team_calendar_events.recurrence to the parent team calendar event; identify parent records where that nested recurrence object is absent.
Interpretation: Microsoft 365 reports recurrence as a nested object on each team calendar event; optional children may be absent from a valid response.

Pattern

Developer identifier: team_calendar_events.recurrence.patternPattern. The frequency and rules of the recurrence. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute pattern in team_calendar_events.PatternedRecurrence.pattern to the parent team calendar event; identify parent records where that nested pattern object is absent.
Interpretation: Microsoft 365 reports pattern as a nested object on each patterned recurrence; optional children may be absent from a valid response.

Day Of Month

Developer identifier: team_calendar_events.recurrence.pattern.dayOfMonthDay Of Month. Day of the month for absoluteMonthly/absoluteYearly patterns. It supplies the day of month measure for the recurrence pattern at the provider’s declared unit and grain.

Enables: Measure day of month through team_calendar_events.RecurrencePattern.dayOfMonth for each recurrence pattern and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports day of month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.

Days Of Week

Developer identifier: team_calendar_events.recurrence.pattern.daysOfWeekDays Of Week. Days of the week the event occurs on. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Compare the exact Microsoft 365-configured days of week set in team_calendar_events.RecurrencePattern.daysOfWeek for each recurrence pattern; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns days of week as an array of recurrence pattern day of week enum entries on each recurrence pattern; missing, empty, and permission-redacted arrays are not equivalent.

First Day Of Week

Developer identifier: team_calendar_events.recurrence.pattern.firstDayOfWeekFirst Day Of Week. First day of the week for weekly patterns. It distinguishes the provider-defined first day of week state or classification for the recurrence pattern.

Enables: Segment recurrence pattern entries in Team Calendar Events by first day of week in team_calendar_events.RecurrencePattern.firstDayOfWeek; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports first day of week as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.

Index

Developer identifier: team_calendar_events.recurrence.pattern.indexIndex. Week index for relativeMonthly/relativeYearly patterns. It distinguishes the provider-defined index state or classification for the recurrence pattern.

Enables: Segment recurrence pattern entries in Team Calendar Events by index in team_calendar_events.RecurrencePattern.index; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports index as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.

Interval

Developer identifier: team_calendar_events.recurrence.pattern.intervalInterval. Number of units between occurrences (e.g. every 2 weeks). It supplies the interval boundary, band, or unit needed to interpret the companion measure.

Enables: Interpret team_calendar_events.RecurrencePattern.interval with its companion minimum, maximum, interval, or unit before comparing the interval across like-for-like records.
Interpretation: Microsoft 365 reports interval as a boundary, band, interval, or unit on each recurrence pattern; it is meaningful only with its companion measure and provider scale.

Month

Developer identifier: team_calendar_events.recurrence.pattern.monthMonth. Month in which the event occurs (1-12), for yearly patterns. It supplies the month measure for the recurrence pattern at the provider’s declared unit and grain.

Enables: Measure month through team_calendar_events.RecurrencePattern.month for each recurrence pattern and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.

Type

Developer identifier: team_calendar_events.recurrence.pattern.typeType. The recurrence pattern type. It distinguishes the provider-defined type state or classification for the recurrence pattern.

Enables: Segment recurrence pattern entries in Team Calendar Events by type in team_calendar_events.RecurrencePattern.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.

Range

Developer identifier: team_calendar_events.recurrence.rangeRange. The duration/bounds of the recurrence. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute range in team_calendar_events.PatternedRecurrence.range to the parent team calendar event; identify parent records where that nested range object is absent.
Interpretation: Microsoft 365 reports range as a nested object on each patterned recurrence; optional children may be absent from a valid response.

End Date

Developer identifier: team_calendar_events.recurrence.range.endDateEnd Date. End date of the recurrence range (YYYY-MM-DD). Used when type is endDate. It anchors the team calendar event on the provider’s reported timeline.

Enables: Filter Team Calendar Events by end date in team_calendar_events.RecurrenceRange.endDate; pair that boundary with the corresponding start before measuring elapsed time.
Interpretation: Microsoft 365 reports end date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.

Number Of Occurrences

Developer identifier: team_calendar_events.recurrence.range.numberOfOccurrencesNumber Of Occurrences. Number of occurrences. Used when type is numbered. It supplies the number of occurrences measure for the recurrence range at the provider’s declared unit and grain.

Enables: Measure number of occurrences through team_calendar_events.RecurrenceRange.numberOfOccurrences for each recurrence range and compare only values with the same unit and record grain.
Interpretation: Microsoft 365 reports number of occurrences as a measure on each recurrence range; compare only records with the same unit and aggregation grain.

Recurrence Time Zone

Developer identifier: team_calendar_events.recurrence.range.recurrenceTimeZoneRecurrence Time Zone. Time zone for the start and end dates. It is needed to interpret companion dates and times for the recurrence range in the provider’s intended zone.

Enables: Apply the zone in team_calendar_events.RecurrenceRange.recurrenceTimeZone when converting the team calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports recurrence time zone as a timezone identifier for each recurrence range; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Start Date

Developer identifier: team_calendar_events.recurrence.range.startDateStart Date. Start date of the recurrence range (YYYY-MM-DD). It anchors the team calendar event on the provider’s reported timeline.

Enables: Filter Team Calendar Events by start date in team_calendar_events.RecurrenceRange.startDate; pair that boundary with the corresponding end before measuring elapsed time.
Interpretation: Microsoft 365 reports start date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.

Type

Developer identifier: team_calendar_events.recurrence.range.typeType. The recurrence range type. It distinguishes the provider-defined type state or classification for the recurrence range.

Enables: Segment recurrence range entries in Team Calendar Events by type in team_calendar_events.RecurrenceRange.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each recurrence range; preserve unknown labels rather than mapping them by assumption.

Response Status

Developer identifier: team_calendar_events.responseStatusResponse Status. The response status and time of the current user for this event. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute response status in team_calendar_events.responseStatus to the parent team calendar event; identify parent records where that nested response status object is absent.
Interpretation: Microsoft 365 reports response status as a nested object on each team calendar event; optional children may be absent from a valid response.

Sensitivity

Developer identifier: team_calendar_events.sensitivitySensitivity. Sensitivity level of the event. It distinguishes the provider-defined sensitivity state or classification for the team calendar event.

Enables: Segment team calendar event entries in Team Calendar Events by sensitivity in team_calendar_events.sensitivity; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports sensitivity as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.

