> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parable.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365

> Sync data from Microsoft 365 (Teams, SharePoint, etc.)

Sync data from Microsoft 365 (Teams, SharePoint, etc.).

<Tabs>
  <Tab title="Overview">
    Create an Azure AD app registration to connect Parable to Microsoft 365 using OAuth 2.0 client credentials. This enables secure, automated access without user sign-in.

    ## Data streams

    This Provider Plugin defines 15 data streams.

    | Stream                 | Description                                                                                                                                                                                                                                                                           | Sync        |
    | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
    | `users`                | Microsoft Entra ID users                                                                                                                                                                                                                                                              | full        |
    | `calendar_events`      | Calendar events by user                                                                                                                                                                                                                                                               | incremental |
    | `messages`             | Mailbox messages by user                                                                                                                                                                                                                                                              | incremental |
    | `teams`                | Microsoft Teams represented as groups                                                                                                                                                                                                                                                 | full        |
    | `team_details`         | Detailed settings for each team                                                                                                                                                                                                                                                       | full        |
    | `team_calendar_events` | Team calendar events by group                                                                                                                                                                                                                                                         | incremental |
    | `sign_in_logs`         | Microsoft Entra sign-in logs                                                                                                                                                                                                                                                          | incremental |
    | `audit_logs`           | Microsoft Purview audit log records via the /beta async create-poll-fetch pattern. Uses recordTypeFilters \[sharePointFileOperation, oneDrive] matching the legacy ingestion-service default.                                                                                         | incremental |
    | `copilot_interactions` | Microsoft 365 Copilot user interaction audit records via the Purview /beta async create-poll-fetch pattern. Filters recordTypeFilters to CopilotInteraction (who/when/AppHost/AccessedResources). Does not include prompt or response text. Opt-in; requires AuditLogsQuery.Read.All. | incremental |
    | `user_calendar_events` | DEPRECATED expansion tap. Duplicates the calendar\_events tap with a narrower \$select. The legacy ingestion-service only defines a single user-calendar tap (calendar\_events). Disabled by default; retained for backward compatibility.                                            | incremental |
    | `channels`             | Channels within each Microsoft Team                                                                                                                                                                                                                                                   | full        |
    | `channel_messages`     | All channel messages across a team (including thread replies) via Teams export API                                                                                                                                                                                                    | incremental |
    | `channel_members`      | Members of each Teams channel                                                                                                                                                                                                                                                         | full        |
    | `organization`         | Entra organization (tenant) metadata                                                                                                                                                                                                                                                  | full        |
    | `groups`               | Microsoft Entra groups (all group types, including non-Teams). Overlaps with the teams tap for groups that have resourceProvisioningOptions Team; teams remains the filtered source for Teams child fan-out.                                                                          | full        |
  </Tab>

  <Tab title="Setup Guide">
    ### App registration

    #### What You'll Need

    | Credential        | What it is                 |
    | ----------------- | -------------------------- |
    | **Tenant ID**     | Azure AD tenant identifier |
    | **Client ID**     | Application (client) ID    |
    | **Client Secret** | Generated client secret    |

    > **Info:** **Setup access in Azure.** These steps require **Administrator**, or a colleague with equivalent permissions who can create credentials for you.
    >
    > If that is not you, ask your Azure administrator.

    * **Global Administrator** or **Application Administrator** role in Azure AD
    * Permission to grant admin consent for API permissions

    #### Step 1: Access Azure Portal

    1. Navigate to <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">Azure Portal</a>
    2. Go to **Azure Active Directory** → **App registrations**
    3. Click **New registration**

    #### Step 2: Register Application

    | Field                   | Value                                           |
    | ----------------------- | ----------------------------------------------- |
    | Name                    | `Parable Integration`                           |
    | Supported account types | Accounts in this organizational directory only  |
    | Redirect URI            | Leave blank (not needed for client credentials) |

    Click **Register**

    #### Step 3: Note Application Details

    From the **Overview** page, copy:

    * **Application (client) ID**
    * **Directory (tenant) ID**

    #### Step 4: Create Client Secret

    1. Go to **Certificates & secrets**
    2. Click **New client secret**
    3. Add description: `Parable Integration Secret`
    4. Select expiration (recommend: 24 months)
    5. Click **Add**

    > **Warning:** Copy the secret **Value** immediately - it won't be shown again!

    #### Step 5: Configure API Permissions

    1. Go to **API permissions**
    2. Click **Add a permission** → **Microsoft Graph**
    3. Select **Application permissions**
    4. Add these permissions:

    | Permission                | Purpose                                                                      |
    | ------------------------- | ---------------------------------------------------------------------------- |
    | `User.Read.All`           | Read all user profiles                                                       |
    | `Directory.Read.All`      | Read directory data (also covers org metadata and channel list when present) |
    | `Team.ReadBasic.All`      | Read Microsoft Teams details                                                 |
    | `Channel.ReadBasic.All`   | List Teams channels (required if Directory.Read.All is not granted)          |
    | `ChannelMessage.Read.All` | Read Teams channel messages via the Teams export API                         |
    | `ChannelMember.Read.All`  | Read Teams channel membership                                                |
    | `AuditLog.Read.All`       | Read sign-in and directory audit logs                                        |
    | `AuditLogsQuery.Read.All` | Read Microsoft Purview audit log queries                                     |
    | `Mail.Read`               | Read mail (if needed)                                                        |
    | `Calendars.Read`          | Read calendars (if needed)                                                   |

    > **Warning:** `ChannelMessage.Read.All` is a protected Teams export permission. Admin
    > consent alone is not enough: Microsoft must also approve protected-API
    > access for your app, and your tenant needs Teams message export
    > eligibility. See Microsoft's
    > [Export content with the Microsoft Teams export APIs](https://learn.microsoft.com/en-us/microsoftteams/export-teams-content)
    > guide. Until that is in place, leave the Parable `channel_messages` tap
    > disabled (it ships opt-in).

    #### Step 6: Grant Admin Consent

    1. Click **Grant admin consent for \[Your Org]**
    2. Confirm the consent dialog

    > **Info:** All permissions should show a green checkmark indicating consent was granted.
    > Channel / message taps that ship disabled stay off until you enable them
    > in Parable after consent and protected-API approval succeed.

    #### Step 7: Enter values in the form

    1. **Tenant ID**, **Client ID**, and **Client Secret**: Paste the Directory (tenant) ID, Application (client) ID, and client secret value.
    2. Click **Save & test connection**.

    By default, Microsoft Graph application permissions can cover every user in the
    directory. Use Microsoft's
    [mailbox access guidance](https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access)
    when your organization needs to restrict the app to an approved population.

    ```bash Get Access Token theme={null}
    curl -X POST "https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token" \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "client_id={CLIENT_ID}" \
      -d "client_secret={CLIENT_SECRET}" \
      -d "scope=https://graph.microsoft.com/.default" \
      -d "grant_type=client_credentials"
    ```

    ```bash Test API Access theme={null}
    curl -H "Authorization: Bearer {ACCESS_TOKEN}" \
      "https://graph.microsoft.com/v1.0/users?\$top=5"
    ```

    > **Success:** **Success!** If you received a `200 OK` response with valid data, your credentials are configured correctly. You can now configure this Provider in Parable.

    > **Tip:** Enter **Tenant ID**, **Client ID**, and **Client Secret** in the Provider form, then click **Save & test connection**.
  </Tab>

  <Tab title="Permissions">
    ### App registration

    | Permission                | Data Accessed                                                                                                         |
    | ------------------------- | --------------------------------------------------------------------------------------------------------------------- |
    | `User.Read.All`           | User profiles, managers, photos                                                                                       |
    | `Directory.Read.All`      | Groups, org hierarchy, devices; sufficient for listing channels when granted                                          |
    | `Team.ReadBasic.All`      | Microsoft Teams names, settings, and membership counts                                                                |
    | `Channel.ReadBasic.All`   | Channel list (standard / private / shared) when Directory.Read.All is not used                                        |
    | `ChannelMessage.Read.All` | Channel message content via Teams export APIs (protected API; Global cloud only - not US Gov L4/L5 or China 21Vianet) |
    | `ChannelMember.Read.All`  | Teams channel member lists                                                                                            |
    | `AuditLog.Read.All`       | Sign-in logs, directory audits                                                                                        |
    | `AuditLogsQuery.Read.All` | Purview audit log records (SharePoint/OneDrive file operations)                                                       |
    | `Mail.Read`               | Email metadata and content                                                                                            |
    | `Calendars.Read`          | Calendar events and availability                                                                                      |

    > **Info:** Channel message export covers public and private channels. Shared-channel
    > coverage follows Microsoft Graph's getAllMessages behavior and may omit
    > some shared-channel traffic. 1:1 and group chats are not included in this
    > Provider version.

    > **Tip:** **Rate Limits:** Microsoft Graph enforces rate limits of **10,000 requests per 10 minutes per app; throttling returns 429 with Retry-After header**.
    >
    > Parable handles rate limiting automatically with exponential backoff, but initial syncs of large datasets may take longer due to these limits.

    <AccordionGroup>
      <Accordion id="provider-permission-tap-microsoft-audit-logs-5af837db5ab7" title="Audit Logs" icon="shield-check" iconType="sharp-duotone-solid">
        Developer identifier: `audit_logs`

        **Audit Logs.** Microsoft Purview audit log records via the /beta async create-poll-fetch pattern. Uses recordTypeFilters \[sharePointFileOperation, oneDrive] matching the legacy ingestion-service default.

        * **Enables:** Trace SharePoint and OneDrive audit operations to the reported user, resource, operation, and event time.
        * **Scope:** Reads the records selected by Microsoft 365's `/beta/security/auditLog/queries` operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The query is restricted to SharePoint file operations and OneDrive record types rather than the tenant's complete Purview audit corpus. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-audit-logs-administrativeunits-441ceff42ff7" title="Administrative Units" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.administrativeUnits`

            **Administrative Units.** Administrative units associated with the record. It preserves the nested context needed to interpret the parent audit log.