Series Master ID

Developer identifier: team_calendar_events.seriesMasterIdSeries Master ID. The ID of the recurring series master event, if this event is part of a recurring series. It provides the reference needed to connect the team calendar event to the corresponding provider object.

Enables: Connect each team calendar event in Team Calendar Events to the referenced series master through team_calendar_events.seriesMasterId; flag series master ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports series master ID as an identifier in its series master namespace; it is not a universal identity outside Microsoft 365.

Show As

Developer identifier: team_calendar_events.showAsShow As. Free/busy status shown during the event. It distinguishes the provider-defined show as state or classification for the team calendar event.

Enables: Segment team calendar event entries in Team Calendar Events by show as in team_calendar_events.showAs; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports show as as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.

Start

Developer identifier: team_calendar_events.startStart. Start date/time and timezone of the event. It preserves the nested context needed to interpret the parent team calendar event.

Enables: Attribute start in team_calendar_events.start to the parent team calendar event; identify parent records where that nested start object is absent.
Interpretation: Microsoft 365 reports start as a nested object on each team calendar event; optional children may be absent from a valid response.

Subject

Developer identifier: team_calendar_events.subjectSubject. Subject/title of the calendar event. It defines the content surface available for this team calendar event.

Enables: Locate team calendar event records by subject in team_calendar_events.subject; attribute each text match to its parent team calendar event and, when present, its reported author.
Interpretation: Microsoft 365 supplies subject as text on each team calendar event; referenced files or media are not implied unless explicitly represented.

Team ID

Developer identifier: team_calendar_events.team_idTeam ID. Parent team reference copied into each team calendar event because the child operation does not return that relationship. It provides the reference needed to connect the team calendar event to the corresponding provider object.

Enables: Connect each team calendar event in Team Calendar Events to the referenced team through team_calendar_events.team_id; flag team ID values that do not resolve in that provider namespace.
Interpretation: Parable copies team ID from the parent traversal record into each team calendar event; the child Microsoft 365 operation does not return it.

Type

Developer identifier: team_calendar_events.typeType. The event type: singleInstance, occurrence, exception, or seriesMaster. It distinguishes the provider-defined type state or classification for the team calendar event.

Enables: Segment team calendar event entries in Team Calendar Events by type in team_calendar_events.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.

Web Link

Developer identifier: team_calendar_events.webLinkWeb Link. URL to open the event in Outlook on the web. It locates the provider resource or path associated with the team calendar event.

Enables: Associate each team calendar event with the resource identified by web link in team_calendar_events.webLink; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports web link as a resource locator for each team calendar event; access still depends on viewer permissions and the URL may expire or change.

Team Details

Developer identifier: team_detailsTeam Details. Detailed settings for each team.

Enables: Match each Team to its detailed messaging, member, guest, discovery, and archival settings.
Scope: Reads the records selected by Microsoft 365’s /v1.0/teams/{id} operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

Classification

Developer identifier: team_details.classificationClassification. Classification of the team (e.g. low, medium, high business impact) when classifications are configured for the organization. It identifies the related provider object that gives the team detail its parent, owner, or container context.

Enables: Segment team detail entries in Team Details by classification in team_details.classification; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports classification as a label from its own taxonomy on each team detail; preserve unknown labels rather than mapping them by assumption. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.

Created Date Time

Developer identifier: team_details.createdDateTimeCreated Date Time. When the team was created. It anchors the team detail on the provider’s reported timeline.

Enables: Order Team Details by created date time in team_details.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each team detail; timezone and precision follow this API field, and absence is not an inferred event time.

Description

Developer identifier: team_details.descriptionDescription. Optional description of the team. It defines the content surface available for this team detail.

Enables: Locate team detail records by description in team_details.description; attribute each text match to its parent team detail and, when present, its reported author.
Interpretation: Microsoft 365 supplies description as text on each team detail; referenced files or media are not implied unless explicitly represented.

Display Name

Developer identifier: team_details.displayNameDisplay Name. Name of the team as displayed to users. It distinguishes the provider-defined display name state or classification for the team detail.

Enables: Label each team detail with display name from team_details.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each team detail; names are mutable and are not stable identities.

Fun Settings

Developer identifier: team_details.funSettingsFun Settings. Settings that control fun content (giphy, stickers, memes) in the team. It preserves the nested context needed to interpret the parent team detail.

Enables: Attribute fun settings in team_details.funSettings to the parent team detail; identify parent records where that nested fun settings object is absent.
Interpretation: Microsoft 365 reports fun settings as a nested object on each team detail; optional children may be absent from a valid response.

Allow Custom Memes

Developer identifier: team_details.funSettings.allowCustomMemesAllow Custom Memes. Whether custom memes can be used in the team. It distinguishes the provider-defined allow custom memes state or classification for the team fun setting.

Enables: Filter Team Details by whether custom memes can be used in the team in team_details.TeamFunSettings.allowCustomMemes; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports custom memes can be used in the team as a boolean on each team fun setting; a missing field is unknown, not false.

Allow Giphy

Developer identifier: team_details.funSettings.allowGiphyAllow Giphy. Whether Giphy can be used in the team. It distinguishes the provider-defined allow giphy state or classification for the team fun setting.

Enables: Filter Team Details by whether giphy can be used in the team in team_details.TeamFunSettings.allowGiphy; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports giphy can be used in the team as a boolean on each team fun setting; a missing field is unknown, not false.

Allow Stickers And Memes

Developer identifier: team_details.funSettings.allowStickersAndMemesAllow Stickers And Memes. Whether stickers and memes can be used in the team. It distinguishes the provider-defined allow stickers and memes state or classification for the team fun setting.

Enables: Filter Team Details by whether stickers and memes can be used in the team in team_details.TeamFunSettings.allowStickersAndMemes; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports stickers and memes can be used in the team as a boolean on each team fun setting; a missing field is unknown, not false.

Giphy Content Rating

Developer identifier: team_details.funSettings.giphyContentRatingGiphy Content Rating. Giphy content rating: moderate or strict. It distinguishes the provider-defined giphy content rating state or classification for the team fun setting.

Enables: Segment team fun setting entries in Team Details by giphy content rating in team_details.TeamFunSettings.giphyContentRating; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports giphy content rating as a label from its own taxonomy on each team fun setting; preserve unknown labels rather than mapping them by assumption.

Guest Settings

Developer identifier: team_details.guestSettingsGuest Settings. Settings that control what guests can do in the team. It preserves the nested context needed to interpret the parent team detail.

Enables: Attribute guest settings in team_details.guestSettings to the parent team detail; identify parent records where that nested guest settings object is absent.
Interpretation: Microsoft 365 reports guest settings as a nested object on each team detail; optional children may be absent from a valid response.