            * **Enables:** Attribute every returned administrative unit value in `audit_logs.administrativeUnits` to its parent audit log; keep each relationship distinct and distinguish an absent array from an explicitly empty one.
            * **Interpretation:** Microsoft 365 returns administrative units as an array of administrative unit value entries on each audit log; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-auditdata-e7af026f68a5" title="Audit Data" icon="code-merge" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.auditData`

            **Audit Data.** Raw service-specific audit payload as a JSON object. It preserves the nested context needed to interpret the parent audit log.

            * **Enables:** Attribute audit data in `audit_logs.auditData` to the parent audit log; identify parent records where that nested audit data object is absent.
            * **Interpretation:** Microsoft 365 reports audit data as a nested object on each audit log; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-auditlogrecordtype-db1433ca3c55" title="Audit Log Record Type" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.auditLogRecordType`

            **Audit Log Record Type.** Audit log record type (e.g. SharePointFileOperation, OneDrive). It distinguishes the provider-defined audit log record type state or classification for the audit log.

            * **Enables:** Segment audit log entries in Audit Logs by audit log record type in `audit_logs.auditLogRecordType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports audit log record type as a label from its own taxonomy on each audit log; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-clientip-27f7a9b0cf6e" title="Client IP" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.clientIp`

            **Client IP.** Client IP address from which the operation was performed. It supplies the provider-reported address or location facet for the audit log, not a residency determination.

            * **Enables:** Correlate audit log records that report the same network address in `audit_logs.clientIp` during an authorized investigation; account for shared, proxied, or translated addresses.
            * **Interpretation:** Microsoft 365 reports this as an IP network address on each audit log. It is not verified geolocation, does not identify a person by itself, and does not establish data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-createddatetime-007cf491f46d" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.createdDateTime`

            **Created Date Time.** Timestamp when the audited operation occurred. It anchors the audit log on the provider's reported timeline.

            * **Enables:** Order Audit Logs by created date time in `audit_logs.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each audit log; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-id-fb30141592a8" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.id`

            **ID.** Unique identifier of the audit log record. It provides the reference needed to connect the audit log to the corresponding provider object.

            * **Enables:** Match repeated audit log entries on ID in `audit_logs.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its audit log namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-objectid-a8dad14d538f" title="Object ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.objectId`

            **Object ID.** Identifier of the object the operation acted on (e.g. file URL). It provides the reference needed to connect the audit log to the corresponding provider object.

            * **Enables:** Connect each audit log in Audit Logs to the referenced object through `audit_logs.objectId`; flag object ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports object ID as an identifier in its object namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-operation-eec446fd3d65" title="Operation" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.operation`

            **Operation.** Operation name (e.g. FileAccessed, FileModified). It distinguishes the provider-defined operation state or classification for the audit log.

            * **Enables:** Filter Audit Logs by the exact Microsoft 365-defined operation in `audit_logs.operation` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies operation from its own taxonomy on each audit log; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-organizationid-b524fa3d6121" title="Organization ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.organizationId`

            **Organization ID.** Microsoft tenant identifier. It provides the reference needed to connect the audit log to the corresponding provider object.

            * **Enables:** Connect each audit log in Audit Logs to the referenced organization through `audit_logs.organizationId`; flag organization ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports organization ID as an identifier in its organization namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-service-8288568f8219" title="Service" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.service`

            **Service.** Microsoft 365 service that produced the record (e.g. SharePoint, OneDrive). It distinguishes the provider-defined service state or classification for the audit log.

            * **Enables:** Filter Audit Logs by the exact Microsoft 365-defined service in `audit_logs.service` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies service from its own taxonomy on each audit log; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-userid-5d7fa900a81f" title="User ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.userId`

            **User ID.** Object ID of the user that performed the operation. It provides the reference needed to connect the audit log to the corresponding provider object.

            * **Enables:** Connect each audit log in Audit Logs to the referenced user through `audit_logs.userId`; flag user ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-userprincipalname-cdd2d23e098d" title="User Principal Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.userPrincipalName`

            **User Principal Name.** UPN of the user that performed the operation. It gives the audit log a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each audit log with user principal name from `audit_logs.userPrincipalName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports user principal name as display text for each audit log; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-audit-logs-usertype-199f4e8e643c" title="User Type" icon="triangle-exclamation" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.userType`

            **User Type.** Type of user that performed the operation. It supplies the user type profile facet used to reconcile or attribute the audit log.

            * **Enables:** Segment audit log entries in Audit Logs by user type in `audit_logs.userType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports user type as a label from its own taxonomy on each audit log; preserve unknown labels rather than mapping them by assumption.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-calendar-events-12aabe9df470" title="Calendar Events" icon="calendar-check" iconType="sharp-duotone-solid">
        Developer identifier: `calendar_events`

        **Calendar Events.** Calendar events by user.

        * **Enables:** Attribute user calendar events to organizers, attendees, calendars, time intervals, recurrence, and response state.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/users/{id}/calendarView` operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The selected fields include `bodyPreview` plus event and recurrence metadata, not the complete event body or attachment bytes. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-3b7916d02a62" title="Attendees" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees`

            **Attendees.** List of attendees with email, name, and response status. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute each returned attendee in `calendar_events.attendees` to the parent calendar event; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
            * **Interpretation:** Microsoft 365 returns attendees as an array of attendee entries on each calendar event; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-emailaddress-c8f875845264" title="Email Address" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.emailAddress`

            **Email Address.** Email address and display name of the attendee. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Match repeated attendee entries on email address in `calendar_events.Attendee.emailAddress`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports email address as a nested object on each attendee; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-emailaddress-e2d4093a743a" title="Address" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.emailAddress.address`

            **Address.** Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

            * **Enables:** Attribute each email address to a person or account by the exact address in `calendar_events.EmailAddress.address`; identify addresses that do not match the Microsoft 365 directory.
            * **Interpretation:** Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-emailaddress-5d2f1de67432" title="Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.emailAddress.name`

            **Name.** Display name of the person or entity. It gives the email address a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each email address with name from `calendar_events.EmailAddress.name`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-proposednewt-62ca32569133" title="Proposed New Time" icon="calendar-days" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.proposedNewTime`

            **Proposed New Time.** An alternate date/time proposed by the attendee. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute proposed new time in `calendar_events.Attendee.proposedNewTime` to the parent calendar event; identify parent records where that nested proposed new time object is absent.
            * **Interpretation:** Microsoft 365 reports proposed new time as a nested object on each attendee; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-proposednewt-dd128abce225" title="End" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.proposedNewTime.end`

            **End.** End of the time slot. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute end in `calendar_events.TimeSlot.end` to the parent calendar event; identify parent records where that nested end object is absent.
            * **Interpretation:** Microsoft 365 reports end as a nested object on each time slot; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-proposednewt-16d658a0266f" title="Date Time" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.proposedNewTime.end.dateTime`

            **Date Time.** Date and time in ISO 8601 format without timezone offset (e.g. 2024-01-15T09:00:00.0000000). It anchors the calendar event on the provider's reported timeline.

            * **Enables:** Order Calendar Events by date time in `calendar_events.DateTimeTimeZone.dateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports date time as a timestamp on each date time time zone; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-proposednewt-08b7c70fdbf4" title="Time Zone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.proposedNewTime.end.timeZone`

            **Time Zone.** IANA or Windows time zone identifier (e.g. Pacific Standard Time, America/New\_York). It is needed to interpret companion dates and times for the date time time zone in the provider's intended zone.

            * **Enables:** Apply the zone in `calendar_events.DateTimeTimeZone.timeZone` when converting the calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports time zone as a timezone identifier for each date time time zone; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-proposednewt-9e1ca9040c09" title="Start" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.proposedNewTime.start`

            **Start.** Start of the time slot. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute start in `calendar_events.TimeSlot.start` to the parent calendar event; identify parent records where that nested start object is absent.
            * **Interpretation:** Microsoft 365 reports start as a nested object on each time slot; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-status-4d1afa321cb0" title="Status" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.status`

            **Status.** The attendee's response status for the event. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute status in `calendar_events.Attendee.status` to the parent calendar event; identify parent records where that nested status object is absent.
            * **Interpretation:** Microsoft 365 reports status as a nested object on each attendee; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-status-respo-f22c2a2c2ae9" title="Response" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.status.response`

            **Response.** The response type. It distinguishes the provider-defined response state or classification for the response status.

            * **Enables:** Segment response status entries in Calendar Events by response in `calendar_events.ResponseStatus.response`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports response as a label from its own taxonomy on each response status; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-status-time-c4dfd8ed9857" title="Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.status.time`

            **Time.** Date and time the response was submitted. It anchors the calendar event on the provider's reported timeline.

            * **Enables:** Order Calendar Events by time in `calendar_events.ResponseStatus.time` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports time as a timestamp on each response status; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-attendees-type-be3208b69a0f" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.attendees.type`

            **Type.** Attendee type: required, optional, or resource. It distinguishes the provider-defined type state or classification for the attendee.

            * **Enables:** Segment attendee entries in Calendar Events by type in `calendar_events.Attendee.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each attendee; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-bodypreview-14c73321c03f" title="Body Preview" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.bodyPreview`

            **Body Preview.** Short text preview of the event body content. It defines the content surface available for this calendar event.

            * **Enables:** Locate calendar event records whose body preview in `calendar_events.bodyPreview` contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
            * **Interpretation:** This is an excerpt supplied by the provider, not the complete body or an attachment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-calendar-72caa601051a" title="Calendar" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.calendar`

            **Calendar.** The calendar navigation property or calendar ID associated with the event. It identifies the related provider object that gives the calendar event its parent, owner, or container context.

            * **Enables:** Connect each calendar event to the related calendar in `calendar_events.calendar` and verify that the referenced provider object resolves in the expected parent or container.
            * **Interpretation:** Microsoft 365 reports calendar as relationship context on each calendar event; resolve it in the named provider namespace rather than by display text alone.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-categories-a8b1c01abf05" title="Categories" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.categories`

            **Categories.** User-assigned categories/labels on the event. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Compare the exact Microsoft 365-configured categories set in `calendar_events.categories` for each calendar event; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns categories as an array of category value entries on each calendar event; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-changekey-598a30ca48e9" title="Change Key" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.changeKey`

            **Change Key.** Version identifier of the event; changes each time the event is modified. It provides the reference needed to connect the calendar event to the corresponding provider object.

            * **Enables:** Connect each calendar event in Calendar Events to the referenced change through `calendar_events.changeKey`; flag change key values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports change key as an identifier in its change namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-createddatetime-85f188b13fab" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.createdDateTime`

            **Created Date Time.** Date and time the event was created in ISO 8601 format. It anchors the calendar event on the provider's reported timeline.

            * **Enables:** Order Calendar Events by created date time in `calendar_events.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each calendar event; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-end-a2885e0cd79e" title="End" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.end`

            **End.** End date/time and timezone of the event. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute end in `calendar_events.end` to the parent calendar event; identify parent records where that nested end object is absent.
            * **Interpretation:** Microsoft 365 reports end as a nested object on each calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-icaluid-ee779a9f562c" title="I Cal U ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.iCalUId`

            **I Cal U ID.** Unique identifier for the event across calendars. Stable when the event moves between calendars, unlike ID. It provides the reference needed to connect the calendar event to the corresponding provider object.

            * **Enables:** Connect each calendar event in Calendar Events to the referenced i cal u through `calendar_events.iCalUId`; flag i cal u ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports i cal u ID as an identifier in its i cal u namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-id-5e7076274780" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.id`

            **ID.** Unique identifier for the event. It provides the reference needed to connect the calendar event to the corresponding provider object.

            * **Enables:** Match repeated calendar event entries on ID in `calendar_events.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its calendar event namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-importance-3f73dad745e5" title="Importance" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.importance`

            **Importance.** Importance level of the event. It distinguishes the provider-defined importance state or classification for the calendar event.

            * **Enables:** Segment calendar event entries in Calendar Events by importance in `calendar_events.importance`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports importance as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-isallday-34e59f44fa2d" title="Is All Day" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.isAllDay`

            **Is All Day.** Whether the event lasts all day. It distinguishes the provider-defined is all day state or classification for the calendar event.

            * **Enables:** Filter Calendar Events by whether the event lasts all day in `calendar_events.isAllDay`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the event lasts all day as a boolean on each calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-iscancelled-9fc88a5d44c8" title="Is Cancelled" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.isCancelled`

            **Is Cancelled.** Whether the event has been cancelled. It distinguishes the provider-defined is cancelled state or classification for the calendar event.

            * **Enables:** Filter Calendar Events by whether the event has been cancelled in `calendar_events.isCancelled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the event has been cancelled as a boolean on each calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-isonlinemeeting-71a662594df5" title="Is Online Meeting" icon="headset" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.isOnlineMeeting`

            **Is Online Meeting.** Whether the event is an online meeting. It distinguishes the provider-defined is online meeting state or classification for the calendar event.

            * **Enables:** Filter Calendar Events by whether the event is an online meeting in `calendar_events.isOnlineMeeting`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the event is an online meeting as a boolean on each calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-lastmodifieddatetime-a3bf7aba8767" title="Last Modified Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.lastModifiedDateTime`

            **Last Modified Date Time.** Date and time the event was last modified in ISO 8601 format. Used as incremental sync cursor. It anchors the calendar event on the provider's reported timeline.

            * **Enables:** Order Calendar Events by last modified date time in `calendar_events.lastModifiedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports last modified date time as a timestamp on each calendar event; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-aafb7f3eff8d" title="Location" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location`

            **Location.** Location of the event. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute location in `calendar_events.location` to the parent calendar event; identify parent records where that nested location object is absent.
            * **Interpretation:** Microsoft 365 reports location as a nested object on each calendar event; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-address-e5b373730cad" title="Address" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.address`

            **Address.** Physical street address of the location. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute address in `calendar_events.Location.address` to the parent calendar event; identify parent records where that nested address object is absent.
            * **Interpretation:** Microsoft 365 reports address as a nested object on each location; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-address-city-2020c70861cc" title="City" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.address.city`

            **City.** City. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Calendar Events by city in `calendar_events.PhysicalAddress.city` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports city as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-address-count-c89976a084fb" title="Country Or Region" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.address.countryOrRegion`

            **Country Or Region.** Country or region. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Calendar Events by country or region in `calendar_events.PhysicalAddress.countryOrRegion` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports country or region as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-address-posta-35a06a710ac8" title="Postal Code" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.address.postalCode`

            **Postal Code.** Postal/ZIP code. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Calendar Events by the exact postal code in `calendar_events.PhysicalAddress.postalCode` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports postal code as an address or location facet on each physical address; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-address-state-55c226e1a217" title="State" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.address.state`

            **State.** State or province. It distinguishes the provider-defined state state or classification for the physical address.

            * **Enables:** Group Calendar Events by state in `calendar_events.PhysicalAddress.state` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports state as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-address-stree-98c1f317a5ca" title="Street" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.address.street`

            **Street.** Street address. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Calendar Events by the exact street in `calendar_events.PhysicalAddress.street` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports street as an address or location facet on each physical address; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-coordinates-6af97a14cb30" title="Coordinates" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.coordinates`

            **Coordinates.** Geographic coordinates and elevation of the location. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute coordinates in `calendar_events.Location.coordinates` to the parent calendar event; identify parent records where that nested coordinates object is absent.
            * **Interpretation:** Microsoft 365 reports coordinates as a nested object on each location; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-coordinates-a-6f723ed07456" title="Accuracy" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.coordinates.accuracy`

            **Accuracy.** Accuracy of the coordinates in meters. It supplies the accuracy measure for the geo coordinate at the provider's declared unit and grain.

            * **Enables:** Measure accuracy through `calendar_events.GeoCoordinates.accuracy` for each geo coordinate and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-coordinates-a-95cb81106314" title="Altitude" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.coordinates.altitude`

            **Altitude.** Altitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Calendar Events by the exact altitude in `calendar_events.GeoCoordinates.altitude` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports altitude as an address or location facet on each geo coordinate; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-coordinates-a-a534ebd6dd97" title="Altitude Accuracy" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.coordinates.altitudeAccuracy`

            **Altitude Accuracy.** Accuracy of the altitude in meters. It supplies the altitude accuracy measure for the geo coordinate at the provider's declared unit and grain.

            * **Enables:** Measure altitude accuracy through `calendar_events.GeoCoordinates.altitudeAccuracy` for each geo coordinate and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports altitude accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-coordinates-l-3aef5a4e86e0" title="Latitude" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.coordinates.latitude`

            **Latitude.** Latitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Calendar Events by latitude in `calendar_events.GeoCoordinates.latitude` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports latitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-coordinates-l-6d5b1b81443b" title="Longitude" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.coordinates.longitude`

            **Longitude.** Longitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Calendar Events by longitude in `calendar_events.GeoCoordinates.longitude` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports longitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-displayname-7ccb388ce21d" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.displayName`

            **Display Name.** Display name of the location. It distinguishes the provider-defined display name state or classification for the location.

            * **Enables:** Label each location with display name from `calendar_events.Location.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each location; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-locationemail-da34978145fb" title="Location Email Address" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.locationEmailAddress`

            **Location Email Address.** Email address associated with the location (e.g. a conference room). It supplies the provider-reported address or location facet for the location, not a residency determination.

            * **Enables:** Attribute each location to a person or account by the exact location email address in `calendar_events.Location.locationEmailAddress`; identify addresses that do not match the Microsoft 365 directory.
            * **Interpretation:** Microsoft 365 reports location email address as an address on each location; aliases, casing, and unverified addresses can prevent a one-to-one person match.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-locationtype-fdc1bd41fc3e" title="Location Type" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.locationType`

            **Location Type.** Type of location. It distinguishes the provider-defined location type state or classification for the location.

            * **Enables:** Segment location entries in Calendar Events by location type in `calendar_events.Location.locationType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports location type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-locationuri-007d7b8e9e8f" title="Location URI" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.locationUri`

            **Location URI.** URI representing the location. It supplies the provider-reported address or location facet for the location, not a residency determination.

            * **Enables:** Associate each location with the resource identified by location URI in `calendar_events.Location.locationUri`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports location URI as a resource locator for each location; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-uniqueid-ffebd61f4ca2" title="Unique ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.uniqueId`

            **Unique ID.** Unique identifier of the location, if available. It provides the reference needed to connect the calendar event to the corresponding provider object.

            * **Enables:** Connect each location in Calendar Events to the referenced unique through `calendar_events.Location.uniqueId`; flag unique ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports unique ID as an identifier in its unique namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-location-uniqueidtype-c5050790792f" title="Unique ID Type" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.location.uniqueIdType`

            **Unique ID Type.** Type of the unique ID for the location. It distinguishes the provider-defined unique ID type state or classification for the location.