Allow Create Update Channels

Developer identifier: team_details.guestSettings.allowCreateUpdateChannelsAllow Create Update Channels. Whether guests can add and update channels. It distinguishes the provider-defined allow create update channels state or classification for the team guest setting.

Enables: Filter Team Details by whether guests can add and update channels in team_details.TeamGuestSettings.allowCreateUpdateChannels; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports guests can add and update channels as a boolean on each team guest setting; a missing field is unknown, not false.

Allow Delete Channels

Developer identifier: team_details.guestSettings.allowDeleteChannelsAllow Delete Channels. Whether guests can delete channels. It distinguishes the provider-defined allow delete channels state or classification for the team guest setting.

Enables: Filter Team Details by whether guests can delete channels in team_details.TeamGuestSettings.allowDeleteChannels; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports guests can delete channels as a boolean on each team guest setting; a missing field is unknown, not false.

Developer identifier: team_details.idID. Unique identifier for the team. It provides the reference needed to connect the team detail to the corresponding provider object.

Enables: Match repeated team detail entries on ID in team_details.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its team detail namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Internal ID

Developer identifier: team_details.internalIdInternal ID. Unique identifier used by Teams telemetry (not the same as ID). It provides the reference needed to connect the team detail to the corresponding provider object.

Enables: Connect each team detail in Team Details to the referenced internal through team_details.internalId; flag internal ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports internal ID as an identifier in its internal namespace; it is not a universal identity outside Microsoft 365.

Is Archived

Developer identifier: team_details.isArchivedIs Archived. Whether the team is currently archived (read-only). It distinguishes the provider-defined is archived state or classification for the team detail.

Enables: Filter Team Details by whether the team is currently archived (read-only) in team_details.isArchived; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the team is currently archived (read-only) as a boolean on each team detail; a missing field is unknown, not false.

Member Settings

Developer identifier: team_details.memberSettingsMember Settings. Settings that control what members can do in the team. It preserves the nested context needed to interpret the parent team detail.

Enables: Attribute member settings in team_details.memberSettings to the parent team detail; identify parent records where that nested member settings object is absent.
Interpretation: Microsoft 365 reports member settings as a nested object on each team detail; optional children may be absent from a valid response.

Allow Add Remove Apps

Developer identifier: team_details.memberSettings.allowAddRemoveAppsAllow Add Remove Apps. Whether members can add or remove apps. It distinguishes the provider-defined allow add remove apps state or classification for the team member setting.

Enables: Filter Team Details by whether members can add or remove apps in team_details.TeamMemberSettings.allowAddRemoveApps; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports members can add or remove apps as a boolean on each team member setting; a missing field is unknown, not false.

Allow Create Private Channels

Developer identifier: team_details.memberSettings.allowCreatePrivateChannelsAllow Create Private Channels. Whether members can add private channels. It distinguishes the provider-defined allow create private channels state or classification for the team member setting.

Enables: Filter Team Details by whether members can add private channels in team_details.TeamMemberSettings.allowCreatePrivateChannels; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports members can add private channels as a boolean on each team member setting; a missing field is unknown, not false.

Allow Create Update Channels

Developer identifier: team_details.memberSettings.allowCreateUpdateChannelsAllow Create Update Channels. Whether members can add and update channels. It distinguishes the provider-defined allow create update channels state or classification for the team member setting.

Enables: Filter Team Details by whether members can add and update channels in team_details.TeamMemberSettings.allowCreateUpdateChannels; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports members can add and update channels as a boolean on each team member setting; a missing field is unknown, not false.

Allow Create Update Remove Connectors

Developer identifier: team_details.memberSettings.allowCreateUpdateRemoveConnectorsAllow Create Update Remove Connectors. Whether members can add, update, and remove connectors. It distinguishes the provider-defined allow create update remove connectors state or classification for the team member setting.

Enables: Filter Team Details by whether members can add, update, and remove connectors in team_details.TeamMemberSettings.allowCreateUpdateRemoveConnectors; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports members can add, update, and remove connectors as a boolean on each team member setting; a missing field is unknown, not false.

Allow Create Update Remove Tabs

Developer identifier: team_details.memberSettings.allowCreateUpdateRemoveTabsAllow Create Update Remove Tabs. Whether members can add, update, and remove tabs. It distinguishes the provider-defined allow create update remove tabs state or classification for the team member setting.

Enables: Filter Team Details by whether members can add, update, and remove tabs in team_details.TeamMemberSettings.allowCreateUpdateRemoveTabs; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports members can add, update, and remove tabs as a boolean on each team member setting; a missing field is unknown, not false.

Allow Delete Channels

Developer identifier: team_details.memberSettings.allowDeleteChannelsAllow Delete Channels. Whether members can delete channels. It distinguishes the provider-defined allow delete channels state or classification for the team member setting.

Enables: Filter Team Details by whether members can delete channels in team_details.TeamMemberSettings.allowDeleteChannels; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports members can delete channels as a boolean on each team member setting; a missing field is unknown, not false.

Messaging Settings

Developer identifier: team_details.messagingSettingsMessaging Settings. Settings that control messaging and mentions in the team. It preserves the nested context needed to interpret the parent team detail.

Enables: Attribute messaging settings in team_details.messagingSettings to the parent team detail; identify parent records where that nested messaging settings object is absent.
Interpretation: Microsoft 365 reports messaging settings as a nested object on each team detail; optional children may be absent from a valid response.

Allow Channel Mentions

Developer identifier: team_details.messagingSettings.allowChannelMentionsAllow Channel Mentions. Whether @channel mentions are allowed. It distinguishes the provider-defined allow channel mentions state or classification for the team messaging setting.

Enables: Filter Team Details by whether @channel mentions are allowed in team_details.TeamMessagingSettings.allowChannelMentions; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports @channel mentions are allowed as a boolean on each team messaging setting; a missing field is unknown, not false.

Allow Owner Delete Messages

Developer identifier: team_details.messagingSettings.allowOwnerDeleteMessagesAllow Owner Delete Messages. Whether owners can delete any message. It distinguishes the provider-defined allow owner delete messages state or classification for the team messaging setting.

Enables: Filter Team Details by whether owners can delete any message in team_details.TeamMessagingSettings.allowOwnerDeleteMessages; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports owners can delete any message as a boolean on each team messaging setting; a missing field is unknown, not false.

Allow Team Mentions

Developer identifier: team_details.messagingSettings.allowTeamMentionsAllow Team Mentions. Whether @team mentions are allowed. It distinguishes the provider-defined allow team mentions state or classification for the team messaging setting.