            * **Enables:** Segment location entries in Calendar Events by unique ID type in `calendar_events.Location.uniqueIdType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports unique ID type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-aab678ad19f0" title="Online Meeting" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting`

            **Online Meeting.** Details for joining an online meeting, including join URL and conference ID. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute online meeting in `calendar_events.onlineMeeting` to the parent calendar event; identify parent records where that nested online meeting object is absent.
            * **Interpretation:** Microsoft 365 reports online meeting as a nested object on each calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-conferen-437972ddc858" title="Conference ID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.conferenceId`

            **Conference ID.** Conference ID for dial-in access. It provides the reference needed to connect the calendar event to the corresponding provider object.

            * **Enables:** Connect each online meeting info in Calendar Events to the referenced conference through `calendar_events.OnlineMeetingInfo.conferenceId`; flag conference ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports conference ID as an identifier in its conference namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-dialinur-74af21da61a4" title="Dialin URL" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.dialinUrl`

            **Dialin URL.** URL with dial-in information. It locates the provider resource or path associated with the online meeting info.

            * **Enables:** Associate each online meeting info with the resource identified by dialin URL in `calendar_events.OnlineMeetingInfo.dialinUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports dialin URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-joinurl-34ab00269e40" title="Join URL" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.joinUrl`

            **Join URL.** URL to join the online meeting. It locates the provider resource or path associated with the online meeting info.

            * **Enables:** Associate each online meeting info with the resource identified by join URL in `calendar_events.OnlineMeetingInfo.joinUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports join URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-phones-21c7d2583fd9" title="Phones" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.phones`

            **Phones.** Phone numbers associated with the online meeting. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Reconcile each returned online meeting phone in `calendar_events.OnlineMeetingInfo.phones` with the parent calendar event's provider profile; preserve distinct aliases, contact points, and organization attributes.
            * **Interpretation:** Microsoft 365 returns phones as an array of online meeting phone entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-phones-n-d6dccc76c2fa" title="Number" icon="headset" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.phones.number`

            **Number.** The phone number. It supplies the number measure for the online meeting phone at the provider's declared unit and grain.

            * **Enables:** Measure number through `calendar_events.OnlineMeetingPhone.number` for each online meeting phone and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports number as a measure on each online meeting phone; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-phones-t-29b078cfb399" title="Type" icon="headset" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.phones.type`

            **Type.** Type of phone number (e.g. toll, tollFree). It distinguishes the provider-defined type state or classification for the online meeting phone.

            * **Enables:** Segment online meeting phone entries in Calendar Events by type in `calendar_events.OnlineMeetingPhone.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each online meeting phone; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-quickdia-b50587735771" title="Quick Dial" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.quickDial`

            **Quick Dial.** Quick dial code for the meeting. It supplies the sensitive provider access code needed to join the online meeting info, not a stable record identifier.

            * **Enables:** Reconcile `calendar_events.OnlineMeetingInfo.quickDial` with the same conference entry point or meeting instructions when validating join access; handle it as sensitive access metadata.
            * **Interpretation:** Microsoft 365 returns quick dial as meeting or conference access metadata on each online meeting info; it can rotate and does not identify the meeting by itself.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-tollfree-677fe3b8fccc" title="Toll Free Numbers" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.tollFreeNumbers`

            **Toll Free Numbers.** List of toll-free phone numbers for dial-in. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Reconcile each returned toll free number value in `calendar_events.OnlineMeetingInfo.tollFreeNumbers` with the parent calendar event's provider profile; preserve distinct aliases, contact points, and organization attributes.
            * **Interpretation:** Microsoft 365 returns toll free numbers as an array of toll free number value entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeeting-tollnumb-839f8bb2226f" title="Toll Number" icon="phone" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeeting.tollNumber`

            **Toll Number.** Toll phone number for dial-in. It supplies the toll number measure for the online meeting info at the provider's declared unit and grain.

            * **Enables:** Measure toll number through `calendar_events.OnlineMeetingInfo.tollNumber` for each online meeting info and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports toll number as a measure on each online meeting info; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-onlinemeetingurl-5c0a50a06203" title="Online Meeting URL" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.onlineMeetingUrl`

            **Online Meeting URL.** URL for joining the online meeting (legacy property). It locates the provider resource or path associated with the calendar event.

            * **Enables:** Associate each calendar event with the resource identified by online meeting URL in `calendar_events.onlineMeetingUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports online meeting URL as a resource locator for each calendar event; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-organizer-49ce782604bc" title="Organizer" icon="envelope" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.organizer`

            **Organizer.** Organizer of the event with email and name. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute organizer in `calendar_events.organizer` to the parent calendar event; identify parent records where that nested organizer object is absent.
            * **Interpretation:** Microsoft 365 reports organizer as a nested object on each calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-organizer-emailaddress-dfe6647c098f" title="Email Address" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.organizer.emailAddress`

            **Email Address.** Email address and display name of the recipient. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute email address in `calendar_events.Recipient.emailAddress` to the parent calendar event; identify parent records where that nested email address object is absent.
            * **Interpretation:** Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-originalendtimezone-c1fc2236bd08" title="Original End Time Zone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.originalEndTimeZone`

            **Original End Time Zone.** End time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the calendar event in the provider's intended zone.

            * **Enables:** Apply the zone in `calendar_events.originalEndTimeZone` when converting the calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports original end time zone as a timezone identifier for each calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-originalstarttimezone-374b61c90a1d" title="Original Start Time Zone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.originalStartTimeZone`

            **Original Start Time Zone.** Start time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the calendar event in the provider's intended zone.

            * **Enables:** Apply the zone in `calendar_events.originalStartTimeZone` when converting the calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports original start time zone as a timezone identifier for each calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-3241a62c4825" title="Recurrence" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence`

            **Recurrence.** Recurrence pattern and range for recurring events. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute recurrence in `calendar_events.recurrence` to the parent calendar event; identify parent records where that nested recurrence object is absent.
            * **Interpretation:** Microsoft 365 reports recurrence as a nested object on each calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-838c6841b7ea" title="Pattern" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern`

            **Pattern.** The frequency and rules of the recurrence. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute pattern in `calendar_events.PatternedRecurrence.pattern` to the parent calendar event; identify parent records where that nested pattern object is absent.
            * **Interpretation:** Microsoft 365 reports pattern as a nested object on each patterned recurrence; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-day-af13f6902f48" title="Day Of Month" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern.dayOfMonth`

            **Day Of Month.** Day of the month for absoluteMonthly/absoluteYearly patterns. It supplies the day of month measure for the recurrence pattern at the provider's declared unit and grain.

            * **Enables:** Measure day of month through `calendar_events.RecurrencePattern.dayOfMonth` for each recurrence pattern and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports day of month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-day-14fc0a2e4bec" title="Days Of Week" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern.daysOfWeek`

            **Days Of Week.** Days of the week the event occurs on. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Compare the exact Microsoft 365-configured days of week set in `calendar_events.RecurrencePattern.daysOfWeek` for each recurrence pattern; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns days of week as an array of recurrence pattern day of week enum entries on each recurrence pattern; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-fir-010239050ef6" title="First Day Of Week" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern.firstDayOfWeek`

            **First Day Of Week.** First day of the week for weekly patterns. It distinguishes the provider-defined first day of week state or classification for the recurrence pattern.

            * **Enables:** Segment recurrence pattern entries in Calendar Events by first day of week in `calendar_events.RecurrencePattern.firstDayOfWeek`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports first day of week as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-ind-97c3d04712bb" title="Index" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern.index`

            **Index.** Week index for relativeMonthly/relativeYearly patterns. It distinguishes the provider-defined index state or classification for the recurrence pattern.

            * **Enables:** Segment recurrence pattern entries in Calendar Events by index in `calendar_events.RecurrencePattern.index`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports index as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-int-ab7e7b5136f3" title="Interval" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern.interval`

            **Interval.** Number of units between occurrences (e.g. every 2 weeks). It supplies the interval boundary, band, or unit needed to interpret the companion measure.

            * **Enables:** Interpret `calendar_events.RecurrencePattern.interval` with its companion minimum, maximum, interval, or unit before comparing the interval across like-for-like records.
            * **Interpretation:** Microsoft 365 reports interval as a boundary, band, interval, or unit on each recurrence pattern; it is meaningful only with its companion measure and provider scale.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-mon-142dffafdfdd" title="Month" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern.month`

            **Month.** Month in which the event occurs (1-12), for yearly patterns. It supplies the month measure for the recurrence pattern at the provider's declared unit and grain.

            * **Enables:** Measure month through `calendar_events.RecurrencePattern.month` for each recurrence pattern and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-pattern-typ-083746539486" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.pattern.type`

            **Type.** The recurrence pattern type. It distinguishes the provider-defined type state or classification for the recurrence pattern.

            * **Enables:** Segment recurrence pattern entries in Calendar Events by type in `calendar_events.RecurrencePattern.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-range-7d870ffe768a" title="Range" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.range`

            **Range.** The duration/bounds of the recurrence. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute range in `calendar_events.PatternedRecurrence.range` to the parent calendar event; identify parent records where that nested range object is absent.
            * **Interpretation:** Microsoft 365 reports range as a nested object on each patterned recurrence; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-range-endda-5fb5d4fccc26" title="End Date" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.range.endDate`

            **End Date.** End date of the recurrence range (YYYY-MM-DD). Used when type is endDate. It anchors the calendar event on the provider's reported timeline.

            * **Enables:** Filter Calendar Events by end date in `calendar_events.RecurrenceRange.endDate`; pair that boundary with the corresponding start before measuring elapsed time.
            * **Interpretation:** Microsoft 365 reports end date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-range-numbe-08632a82ee7e" title="Number Of Occurrences" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.range.numberOfOccurrences`

            **Number Of Occurrences.** Number of occurrences. Used when type is numbered. It supplies the number of occurrences measure for the recurrence range at the provider's declared unit and grain.

            * **Enables:** Measure number of occurrences through `calendar_events.RecurrenceRange.numberOfOccurrences` for each recurrence range and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports number of occurrences as a measure on each recurrence range; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-range-recur-e096de43dfa6" title="Recurrence Time Zone" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.range.recurrenceTimeZone`

            **Recurrence Time Zone.** Time zone for the start and end dates. It is needed to interpret companion dates and times for the recurrence range in the provider's intended zone.

            * **Enables:** Apply the zone in `calendar_events.RecurrenceRange.recurrenceTimeZone` when converting the calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports recurrence time zone as a timezone identifier for each recurrence range; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-range-start-e652f0f844c3" title="Start Date" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.range.startDate`

            **Start Date.** Start date of the recurrence range (YYYY-MM-DD). It anchors the calendar event on the provider's reported timeline.

            * **Enables:** Filter Calendar Events by start date in `calendar_events.RecurrenceRange.startDate`; pair that boundary with the corresponding end before measuring elapsed time.
            * **Interpretation:** Microsoft 365 reports start date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-recurrence-range-type-0304cadbf753" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.recurrence.range.type`

            **Type.** The recurrence range type. It distinguishes the provider-defined type state or classification for the recurrence range.

            * **Enables:** Segment recurrence range entries in Calendar Events by type in `calendar_events.RecurrenceRange.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each recurrence range; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-responsestatus-b41b730131f7" title="Response Status" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.responseStatus`

            **Response Status.** The response status and time of the current user for this event. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute response status in `calendar_events.responseStatus` to the parent calendar event; identify parent records where that nested response status object is absent.
            * **Interpretation:** Microsoft 365 reports response status as a nested object on each calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-sensitivity-a88869e46310" title="Sensitivity" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.sensitivity`

            **Sensitivity.** Sensitivity level of the event. It distinguishes the provider-defined sensitivity state or classification for the calendar event.

            * **Enables:** Segment calendar event entries in Calendar Events by sensitivity in `calendar_events.sensitivity`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports sensitivity as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-seriesmasterid-dbfea1937624" title="Series Master ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.seriesMasterId`

            **Series Master ID.** The ID of the recurring series master event, if this event is part of a recurring series. It provides the reference needed to connect the calendar event to the corresponding provider object.

            * **Enables:** Connect each calendar event in Calendar Events to the referenced series master through `calendar_events.seriesMasterId`; flag series master ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports series master ID as an identifier in its series master namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-showas-4404dd6245a5" title="Show As" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.showAs`

            **Show As.** Free/busy status shown during the event. It distinguishes the provider-defined show as state or classification for the calendar event.

            * **Enables:** Segment calendar event entries in Calendar Events by show as in `calendar_events.showAs`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports show as as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-start-8da9cdc23f20" title="Start" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.start`

            **Start.** Start date/time and timezone of the event. It preserves the nested context needed to interpret the parent calendar event.

            * **Enables:** Attribute start in `calendar_events.start` to the parent calendar event; identify parent records where that nested start object is absent.
            * **Interpretation:** Microsoft 365 reports start as a nested object on each calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-subject-a696a8d187f4" title="Subject" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.subject`

            **Subject.** Subject/title of the calendar event. It defines the content surface available for this calendar event.

            * **Enables:** Locate calendar event records by subject in `calendar_events.subject`; attribute each text match to its parent calendar event and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies subject as text on each calendar event; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-type-fcbdf20a66fd" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.type`

            **Type.** The event type: singleInstance, occurrence, exception, or seriesMaster. It distinguishes the provider-defined type state or classification for the calendar event.

            * **Enables:** Segment calendar event entries in Calendar Events by type in `calendar_events.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-user-id-633a7a63d2c8" title="User ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.user_id`

            **User ID.** Parent user reference copied into each calendar event because the child operation does not return that relationship. It provides the reference needed to connect the calendar event to the corresponding provider object.

            * **Enables:** Connect each calendar event in Calendar Events to the referenced user through `calendar_events.user_id`; flag user ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies user ID from the parent traversal record into each calendar event; the child Microsoft 365 operation does not return it.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-calendar-events-weblink-399046572874" title="Web Link" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `calendar_events.webLink`

            **Web Link.** URL to open the event in Outlook on the web. It locates the provider resource or path associated with the calendar event.

            * **Enables:** Associate each calendar event with the resource identified by web link in `calendar_events.webLink`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports web link as a resource locator for each calendar event; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-channel-members-99e076056205" title="Channel Members" icon="sitemap" iconType="sharp-duotone-solid">
        Developer identifier: `channel_members`

        **Channel Members.** Members of each Teams channel.

        * **Enables:** Match each Teams channel membership to the channel, user, roles, and provider membership identifier.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/teams/{team_id}/channels/{id}/members` operation as a snapshot stream using full synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-channel-members-channel-id-e6629ec070ca" title="Channel ID" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.channel_id`

            **Channel ID.** Parent channel reference copied into each channel member because the child operation does not return that relationship. It provides the reference needed to connect the channel member to the corresponding provider object.

            * **Enables:** Connect each channel member in Channel Members to the referenced channel through `channel_members.channel_id`; flag channel ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies channel ID from the parent traversal record into each channel member; the child Microsoft 365 operation does not return it.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-displayname-87c67b9b0315" title="Display Name" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.displayName`

            **Display Name.** Display name of the member. It distinguishes the provider-defined display name state or classification for the channel member.

            * **Enables:** Label each channel member with display name from `channel_members.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each channel member; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-email-d619a96456d5" title="Email" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.email`

            **Email.** Email address of the member when present. It supplies the provider-reported address or location facet for the channel member, not a residency determination.

            * **Enables:** Attribute each channel member to a person or account by the exact email in `channel_members.email`; identify addresses that do not match the Microsoft 365 directory.
            * **Interpretation:** Microsoft 365 reports email as an address on each channel member; aliases, casing, and unverified addresses can prevent a one-to-one person match. A connector directive maps this field to a person's email identity.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-id-e8c5035253c6" title="ID" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.id`

            **ID.** Opaque membership ID. It provides the reference needed to connect the channel member to the corresponding provider object.

            * **Enables:** Connect each channel member in Channel Members to the referenced channel member through `channel_members.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its channel member namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-membership-key-5aae56f5165f" title="Membership Key" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.membership_key`

            **Membership Key.** Synthetic primary key hashing injected channel\_id and wire membership ID. Graph membership IDs are opaque and can collide across channels for the same user. It provides the reference needed to connect the channel member to the corresponding provider object.

            * **Enables:** Match repeated channel member entries on membership key in `channel_members.membership_key`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports membership key as an identifier in its membership namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-roles-280c3777c2a4" title="Roles" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.roles`

            **Roles.** Roles of the member in the channel (e.g. owner, guest). It preserves the nested context needed to interpret the parent channel member.

            * **Enables:** Compare the exact Microsoft 365-configured roles set in `channel_members.roles` for each channel member; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns roles as an array of role value entries on each channel member; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-team-id-d0815127f8a9" title="Team ID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.team_id`

            **Team ID.** Parent team reference copied into each channel member because the child operation does not return that relationship. It provides the reference needed to connect the channel member to the corresponding provider object.

            * **Enables:** Connect each channel member in Channel Members to the referenced team through `channel_members.team_id`; flag team ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies team ID from the parent traversal record into each channel member; the child Microsoft 365 operation does not return it.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-tenantid-a5e3e3c673cf" title="Tenant ID" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.tenantId`

            **Tenant ID.** Tenant ID of the member. It provides the reference needed to connect the channel member to the corresponding provider object.

            * **Enables:** Connect each channel member in Channel Members to the referenced tenant through `channel_members.tenantId`; flag tenant ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-userid-6f487317040b" title="User ID" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.userId`

            **User ID.** Entra user ID of the member. It provides the reference needed to connect the channel member to the corresponding provider object.

            * **Enables:** Connect each channel member in Channel Members to the referenced user through `channel_members.userId`; flag user ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365. A connector directive maps this field to account identity.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-members-visiblehistorystartdat-4d8ed7072672" title="Visible History Start Date Time" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_members.visibleHistoryStartDateTime`

            **Visible History Start Date Time.** Earliest message history visible to this member, when set. It anchors the channel member on the provider's reported timeline.

            * **Enables:** Filter Channel Members by visible history start date time in `channel_members.visibleHistoryStartDateTime`; pair that boundary with the corresponding end before measuring elapsed time.
            * **Interpretation:** Microsoft 365 reports visible history start date time as a timestamp on each channel member; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-channel-messages-224b721d0147" title="Channel Messages" icon="comments" iconType="sharp-duotone-solid">
        Developer identifier: `channel_messages`

        **Channel Messages.** All channel messages across a team (including thread replies) via Teams export API.

        * **Enables:** Attribute Teams channel posts and thread replies to their channel, author, mentions, and timestamps.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/teams/{id}/channels/getAllMessages` operation as an event stream using incremental synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. Message bodies and message-level attachment or mention metadata may be present, but binary attachment content is not fetched. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-channel-messages-attachments-f7b8cfba141f" title="Attachments" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.attachments`

            **Attachments.** Attachments on the message. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Associate each returned chat message attachment metadata entry in `channel_messages.attachments` with the parent channel message; inventory the reference without assuming file, recording, or attachment bytes are present.
            * **Interpretation:** Microsoft 365 returns attachments as file, recording, or attachment metadata on each channel message; the array does not imply that binary content was collected. This field is metadata or a reference for the file or attachment; it does not by itself include binary content.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-attachments-content-560d9dcf6b06" title="Content" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.attachments.content`

            **Content.** The provider-reported content for each chat message attachment in Channel Messages. It defines the content surface available for this channel message.