Enables: Filter Team Details by whether @team mentions are allowed in team_details.TeamMessagingSettings.allowTeamMentions; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports @team mentions are allowed as a boolean on each team messaging setting; a missing field is unknown, not false.

Allow User Delete Messages

Developer identifier: team_details.messagingSettings.allowUserDeleteMessagesAllow User Delete Messages. Whether users can delete their own messages. It distinguishes the provider-defined allow user delete messages state or classification for the team messaging setting.

Enables: Filter Team Details by whether users can delete their own messages in team_details.TeamMessagingSettings.allowUserDeleteMessages; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports users can delete their own messages as a boolean on each team messaging setting; a missing field is unknown, not false.

Allow User Edit Messages

Developer identifier: team_details.messagingSettings.allowUserEditMessagesAllow User Edit Messages. Whether users can edit their own messages. It distinguishes the provider-defined allow user edit messages state or classification for the team messaging setting.

Enables: Filter Team Details by whether users can edit their own messages in team_details.TeamMessagingSettings.allowUserEditMessages; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports users can edit their own messages as a boolean on each team messaging setting; a missing field is unknown, not false.

Specialization

Developer identifier: team_details.specializationSpecialization. Creation-time specialization of the team (evolvable enum, e.g. none, educationStandard, educationClass, healthcareStandard). Stored as string because Microsoft adds values over time (education/healthcare variants) and a strict enum would quarantine records on any new value. It identifies the related provider object that gives the team detail its parent, owner, or container context.

Enables: Connect each team detail to the related specialization in team_details.specialization and verify that the referenced provider object resolves in the expected parent or container.
Interpretation: Microsoft 365 reports specialization as relationship context on each team detail; resolve it in the named provider namespace rather than by display text alone.

Team ID

Developer identifier: team_details.team_idTeam ID. Parent team reference copied into each team detail because the child operation does not return that relationship. It provides the reference needed to connect the team detail to the corresponding provider object.

Enables: Connect each team detail in Team Details to the referenced team through team_details.team_id; flag team ID values that do not resolve in that provider namespace.
Interpretation: Parable copies team ID from the parent traversal record into each team detail; the child Microsoft 365 operation does not return it.

Tenant ID

Developer identifier: team_details.tenantIdTenant ID. Identifier (GUID) of the Microsoft Entra tenant the team belongs to. Kept as string (not Identity.UUID) to match this connector’s ID-field convention. It provides the reference needed to connect the team detail to the corresponding provider object.

Enables: Connect each team detail in Team Details to the referenced tenant through team_details.tenantId; flag tenant ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.

Visibility

Developer identifier: team_details.visibilityVisibility. Visibility of the underlying group: private, public, or hiddenMembership. It distinguishes the provider-defined visibility state or classification for the team detail.

Enables: Segment team detail entries in Team Details by visibility in team_details.visibility; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports visibility as a label from its own taxonomy on each team detail; preserve unknown labels rather than mapping them by assumption.

Web URL

Developer identifier: team_details.webUrlWeb URL. URL to open the team in the Microsoft Teams client. It locates the provider resource or path associated with the team detail.

Enables: Associate each team detail with the resource identified by web URL in team_details.webUrl; verify the link resolves to the expected Microsoft 365 object.
Interpretation: Microsoft 365 reports web URL as a resource locator for each team detail; access still depends on viewer permissions and the URL may expire or change.

Teams

Developer identifier: teamsTeams. Microsoft Teams represented as groups.

Enables: Inventory Entra groups provisioned as Teams and preserve their visibility, lifecycle, and mail settings for child traversal.
Scope: Reads the records selected by Microsoft 365’s /v1.0/groups operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

Classification

Developer identifier: teams.classificationClassification. Classification of the group (e.g. Low, Medium, High) when classifications are configured for the organization. It distinguishes the provider-defined classification state or classification for the team.

Enables: Segment team entries in Teams by classification in teams.classification; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports classification as a label from its own taxonomy on each team; preserve unknown labels rather than mapping them by assumption. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.

Created Date Time

Developer identifier: teams.createdDateTimeCreated Date Time. When the group was created. It anchors the team on the provider’s reported timeline.

Enables: Order Teams by created date time in teams.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.

Deleted Date Time

Developer identifier: teams.deletedDateTimeDeleted Date Time. When the group was soft-deleted, if it is in the deleted items. It anchors the team on the provider’s reported timeline.

Enables: Order Teams by deleted date time in teams.deletedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports deleted date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.

Description

Developer identifier: teams.descriptionDescription. Description of the group. It defines the content surface available for this team.

Enables: Locate team records by description in teams.description; attribute each text match to its parent team and, when present, its reported author.
Interpretation: Microsoft 365 supplies description as text on each team; referenced files or media are not implied unless explicitly represented.

Display Name

Developer identifier: teams.displayNameDisplay Name. Display name of the group. It distinguishes the provider-defined display name state or classification for the team.

Enables: Label each team with display name from teams.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each team; names are mutable and are not stable identities.

Expiration Date Time

Developer identifier: teams.expirationDateTimeExpiration Date Time. When the group is set to expire under the group lifecycle policy. It anchors the team on the provider’s reported timeline.

Enables: Order Teams by expiration date time in teams.expirationDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports expiration date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.

Group Types

Developer identifier: teams.groupTypesGroup Types. Group type markers (e.g. Unified for M365 groups, DynamicMembership). It preserves the nested context needed to interpret the parent team.

Enables: Compare the exact Microsoft 365-configured group types set in teams.groupTypes for each team; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns group types as an array of group type value entries on each team; missing, empty, and permission-redacted arrays are not equivalent.

Developer identifier: teams.idID. Unique identifier for the group. It provides the reference needed to connect the team to the corresponding provider object.

Enables: Match repeated team entries on ID in teams.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its team namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Mail

Developer identifier: teams.mailMail. SMTP address for the group. It supplies the provider-reported address or location facet for the team, not a residency determination.

Enables: Group Teams by the exact mail in teams.mail while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports mail as an address or location facet on each team; it does not establish verified geolocation or data residency.

Mail Enabled

Developer identifier: teams.mailEnabledMail Enabled. Whether the group is mail-enabled. It distinguishes the provider-defined mail enabled state or classification for the team.

Enables: Filter Teams by whether the group is mail-enabled in teams.mailEnabled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the group is mail-enabled as a boolean on each team; a missing field is unknown, not false.