            * **Enables:** Locate chat message attachment records by content in `channel_messages.ChatMessageAttachment.content`; attribute each text match to its parent channel message and, when present, its reported author.
            * **Interpretation:** This is attachment or file metadata; it does not by itself include the referenced file bytes. This stream treats the file or attachment as metadata and references; binary bytes are not included.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-attachments-contentty-12ef6b7c93ef" title="Content Type" icon="circle-exclamation" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.attachments.contentType`

            **Content Type.** The provider-reported content type for each chat message attachment in Channel Messages. It supplies the returned content type text needed to understand the chat message attachment in context.

            * **Enables:** Segment chat message attachment entries in Channel Messages by content type in `channel_messages.ChatMessageAttachment.contentType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports content type as a label from its own taxonomy on each chat message attachment; preserve unknown labels rather than mapping them by assumption. This stream treats the file or attachment as metadata and references; binary bytes are not included.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-attachments-contentur-e59a9a86d36c" title="Content URL" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.attachments.contentUrl`

            **Content URL.** ContentUrl for the attachment. It locates the provider resource or path associated with the chat message attachment.

            * **Enables:** Associate each chat message attachment with the resource identified by content URL in `channel_messages.ChatMessageAttachment.contentUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports content URL as a resource locator for each chat message attachment; access still depends on viewer permissions and the URL may expire or change. This stream treats the file or attachment as metadata and references; binary bytes are not included.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-attachments-id-aec6ebdfda0c" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.attachments.id`

            **ID.** The provider-reported ID for each chat message attachment in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Match repeated chat message attachment entries on ID in `channel_messages.ChatMessageAttachment.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its chat message attachment namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key. This stream treats the file or attachment as metadata and references; binary bytes are not included.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-attachments-name-a1dd5333bfdf" title="Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.attachments.name`

            **Name.** The provider-reported name for each chat message attachment in Channel Messages. It gives the chat message attachment a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each chat message attachment with name from `channel_messages.ChatMessageAttachment.name`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports name as display text for each chat message attachment; names are mutable and are not stable identities. This stream treats the file or attachment as metadata and references; binary bytes are not included.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-attachments-thumbnail-55c7af0d7348" title="Thumbnail URL" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.attachments.thumbnailUrl`

            **Thumbnail URL.** ThumbnailUrl for the attachment. It locates the provider resource or path associated with the chat message attachment.

            * **Enables:** Associate each chat message attachment with the resource identified by thumbnail URL in `channel_messages.ChatMessageAttachment.thumbnailUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports thumbnail URL as a resource locator for each chat message attachment; access still depends on viewer permissions and the URL may expire or change. This stream treats the file or attachment as metadata and references; binary bytes are not included.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-body-e562435842a0" title="Body" icon="terminal" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.body`

            **Body.** Message body content. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute body in `channel_messages.body` to the parent channel message; identify parent records where that nested body object is absent.
            * **Interpretation:** Microsoft 365 reports body as a nested object on each channel message; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-body-content-cd3fed11ac22" title="Content" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.body.content`

            **Content.** Body content. It defines the content surface available for this channel message.

            * **Enables:** Locate chat message body records by content in `channel_messages.ChatMessageBody.content`; attribute each text match to its parent channel message and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies content as text on each chat message body; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-body-contenttype-36bfef516c26" title="Content Type" icon="circle-exclamation" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.body.contentType`

            **Content Type.** Content type: text or html. It supplies the returned content type text needed to understand the chat message body in context.

            * **Enables:** Segment chat message body entries in Channel Messages by content type in `channel_messages.ChatMessageBody.contentType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports content type as a label from its own taxonomy on each chat message body; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-channelidentity-0a7b20e440f7" title="Channel Identity" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.channelIdentity`

            **Channel Identity.** Team and channel identity for this message. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute channel identity in `channel_messages.channelIdentity` to the parent channel message; identify parent records where that nested channel identity object is absent.
            * **Interpretation:** Microsoft 365 reports channel identity as a nested object on each channel message; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-channelidentity-chann-a6c3032ddec1" title="Channel ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.channelIdentity.channelId`

            **Channel ID.** Channel ID (opaque thread ID). It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each channel identity in Channel Messages to the referenced channel through `channel_messages.ChannelIdentity.channelId`; flag channel ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports channel ID as an identifier in its channel namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-channelidentity-teami-d135ca92413b" title="Team ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.channelIdentity.teamId`

            **Team ID.** Team ID. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each channel identity in Channel Messages to the referenced team through `channel_messages.ChannelIdentity.teamId`; flag team ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports team ID as an identifier in its team namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-chatid-d6dd8258d346" title="Chat ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.chatId`

            **Chat ID.** Chat ID when the message belongs to a chat rather than a channel; null for channel messages. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each channel message in Channel Messages to the referenced chat through `channel_messages.chatId`; flag chat ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports chat ID as an identifier in its chat namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-createddatetime-43197f33dfec" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.createdDateTime`

            **Created Date Time.** When the message was created. It anchors the channel message on the provider's reported timeline.

            * **Enables:** Order Channel Messages by created date time in `channel_messages.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-deleteddatetime-22ecb0a29909" title="Deleted Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.deletedDateTime`

            **Deleted Date Time.** When the message was soft-deleted, if ever. It anchors the channel message on the provider's reported timeline.

            * **Enables:** Order Channel Messages by deleted date time in `channel_messages.deletedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports deleted date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-etag-c97af76b19e2" title="ETag" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.etag`

            **ETag.** Version stamp for the message. It is needed for conditional reads and provider-version checks, not as a stable business identifier.

            * **Enables:** Use `channel_messages.etag` for conditional provider reads and revision checks; pair the ETag with the channel message ID rather than joining on it.
            * **Interpretation:** Microsoft 365 returns this ETag as an opaque revision token for each channel message; it can change when the resource changes and is not a universal identifier.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-4d18dcdc886b" title="From" icon="brackets-curly" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from`

            **From.** Identity of the sender. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute from in `channel_messages.from` to the parent channel message; identify parent records where that nested from object is absent.
            * **Interpretation:** Microsoft 365 reports from as a nested object on each channel message; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-application-59d1d67b92fe" title="Application" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.application`

            **Application.** Application identity when the sender is an app. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute application in `channel_messages.ChatMessageFrom.application` to the parent channel message; identify parent records where that nested application object is absent.
            * **Interpretation:** Microsoft 365 reports application as a nested object on each chat message from; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-application-appl-447e2c146b51" title="Application Identity Type" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.application.applicationIdentityType`

            **Application Identity Type.** The provider-reported application identity type for each application in Channel Messages. It distinguishes the provider-defined application identity type state or classification for the application.

            * **Enables:** Segment application entries in Channel Messages by application identity type in `channel_messages.ChatMessageFrom.application.applicationIdentityType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports application identity type as a label from its own taxonomy on each application; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-application-disp-63ed9ce563a5" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.application.displayName`

            **Display Name.** The provider-reported display name for each application in Channel Messages. It distinguishes the provider-defined display name state or classification for the application.

            * **Enables:** Label each application with display name from `channel_messages.ChatMessageFrom.application.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each application; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-application-id-e47ca2358752" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.application.id`

            **ID.** The provider-reported ID for each application in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each application in Channel Messages to the referenced application through `channel_messages.ChatMessageFrom.application.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its application namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-device-2c6d2fd20562" title="Device" icon="terminal" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.device`

            **Device.** Device identity when the sender is a device. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute device in `channel_messages.ChatMessageFrom.device` to the parent channel message; identify parent records where that nested device object is absent.
            * **Interpretation:** Microsoft 365 reports device as a nested object on each chat message from; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-device-displayna-54bebcc17e4e" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.device.displayName`

            **Display Name.** The provider-reported display name for each device in Channel Messages. It distinguishes the provider-defined display name state or classification for the device.

            * **Enables:** Label each device with display name from `channel_messages.ChatMessageFrom.device.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each device; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-device-id-bed69915b267" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.device.id`

            **ID.** The provider-reported ID for each device in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each device in Channel Messages to the referenced device through `channel_messages.ChatMessageFrom.device.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its device namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-user-717135bf0e52" title="User" icon="code-merge" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.user`

            **User.** User identity when the sender is a user. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute user in `channel_messages.ChatMessageFrom.user` to the parent channel message; identify parent records where that nested user object is absent.
            * **Interpretation:** Microsoft 365 reports user as a nested object on each chat message from; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-user-displayname-69054e4c7300" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.user.displayName`

            **Display Name.** Display name of the sender. It distinguishes the provider-defined display name state or classification for the user.

            * **Enables:** Label each user with display name from `channel_messages.ChatMessageFrom.user.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each user; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-user-id-fc997cc6f9aa" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.user.id`

            **ID.** Entra user ID of the sender. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each user in Channel Messages to the referenced user through `channel_messages.ChatMessageFrom.user.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-user-tenantid-678499767546" title="Tenant ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.user.tenantId`

            **Tenant ID.** Tenant ID of the sender when present. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each user in Channel Messages to the referenced tenant through `channel_messages.ChatMessageFrom.user.tenantId`; flag tenant ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-from-user-useridentit-fd530be9bbd2" title="User Identity Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.from.user.userIdentityType`

            **User Identity Type.** User identity type (e.g. aadUser). It supplies the user identity type profile facet used to reconcile or attribute the user.

            * **Enables:** Segment user entries in Channel Messages by user identity type in `channel_messages.ChatMessageFrom.user.userIdentityType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports user identity type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-id-b0db988b9cfa" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.id`

            **ID.** Wire chatMessage ID (unique within its channel). It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each channel message in Channel Messages to the referenced channel message through `channel_messages.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its channel message namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-importance-19e6af4a0cec" title="Importance" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.importance`

            **Importance.** Message importance: normal, high, urgent, or unknownFutureValue. It supplies the returned importance text needed to understand the channel message in context.