Mail Nickname

Developer identifier: teams.mailNicknameMail Nickname. Mail alias for the group. It supplies the mail nickname profile facet used to reconcile or attribute the team.

Enables: Reconcile the team’s mail nickname in teams.mailNickname with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
Interpretation: Microsoft 365 reports mail nickname as a mutable profile or directory attribute on each team; it may be absent, shared, or non-unique.

Renewed Date Time

Developer identifier: teams.renewedDateTimeRenewed Date Time. When the group was last renewed under the group lifecycle policy. It anchors the team on the provider’s reported timeline.

Enables: Order Teams by renewed date time in teams.renewedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports renewed date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.

Resource Provisioning Options

Developer identifier: teams.resourceProvisioningOptionsResource Provisioning Options. Provisioned resources for the group (e.g. Team). It preserves the nested context needed to interpret the parent team.

Enables: Compare the exact Microsoft 365-configured resource provisioning options set in teams.resourceProvisioningOptions for each team; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns resource provisioning options as an array of resource provisioning option value entries on each team; missing, empty, and permission-redacted arrays are not equivalent.

Security Enabled

Developer identifier: teams.securityEnabledSecurity Enabled. Whether the group is a security group. It distinguishes the provider-defined security enabled state or classification for the team.

Enables: Filter Teams by whether the group is a security group in teams.securityEnabled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the group is a security group as a boolean on each team; a missing field is unknown, not false.

Visibility

Developer identifier: teams.visibilityVisibility. Group visibility: Public, Private, or HiddenMembership. It distinguishes the provider-defined visibility state or classification for the team.

Enables: Segment team entries in Teams by visibility in teams.visibility; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports visibility as a label from its own taxonomy on each team; preserve unknown labels rather than mapping them by assumption.

User Calendar Events

Developer identifier: user_calendar_eventsUser Calendar Events. DEPRECATED expansion tap. Duplicates the calendar_events tap with a narrower $select. The legacy ingestion-service only defines a single user-calendar tap (calendar_events). Disabled by default; retained for backward compatibility.

Enables: Preserve the deprecated narrower calendar projection for compatibility while directing new workflows to Calendar Events.
Scope: Reads the records selected by Microsoft 365’s /v1.0/users/{id}/calendarView operation as an event stream using incremental synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. This opt-in stream is deprecated, duplicates Calendar Events with a narrower selection, and is retained only for compatibility. This stream supplies no reliable deletion signal.

@odata ETag

Developer identifier: user_calendar_events.@odata.etag@odata ETag. OData entity tag for concurrency. It is needed for conditional reads and provider-version checks, not as a stable business identifier.

Enables: Use user_calendar_events.@odata.etag for conditional provider reads and revision checks; pair the ETag with the user calendar event ID rather than joining on it.
Interpretation: Microsoft 365 returns this ETag as an opaque revision token for each user calendar event; it can change when the resource changes and is not a universal identifier.

Attendees

Developer identifier: user_calendar_events.attendeesAttendees. List of attendees. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Attribute each returned attendee in user_calendar_events.attendees to the parent user calendar event; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
Interpretation: Microsoft 365 returns attendees as an array of attendee entries on each user calendar event; missing, empty, and permission-redacted arrays are not equivalent.

Email Address

Developer identifier: user_calendar_events.attendees.emailAddressEmail Address. The structured email address details attached to each attendee in User Calendar Events. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Match repeated attendee entries on email address in user_calendar_events.Attendee.emailAddress; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports email address as a nested object on each attendee; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.

Address

Developer identifier: user_calendar_events.attendees.emailAddress.addressAddress. Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

Enables: Attribute each email address to a person or account by the exact address in user_calendar_events.EmailAddress.address; identify addresses that do not match the Microsoft 365 directory.
Interpretation: Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match.

Name

Developer identifier: user_calendar_events.attendees.emailAddress.nameName. The provider-reported name for each email address in User Calendar Events. It gives the email address a human-readable provider label while its identifier remains the stable reference.

Enables: Label each email address with name from user_calendar_events.EmailAddress.name; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.

Status

Developer identifier: user_calendar_events.attendees.statusStatus. The structured status details attached to each attendee in User Calendar Events. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Attribute status in user_calendar_events.Attendee.status to the parent user calendar event; identify parent records where that nested status object is absent.
Interpretation: Microsoft 365 reports status as a nested object on each attendee; optional children may be absent from a valid response.

Response

Developer identifier: user_calendar_events.attendees.status.responseResponse. Response type (none, organizer, tentativelyAccepted, accepted, declined, notResponded). It defines the content surface available for this user calendar event.

Enables: Locate response status records by response in user_calendar_events.ResponseStatus.response; attribute each text match to its parent user calendar event and, when present, its reported author.
Interpretation: Microsoft 365 supplies response as text on each response status; referenced files or media are not implied unless explicitly represented.

Time

Developer identifier: user_calendar_events.attendees.status.timeTime. Response timestamp. It anchors the user calendar event on the provider’s reported timeline.

Enables: Order User Calendar Events by time in user_calendar_events.ResponseStatus.time and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports time as a timestamp on each response status; timezone and precision follow this API field, and absence is not an inferred event time.

Type

Developer identifier: user_calendar_events.attendees.typeType. Attendee type (required, optional, resource). It distinguishes the provider-defined type state or classification for the attendee.

Enables: Segment attendee entries in User Calendar Events by type in user_calendar_events.Attendee.type; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports type as a label from its own taxonomy on each attendee; preserve unknown labels rather than mapping them by assumption.

Body Preview

Developer identifier: user_calendar_events.bodyPreviewBody Preview. Plain text preview of the event body. It defines the content surface available for this user calendar event.

Enables: Locate user calendar event records whose body preview in user_calendar_events.bodyPreview contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
Interpretation: This is an excerpt supplied by the provider, not the complete body or an attachment.

Created Date Time

Developer identifier: user_calendar_events.createdDateTimeCreated Date Time. Event creation timestamp. It anchors the user calendar event on the provider’s reported timeline.

Enables: Order User Calendar Events by created date time in user_calendar_events.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each user calendar event; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.

End

Developer identifier: user_calendar_events.endEnd. Event end date/time with timezone. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Attribute end in user_calendar_events.end to the parent user calendar event; identify parent records where that nested end object is absent.
Interpretation: Microsoft 365 reports end as a nested object on each user calendar event; optional children may be absent from a valid response.

Date Time

Developer identifier: user_calendar_events.end.dateTimeDate Time. Date and time in ISO 8601 format. It anchors the user calendar event on the provider’s reported timeline.