            * **Enables:** Search the returned importance text in `channel_messages.importance` and attribute each match to its parent channel message and reported author when available.
            * **Interpretation:** Microsoft 365 supplies importance as returned text on each channel message; truncation, formatting, and access boundaries can limit completeness.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-lastediteddatetime-e0ef76afa469" title="Last Edited Date Time" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.lastEditedDateTime`

            **Last Edited Date Time.** When the message body was last edited, if ever. It anchors the channel message on the provider's reported timeline.

            * **Enables:** Order Channel Messages by last edited date time in `channel_messages.lastEditedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports last edited date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-lastmodifieddatetime-f5f68c025ae7" title="Last Modified Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.lastModifiedDateTime`

            **Last Modified Date Time.** When the message was last modified. Used as incremental sync cursor. It anchors the channel message on the provider's reported timeline.

            * **Enables:** Order Channel Messages by last modified date time in `channel_messages.lastModifiedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports last modified date time as a timestamp on each channel message; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-locale-4b7192632723" title="Locale" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.locale`

            **Locale.** Locale of the message body. It supplies the returned locale text needed to understand the channel message in context.

            * **Enables:** Search the returned locale text in `channel_messages.locale` and attribute each match to its parent channel message and reported author when available.
            * **Interpretation:** Microsoft 365 supplies locale as returned text on each channel message; truncation, formatting, and access boundaries can limit completeness.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-bd7c6c441598" title="Mentions" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions`

            **Mentions.** Mentions in the message. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute each returned chat message mention in `channel_messages.mentions` to the parent channel message and reconcile the reacting or mentioned users and provider symbol.
            * **Interpretation:** Microsoft 365 returns mentions as an array of chat message mention entries on each channel message; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-id-0133bef76c7f" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.id`

            **ID.** Mention index within the message. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Match repeated chat message mention entries on ID in `channel_messages.ChatMessageMention.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its chat message mention namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-d6a33e97b774" title="Mentioned" icon="terminal" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned`

            **Mentioned.** Identity that was mentioned. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute mentioned in `channel_messages.ChatMessageMention.mentioned` to the parent channel message; identify parent records where that nested mentioned object is absent.
            * **Interpretation:** Microsoft 365 reports mentioned as a nested object on each chat message mention; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-ap-6e4ddddd50a7" title="Application" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.application`

            **Application.** The structured application details attached to each mentioned in Channel Messages. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute application in `channel_messages.ChatMessageMention.mentioned.application` to the parent channel message; identify parent records where that nested application object is absent.
            * **Interpretation:** Microsoft 365 reports application as a nested object on each mentioned; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-ap-c7ee1f7f8827" title="Application Identity Type" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.application.applicationIdentityType`

            **Application Identity Type.** The provider-reported application identity type for each application in Channel Messages. It distinguishes the provider-defined application identity type state or classification for the application.

            * **Enables:** Segment application entries in Channel Messages by application identity type in `channel_messages.ChatMessageMention.mentioned.application.applicationIdentityType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports application identity type as a label from its own taxonomy on each application; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-ap-ddef91fa1b5b" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.application.displayName`

            **Display Name.** The provider-reported display name for each application in Channel Messages. It distinguishes the provider-defined display name state or classification for the application.

            * **Enables:** Label each application with display name from `channel_messages.ChatMessageMention.mentioned.application.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each application; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-ap-e291517c2a6f" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.application.id`

            **ID.** The provider-reported ID for each application in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each application in Channel Messages to the referenced application through `channel_messages.ChatMessageMention.mentioned.application.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its application namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-co-7f07d2a68866" title="Conversation" icon="terminal" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.conversation`

            **Conversation.** The structured conversation details attached to each mentioned in Channel Messages. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute conversation in `channel_messages.ChatMessageMention.mentioned.conversation` to the parent channel message; identify parent records where that nested conversation object is absent.
            * **Interpretation:** Microsoft 365 reports conversation as a nested object on each mentioned; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-co-27cbfb6fb4be" title="Conversation Identity Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.conversation.conversationIdentityType`

            **Conversation Identity Type.** The provider-reported conversation identity type for each conversation in Channel Messages. It distinguishes the provider-defined conversation identity type state or classification for the conversation.

            * **Enables:** Segment conversation entries in Channel Messages by conversation identity type in `channel_messages.ChatMessageMention.mentioned.conversation.conversationIdentityType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports conversation identity type as a label from its own taxonomy on each conversation; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-co-9c127eed5565" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.conversation.displayName`

            **Display Name.** The provider-reported display name for each conversation in Channel Messages. It distinguishes the provider-defined display name state or classification for the conversation.

            * **Enables:** Label each conversation with display name from `channel_messages.ChatMessageMention.mentioned.conversation.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each conversation; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-co-1256295ebf6d" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.conversation.id`

            **ID.** The provider-reported ID for each conversation in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each conversation in Channel Messages to the referenced conversation through `channel_messages.ChatMessageMention.mentioned.conversation.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its conversation namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-us-f720496390b6" title="User" icon="code-merge" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.user`

            **User.** The structured user details attached to each mentioned in Channel Messages. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute user in `channel_messages.ChatMessageMention.mentioned.user` to the parent channel message; identify parent records where that nested user object is absent.
            * **Interpretation:** Microsoft 365 reports user as a nested object on each mentioned; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-us-ecb1d2c7d281" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.user.displayName`

            **Display Name.** The provider-reported display name for each user in Channel Messages. It distinguishes the provider-defined display name state or classification for the user.

            * **Enables:** Label each user with display name from `channel_messages.ChatMessageMention.mentioned.user.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each user; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-us-d6e396025cb9" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.user.id`

            **ID.** The provider-reported ID for each user in Channel Messages. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each user in Channel Messages to the referenced user through `channel_messages.ChatMessageMention.mentioned.user.id`; flag ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentioned-us-6aed818ddccc" title="User Identity Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentioned.user.userIdentityType`

            **User Identity Type.** The provider-reported user identity type for each user in Channel Messages. It supplies the user identity type profile facet used to reconcile or attribute the user.

            * **Enables:** Segment user entries in Channel Messages by user identity type in `channel_messages.ChatMessageMention.mentioned.user.userIdentityType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports user identity type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-mentions-mentiontext-b53e198f9232" title="Mention Text" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.mentions.mentionText`

            **Mention Text.** Display text of the mention. It defines the content surface available for this channel message.

            * **Enables:** Locate chat message mention records by mention text in `channel_messages.ChatMessageMention.mentionText`; attribute each text match to its parent channel message and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies mention text as text on each chat message mention; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-message-key-aaad8bbd1901" title="Message Key" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.message_key`

            **Message Key.** Synthetic primary key hashing channelIdentity.channelId and wire ID. Graph message IDs are unique within a channel, not across channels. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Match repeated channel message entries on message key in `channel_messages.message_key`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports message key as an identifier in its message namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-messagetype-c00c1332ec81" title="Message Type" icon="circle-exclamation" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.messageType`

            **Message Type.** Message type (message, chatEvent, typing, unknownFutureValue, systemEventMessage). It supplies the returned message type text needed to understand the channel message in context.

            * **Enables:** Segment channel message entries in Channel Messages by message type in `channel_messages.messageType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports message type as a label from its own taxonomy on each channel message; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-reactions-fe309504da46" title="Reactions" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.reactions`

            **Reactions.** Reactions on the message. Stored as Generic.JSON because Graph emits one object per (user, emoji); a typed child table keyed only on reactionType would silently collapse multi-user reactions. It preserves the nested context needed to interpret the parent channel message.

            * **Enables:** Attribute each returned reaction in `channel_messages.reactions` to the parent channel message and reconcile the reacting or mentioned users and provider symbol.
            * **Interpretation:** Microsoft 365 returns reactions as an array of reaction entries on each channel message; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-replytoid-d842c623e000" title="Reply To ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.replyToId`

            **Reply To ID.** ID of the parent root message when this record is a thread reply. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each channel message in Channel Messages to the referenced reply to through `channel_messages.replyToId`; flag reply to ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports reply to ID as an identifier in its reply to namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-subject-8a0c9d6157e0" title="Subject" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.subject`

            **Subject.** Plaintext subject of the message. It defines the content surface available for this channel message.

            * **Enables:** Locate channel message records by subject in `channel_messages.subject`; attribute each text match to its parent channel message and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies subject as text on each channel message; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-summary-d70ce3a50a40" title="Summary" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.summary`

            **Summary.** Summary text for notifications or fallback views. It defines the content surface available for this channel message.

            * **Enables:** Locate channel message records by summary in `channel_messages.summary`; attribute each text match to its parent channel message and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies summary as text on each channel message; referenced files or media are not implied unless explicitly represented. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-team-id-902437db2460" title="Team ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.team_id`

            **Team ID.** Parent team reference copied into each channel message because the child operation does not return that relationship. It provides the reference needed to connect the channel message to the corresponding provider object.

            * **Enables:** Connect each channel message in Channel Messages to the referenced team through `channel_messages.team_id`; flag team ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies team ID from the parent traversal record into each channel message; the child Microsoft 365 operation does not return it.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channel-messages-weburl-81bcfeb76d5c" title="Web URL" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `channel_messages.webUrl`

            **Web URL.** Deep link URL to the message in Microsoft Teams. It locates the provider resource or path associated with the channel message.