Enables: Order User Calendar Events by date time in user_calendar_events.DateTimeTimeZone.dateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports date time as a timestamp on each date time time zone; timezone and precision follow this API field, and absence is not an inferred event time.

Time Zone

Developer identifier: user_calendar_events.end.timeZoneTime Zone. IANA timezone identifier. It is needed to interpret companion dates and times for the date time time zone in the provider’s intended zone.

Enables: Apply the zone in user_calendar_events.DateTimeTimeZone.timeZone when converting the user calendar event’s companion start, end, or scheduled timestamps; do not infer it from locale.
Interpretation: Microsoft 365 reports time zone as a timezone identifier for each date time time zone; supported IANA or provider-specific names and daylight-saving behavior must be preserved.

Developer identifier: user_calendar_events.idID. Unique event identifier. It provides the reference needed to connect the user calendar event to the corresponding provider object.

Enables: Match repeated user calendar event entries on ID in user_calendar_events.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its user calendar event namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Importance

Developer identifier: user_calendar_events.importanceImportance. Event importance (low, normal, high). It distinguishes the provider-defined importance state or classification for the user calendar event.

Enables: Filter User Calendar Events by the exact Microsoft 365-defined importance in user_calendar_events.importance and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies importance from its own taxonomy on each user calendar event; preserve unknown and newly introduced labels.

Is All Day

Developer identifier: user_calendar_events.isAllDayIs All Day. Whether this is an all-day event. It distinguishes the provider-defined is all day state or classification for the user calendar event.

Enables: Filter User Calendar Events by whether this is an all-day event in user_calendar_events.isAllDay; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports this is an all-day event as a boolean on each user calendar event; a missing field is unknown, not false.

Is Cancelled

Developer identifier: user_calendar_events.isCancelledIs Cancelled. Whether the event is cancelled. It distinguishes the provider-defined is cancelled state or classification for the user calendar event.

Enables: Filter User Calendar Events by whether the event is cancelled in user_calendar_events.isCancelled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the event is cancelled as a boolean on each user calendar event; a missing field is unknown, not false.

Last Modified Date Time

Developer identifier: user_calendar_events.lastModifiedDateTimeLast Modified Date Time. Last modification timestamp. It anchors the user calendar event on the provider’s reported timeline.

Enables: Order User Calendar Events by last modified date time in user_calendar_events.lastModifiedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports last modified date time as a timestamp on each user calendar event; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.

Location

Developer identifier: user_calendar_events.locationLocation. Event location. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Attribute location in user_calendar_events.location to the parent user calendar event; identify parent records where that nested location object is absent.
Interpretation: Microsoft 365 reports location as a nested object on each user calendar event; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.

Display Name

Developer identifier: user_calendar_events.location.displayNameDisplay Name. Location display name. It distinguishes the provider-defined display name state or classification for the location.

Enables: Label each location with display name from user_calendar_events.Location.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each location; names are mutable and are not stable identities.

Location Type

Developer identifier: user_calendar_events.location.locationTypeLocation Type. Location type. It supplies the provider-reported address or location facet for the location, not a residency determination.

Enables: Group User Calendar Events by location type in user_calendar_events.Location.locationType without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports location type as a user, device, request, or resource location attribute on each location; it does not establish where data is stored or processed.

Organizer

Developer identifier: user_calendar_events.organizerOrganizer. Event organizer. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Attribute organizer in user_calendar_events.organizer to the parent user calendar event; identify parent records where that nested organizer object is absent.
Interpretation: Microsoft 365 reports organizer as a nested object on each user calendar event; optional children may be absent from a valid response.

Email Address

Developer identifier: user_calendar_events.organizer.emailAddressEmail Address. The structured email address details attached to each recipient in User Calendar Events. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Attribute email address in user_calendar_events.Recipient.emailAddress to the parent user calendar event; identify parent records where that nested email address object is absent.
Interpretation: Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response.

Sensitivity

Developer identifier: user_calendar_events.sensitivitySensitivity. Event sensitivity (normal, personal, private, confidential). It distinguishes the provider-defined sensitivity state or classification for the user calendar event.

Enables: Filter User Calendar Events by the exact Microsoft 365-defined sensitivity in user_calendar_events.sensitivity and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies sensitivity from its own taxonomy on each user calendar event; preserve unknown and newly introduced labels.

Show As

Developer identifier: user_calendar_events.showAsShow As. Free/busy status (free, tentative, busy, oof, workingElsewhere, unknown). It distinguishes the provider-defined show as state or classification for the user calendar event.

Enables: Filter User Calendar Events by the exact Microsoft 365-defined show as in user_calendar_events.showAs and preserve unknown values as distinct categories.
Interpretation: Microsoft 365 supplies show as from its own taxonomy on each user calendar event; preserve unknown and newly introduced labels.

Start

Developer identifier: user_calendar_events.startStart. Event start date/time with timezone. It preserves the nested context needed to interpret the parent user calendar event.

Enables: Attribute start in user_calendar_events.start to the parent user calendar event; identify parent records where that nested start object is absent.
Interpretation: Microsoft 365 reports start as a nested object on each user calendar event; optional children may be absent from a valid response.

Subject

Developer identifier: user_calendar_events.subjectSubject. Event subject/title. It defines the content surface available for this user calendar event.

Enables: Locate user calendar event records by subject in user_calendar_events.subject; attribute each text match to its parent user calendar event and, when present, its reported author.
Interpretation: Microsoft 365 supplies subject as text on each user calendar event; referenced files or media are not implied unless explicitly represented.

Users

Developer identifier: usersUsers. Microsoft Entra ID users.

Enables: Reconcile Microsoft Entra users to account status, directory identity, organization, licenses, job attributes, and synchronization state.
Scope: Reads the records selected by Microsoft 365’s /v1.0/users operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

Account Enabled

Developer identifier: users.accountEnabledAccount Enabled. Whether the user account is enabled. It distinguishes the provider-defined account enabled state or classification for the user.

Enables: Filter Users by whether the user account is enabled in users.accountEnabled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the user account is enabled as a boolean on each user; a missing field is unknown, not false.

Assigned Licenses

Developer identifier: users.assignedLicensesAssigned Licenses. Licenses assigned to the user, including inherited (group-based) licenses. It preserves the nested context needed to interpret the parent user.

Enables: Compare the exact Microsoft 365-configured assigned licenses set in users.assignedLicenses for each user; preserve provider labels and unknown entries.
Interpretation: Microsoft 365 returns assigned licenses as an array of assigned license entries on each user; missing, empty, and permission-redacted arrays are not equivalent.

Disabled Plans

Developer identifier: users.assignedLicenses.disabledPlansDisabled Plans. Unique identifiers (GUIDs) for the service plans disabled within this license assignment. It preserves the nested context needed to interpret the parent user.

Enables: Connect the parent user to every referenced disabled plan value in users.AssignedLicense.disabledPlans; identify provider IDs that do not resolve to the expected related object.
Interpretation: Microsoft 365 returns disabled plans as an array of disabled plan value entries on each assigned license; missing, empty, and permission-redacted arrays are not equivalent.

Sku ID

Developer identifier: users.assignedLicenses.skuIdSku ID. Unique identifier (GUID) for the SKU of the assigned license. Kept as string (not Identity.UUID) to match this connector’s ID-field convention and avoid quarantining records if Microsoft returns a non-canonical GUID form. It provides the reference needed to connect the user to the corresponding provider object.

Enables: Match repeated assigned license entries on sku ID in users.AssignedLicense.skuId; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports sku ID as an identifier in its sku namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

City

Developer identifier: users.cityCity. City of the user’s address. It supplies the provider-reported address or location facet for the user, not a residency determination.

Enables: Group Users by city in users.city without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports city as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.

Company Name

Developer identifier: users.companyNameCompany Name. Company name associated with the user. It gives the user a human-readable provider label while its identifier remains the stable reference.

Enables: Label each user with company name from users.companyName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports company name as display text for each user; names are mutable and are not stable identities.

Country

Developer identifier: users.countryCountry. Country or region of the user’s address. It supplies the provider-reported address or location facet for the user, not a residency determination.

Enables: Group Users by country in users.country without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports country as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.

Created Date Time

Developer identifier: users.createdDateTimeCreated Date Time. When the user account was created. It anchors the user on the provider’s reported timeline.

Enables: Order Users by created date time in users.createdDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports created date time as a timestamp on each user; timezone and precision follow this API field, and absence is not an inferred event time.

Creation Type

Developer identifier: users.creationTypeCreation Type. How the user account was created (e.g. Invitation, LocalAccount). It distinguishes the provider-defined creation type state or classification for the user.

Enables: Segment user entries in Users by creation type in users.creationType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports creation type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.

Deleted Date Time

Developer identifier: users.deletedDateTimeDeleted Date Time. When the user was soft-deleted, if in the deleted items. It anchors the user on the provider’s reported timeline.

Enables: Order Users by deleted date time in users.deletedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports deleted date time as a timestamp on each user; timezone and precision follow this API field, and absence is not an inferred event time.

Department

Developer identifier: users.departmentDepartment. Department the user belongs to. It identifies the related provider object that gives the user its parent, owner, or container context.

Enables: Connect each user to the related department in users.department and verify that the referenced provider object resolves in the expected parent or container.
Interpretation: Microsoft 365 reports department as relationship context on each user; resolve it in the named provider namespace rather than by display text alone.

Display Name

Developer identifier: users.displayNameDisplay Name. Full display name of the user. It distinguishes the provider-defined display name state or classification for the user.

Enables: Label each user with display name from users.displayName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports display name as display text for each user; names are mutable and are not stable identities. A connector directive maps this field to a person’s display name.

Employee ID

Developer identifier: users.employeeIdEmployee ID. Employee identifier assigned by the organization. It provides the reference needed to connect the user to the corresponding provider object.

Enables: Connect each user in Users to the referenced employee through users.employeeId; flag employee ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports employee ID as an identifier in its employee namespace; it is not a universal identity outside Microsoft 365.

Employee Type

Developer identifier: users.employeeTypeEmployee Type. Type of worker (e.g. Employee, Contractor, Vendor). It distinguishes the provider-defined employee type state or classification for the user.

Enables: Segment user entries in Users by employee type in users.employeeType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports employee type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.

Given Name

Developer identifier: users.givenNameGiven Name. First name of the user. It gives the user a human-readable provider label while its identifier remains the stable reference.

Enables: Label each user with given name from users.givenName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports given name as display text for each user; names are mutable and are not stable identities.

Developer identifier: users.idID. Unique identifier for the user in Entra ID. It provides the reference needed to connect the user to the corresponding provider object.

Enables: Match repeated user entries on ID in users.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key. A connector directive maps this field to account identity.

Identities

Developer identifier: users.identitiesIdentities. Identities used to sign in to the account (local, social, or federated). It preserves the nested context needed to interpret the parent user.

Enables: Reconcile each returned object identity in users.identities with the parent user’s provider profile; preserve distinct aliases, contact points, and organization attributes.
Interpretation: Microsoft 365 returns identities as an array of object identity entries on each user; missing, empty, and permission-redacted arrays are not equivalent.

Issuer

Developer identifier: users.identities.issuerIssuer. Issuer of the identity (e.g. the tenant domain or an external identity provider). It supplies the issuer profile facet used to reconcile or attribute the object identity.

Enables: Match repeated object identity entries on issuer in users.ObjectIdentity.issuer; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports issuer on each object identity; missing and empty values can have different meanings. The connector explicitly marks this field as a transform deduplication key.

Issuer Assigned ID

Developer identifier: users.identities.issuerAssignedIdIssuer Assigned ID. Identifier assigned to the user by the issuer. It provides the reference needed to connect the user to the corresponding provider object.

Enables: Match repeated object identity entries on issuer assigned ID in users.ObjectIdentity.issuerAssignedId; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports issuer assigned ID as an identifier in its issuer assigned namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Developer identifier: users.identities.signInTypeSign In Type. Sign-in type of the identity (e.g. emailAddress, userName, federated). It distinguishes the provider-defined sign in type state or classification for the object identity.

Enables: Segment object identity entries in Users by sign in type in users.ObjectIdentity.signInType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports sign in type as a label from its own taxonomy on each object identity; preserve unknown labels rather than mapping them by assumption.

Job Title

Developer identifier: users.jobTitleJob Title. User’s job title. It supplies the job title profile facet used to reconcile or attribute the user.

Enables: Label each user with job title from users.jobTitle; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports job title as display text for each user; names are mutable and are not stable identities.

Last Password Change Date Time

Developer identifier: users.lastPasswordChangeDateTimeLast Password Change Date Time. When the user last changed their password. It anchors the user on the provider’s reported timeline.

Enables: Order Users by last password change date time in users.lastPasswordChangeDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports last password change date time as a timestamp on each user; timezone and precision follow this API field, and absence is not an inferred event time.

Mail

Developer identifier: users.mailMail. SMTP email address of the user. It supplies the provider-reported address or location facet for the user, not a residency determination.

Enables: Group Users by the exact mail in users.mail while keeping that address or location separate from geolocation and residency claims.
Interpretation: Microsoft 365 reports mail as an address or location facet on each user; it does not establish verified geolocation or data residency. A connector directive maps this field to a person’s email identity.

Mail Nickname

Developer identifier: users.mailNicknameMail Nickname. Mail alias for the user. It supplies the mail nickname profile facet used to reconcile or attribute the user.

Enables: Reconcile the user’s mail nickname in users.mailNickname with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
Interpretation: Microsoft 365 reports mail nickname as a mutable profile or directory attribute on each user; it may be absent, shared, or non-unique.

Member Of

Developer identifier: users.memberOfMember Of. Groups and directory roles the user is a member of, expanded via

expand=memberOf(

select=ID,deletedDateTime). It preserves the nested context needed to interpret the parent user.

Enables: Match every returned directory object ref in users.memberOf to the parent user; use the element’s provider identity or role to reconcile membership and attribution.
Interpretation: Microsoft 365 returns member of as an array of directory object ref entries on each user; missing, empty, and permission-redacted arrays are not equivalent.

Deleted Date Time

Developer identifier: users.memberOf.deletedDateTimeDeleted Date Time. When the directory object was soft-deleted, if applicable. It anchors the user on the provider’s reported timeline.

Enables: Order Users by deleted date time in users.DirectoryObjectRef.deletedDateTime and isolate records inside an exact provider reporting window.
Interpretation: Microsoft 365 reports deleted date time as a timestamp on each directory object ref; timezone and precision follow this API field, and absence is not an inferred event time.

Developer identifier: users.memberOf.idID. Unique identifier of the directory object. It provides the reference needed to connect the user to the corresponding provider object.

Enables: Match repeated directory object ref entries on ID in users.DirectoryObjectRef.id; collapse only entries that share this declared transform key.
Interpretation: Microsoft 365 reports ID as an identifier in its directory object ref namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.

Office Location

Developer identifier: users.officeLocationOffice Location. Physical office location of the user. It supplies the provider-reported address or location facet for the user, not a residency determination.

Enables: Group Users by office location in users.officeLocation without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports office location as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.

On Premises Immutable ID

Developer identifier: users.onPremisesImmutableIdOn Premises Immutable ID. Immutable identifier associating an on-premises AD user with the Entra ID user. It provides the reference needed to connect the user to the corresponding provider object.

Enables: Connect each user in Users to the referenced on premises immutable through users.onPremisesImmutableId; flag on premises immutable ID values that do not resolve in that provider namespace.
Interpretation: Microsoft 365 reports on premises immutable ID as an identifier in its on premises immutable namespace; it is not a universal identity outside Microsoft 365.

On Premises Sam Account Name

Developer identifier: users.onPremisesSamAccountNameOn Premises Sam Account Name. On-premises SAM account name synchronized from the on-premises directory. It locates the provider resource or path associated with the user.

Enables: Label each user with on premises sam account name from users.onPremisesSamAccountName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports on premises sam account name as display text for each user; names are mutable and are not stable identities.

On Premises Sync Enabled

Developer identifier: users.onPremisesSyncEnabledOn Premises Sync Enabled. Whether the user is synchronized from an on-premises directory. It distinguishes the provider-defined on premises sync enabled state or classification for the user.

Enables: Filter Users by whether the user is synchronized from an on-premises directory in users.onPremisesSyncEnabled; count true, false, and missing results separately.
Interpretation: Microsoft 365 reports the user is synchronized from an on-premises directory as a boolean on each user; a missing field is unknown, not false.

State

Developer identifier: users.stateState. State or province of the user’s address. It supplies the provider-reported address or location facet for the user, not a residency determination.

Enables: Group Users by state in users.state without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports state as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.

Surname

Developer identifier: users.surnameSurname. Last name (family name) of the user. It supplies the surname profile facet used to reconcile or attribute the user.

Enables: Reconcile the user’s surname in users.surname with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
Interpretation: Microsoft 365 reports surname as a mutable profile or directory attribute on each user; it may be absent, shared, or non-unique.

Usage Location

Developer identifier: users.usageLocationUsage Location. Two-letter country code used for license assignment compliance. It supplies the provider-reported address or location facet for the user, not a residency determination.

Enables: Group Users by usage location in users.usageLocation without treating that user, device, or request attribute as a data-residency signal.
Interpretation: Microsoft 365 reports usage location as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.

User Principal Name

Developer identifier: users.userPrincipalNameUser Principal Name. Sign-in name (typically email format) for the user. It gives the user a human-readable provider label while its identifier remains the stable reference.

Enables: Label each user with user principal name from users.userPrincipalName; distinguish records that share that display name but have different Microsoft 365 identifiers.
Interpretation: Microsoft 365 reports user principal name as display text for each user; names are mutable and are not stable identities.

User Type

Developer identifier: users.userTypeUser Type. Type of user: Member or Guest. It supplies the user type profile facet used to reconcile or attribute the user.

Enables: Segment user entries in Users by user type in users.userType; compare counts only within the same Microsoft 365 taxonomy.
Interpretation: Microsoft 365 reports user type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.

Error	Meaning	Solution
`AADSTS700016`	App not found	Verify Client ID and Tenant ID
`AADSTS7000215`	Invalid client secret	Regenerate client secret
`AADSTS65001`	Consent not granted	Grant admin consent for permissions
`403 Forbidden`	Missing permission	Add required API permission and grant consent

Common Issues

”Insufficient privileges to complete the operation”

Ensure admin consent was granted for all required permissions. Check API permissions in the app registration.

Token expires quickly

Access tokens are valid for ~1 hour. Implement proper token refresh using the client credentials flow.Microsoft Graph API - Official Graph API documentationApp Registration - Azure AD app registration guide

​Data streams

​App registration

​What You’ll Need

​Step 1: Access Azure Portal

​Step 2: Register Application

​Step 3: Note Application Details

​Step 4: Create Client Secret

​Step 5: Configure API Permissions

​Step 6: Grant Admin Consent

​Step 7: Enter values in the form

​App registration

​Common Issues

​”Insufficient privileges to complete the operation”

​Token expires quickly

Data streams

App registration

What You’ll Need

Step 1: Access Azure Portal

Step 2: Register Application

Step 3: Note Application Details

Step 4: Create Client Secret

Step 5: Configure API Permissions

Step 6: Grant Admin Consent

Step 7: Enter values in the form

App registration

Common Issues

”Insufficient privileges to complete the operation”

Token expires quickly