            * **Enables:** Associate each channel message with the resource identified by web URL in `channel_messages.webUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports web URL as a resource locator for each channel message; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-channels-62eab0d73ea5" title="Channels" icon="address-book" iconType="sharp-duotone-solid">
        Developer identifier: `channels`

        **Channels.** Channels within each Microsoft Team.

        * **Enables:** Match channels to their parent Team and compare channel name, description, type, membership mode, and lifecycle state.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/teams/{id}/channels` operation as a snapshot stream using full synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-channels-createddatetime-82a7628e89fc" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channels.createdDateTime`

            **Created Date Time.** When the channel was created. It anchors the channel on the provider's reported timeline.

            * **Enables:** Order Channels by created date time in `channels.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each channel; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-description-a9a50ca69d4c" title="Description" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `channels.description`

            **Description.** Optional channel description. It defines the content surface available for this channel.

            * **Enables:** Locate channel records by description in `channels.description`; attribute each text match to its parent channel and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies description as text on each channel; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-displayname-f4eb9628995c" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `channels.displayName`

            **Display Name.** Display name of the channel. It distinguishes the provider-defined display name state or classification for the channel.

            * **Enables:** Label each channel with display name from `channels.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each channel; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-id-e9b49805776f" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `channels.id`

            **ID.** Channel ID (opaque thread ID, e.g. 19:...\@thread.tacv2). Not an RFC UUID. It provides the reference needed to connect the channel to the corresponding provider object.

            * **Enables:** Match repeated channel entries on ID in `channels.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its channel namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-isarchived-e8f623c7001b" title="Is Archived" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `channels.isArchived`

            **Is Archived.** Whether the channel is archived. It distinguishes the provider-defined is archived state or classification for the channel.

            * **Enables:** Filter Channels by whether the channel is archived in `channels.isArchived`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the channel is archived as a boolean on each channel; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-isfavoritebydefault-8ebdd97f9775" title="Is Favorite By Default" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `channels.isFavoriteByDefault`

            **Is Favorite By Default.** Whether the channel is favorited by default for team members. It distinguishes the provider-defined is favorite by default state or classification for the channel.

            * **Enables:** Filter Channels by whether the channel is favorited by default for team members in `channels.isFavoriteByDefault`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the channel is favorited by default for team members as a boolean on each channel; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-membershiptype-e8a2a85411a6" title="Membership Type" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `channels.membershipType`

            **Membership Type.** Channel membership type: standard, private, shared, or unknownFutureValue. It identifies the related provider object that gives the channel its parent, owner, or container context.

            * **Enables:** Segment channel entries in Channels by membership type in `channels.membershipType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports membership type as a label from its own taxonomy on each channel; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-team-id-b4239689110d" title="Team ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `channels.team_id`

            **Team ID.** Parent team reference copied into each channel because the child operation does not return that relationship. It provides the reference needed to connect the channel to the corresponding provider object.

            * **Enables:** Connect each channel in Channels to the referenced team through `channels.team_id`; flag team ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies team ID from the parent traversal record into each channel; the child Microsoft 365 operation does not return it.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-tenantid-127adbcef5b5" title="Tenant ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `channels.tenantId`

            **Tenant ID.** Entra tenant ID that owns the channel. It provides the reference needed to connect the channel to the corresponding provider object.

            * **Enables:** Connect each channel in Channels to the referenced tenant through `channels.tenantId`; flag tenant ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-channels-weburl-d0e7fc1da63e" title="Web URL" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `channels.webUrl`

            **Web URL.** Deep link URL to the channel in Microsoft Teams. It locates the provider resource or path associated with the channel.

            * **Enables:** Associate each channel with the resource identified by web URL in `channels.webUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports web URL as a resource locator for each channel; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-copilot-interactions-295a3d79897d" title="Copilot Interactions" icon="user-shield" iconType="sharp-duotone-solid">
        Developer identifier: `copilot_interactions`

        **Copilot Interactions.** Microsoft 365 Copilot user interaction audit records via the Purview /beta async create-poll-fetch pattern. Filters recordTypeFilters to CopilotInteraction (who/when/AppHost/AccessedResources). Does not include prompt or response text. Opt-in; requires AuditLogsQuery.Read.All.

        * **Enables:** Attribute Microsoft-reported Copilot interaction events to users, host applications, accessed resources, and timestamps.
        * **Scope:** Reads the records selected by Microsoft 365's `/beta/security/auditLog/queries` operation as an event stream using incremental synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The filtered Purview records include who, when, host application, and accessed-resource metadata; prompt and response text are excluded. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-copilot-interactions-administrativeuni-22ea153abf57" title="Administrative Units" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.administrativeUnits`

            **Administrative Units.** Administrative units associated with the record. It preserves the nested context needed to interpret the parent copilot interaction.

            * **Enables:** Attribute every returned administrative unit value in `copilot_interactions.administrativeUnits` to its parent copilot interaction; keep each relationship distinct and distinguish an absent array from an explicitly empty one.
            * **Interpretation:** Microsoft 365 returns administrative units as an array of administrative unit value entries on each copilot interaction; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-auditdata-d6ba86bd0ce1" title="Audit Data" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.auditData`

            **Audit Data.** Raw Copilot audit payload as a JSON object, including CopilotEventData (AppHost, Contexts, AccessedResources, Messages, ThreadId). Does not contain prompt or response text. It preserves the nested context needed to interpret the parent copilot interaction.

            * **Enables:** Attribute audit data in `copilot_interactions.auditData` to the parent copilot interaction; identify parent records where that nested audit data object is absent.
            * **Interpretation:** Microsoft 365 reports audit data as a nested object on each copilot interaction; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-auditlogrecordtyp-b0b9513ecba5" title="Audit Log Record Type" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.auditLogRecordType`

            **Audit Log Record Type.** Audit log record type (CopilotInteraction for this tap). It distinguishes the provider-defined audit log record type state or classification for the copilot interaction.

            * **Enables:** Segment copilot interaction entries in Copilot Interactions by audit log record type in `copilot_interactions.auditLogRecordType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports audit log record type as a label from its own taxonomy on each copilot interaction; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-clientip-cd578881c95f" title="Client IP" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.clientIp`

            **Client IP.** Client IP address from which the operation was performed. It supplies the provider-reported address or location facet for the copilot interaction, not a residency determination.

            * **Enables:** Correlate copilot interaction records that report the same network address in `copilot_interactions.clientIp` during an authorized investigation; account for shared, proxied, or translated addresses.
            * **Interpretation:** Microsoft 365 reports this as an IP network address on each copilot interaction. It is not verified geolocation, does not identify a person by itself, and does not establish data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-createddatetime-309c71061150" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.createdDateTime`

            **Created Date Time.** Timestamp when the Copilot interaction occurred. It anchors the copilot interaction on the provider's reported timeline.

            * **Enables:** Order Copilot Interactions by created date time in `copilot_interactions.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each copilot interaction; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-id-d063a7dd6a6a" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.id`

            **ID.** Unique identifier of the audit log record. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

            * **Enables:** Match repeated copilot interaction entries on ID in `copilot_interactions.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its copilot interaction namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-objectid-4377ae1008db" title="Object ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.objectId`

            **Object ID.** Identifier of the object the operation acted on, when present. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

            * **Enables:** Connect each copilot interaction in Copilot Interactions to the referenced object through `copilot_interactions.objectId`; flag object ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports object ID as an identifier in its object namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-operation-b3209c47e192" title="Operation" icon="video" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.operation`

            **Operation.** Operation name (typically CopilotInteraction). It distinguishes the provider-defined operation state or classification for the copilot interaction.

            * **Enables:** Filter Copilot Interactions by the exact Microsoft 365-defined operation in `copilot_interactions.operation` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies operation from its own taxonomy on each copilot interaction; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-organizationid-925e8e18f0e7" title="Organization ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.organizationId`

            **Organization ID.** Microsoft tenant identifier. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

            * **Enables:** Connect each copilot interaction in Copilot Interactions to the referenced organization through `copilot_interactions.organizationId`; flag organization ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports organization ID as an identifier in its organization namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-service-eb6b9159adab" title="Service" icon="headset" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.service`

            **Service.** Microsoft 365 service that produced the record (typically Copilot). It distinguishes the provider-defined service state or classification for the copilot interaction.

            * **Enables:** Filter Copilot Interactions by the exact Microsoft 365-defined service in `copilot_interactions.service` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies service from its own taxonomy on each copilot interaction; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-userid-69b9b8015895" title="User ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.userId`

            **User ID.** Object ID of the user that performed the Copilot interaction. It provides the reference needed to connect the copilot interaction to the corresponding provider object.

            * **Enables:** Connect each copilot interaction in Copilot Interactions to the referenced user through `copilot_interactions.userId`; flag user ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-userprincipalname-581c9d4cd1b2" title="User Principal Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.userPrincipalName`

            **User Principal Name.** UPN of the user that performed the Copilot interaction. It gives the copilot interaction a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each copilot interaction with user principal name from `copilot_interactions.userPrincipalName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports user principal name as display text for each copilot interaction; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-copilot-interactions-usertype-3758d0156874" title="User Type" icon="triangle-exclamation" iconType="sharp-duotone-solid">
            Developer identifier: `copilot_interactions.userType`

            **User Type.** Type of user that performed the operation. It supplies the user type profile facet used to reconcile or attribute the copilot interaction.

            * **Enables:** Segment copilot interaction entries in Copilot Interactions by user type in `copilot_interactions.userType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports user type as a label from its own taxonomy on each copilot interaction; preserve unknown labels rather than mapping them by assumption.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-groups-0520696d4437" title="Groups" icon="address-book" iconType="sharp-duotone-solid">
        Developer identifier: `groups`

        **Groups.** Microsoft Entra groups (all group types, including non-Teams). Overlaps with the teams tap for groups that have resourceProvisioningOptions Team; teams remains the filtered source for Teams child fan-out.

        * **Enables:** Inventory all Entra group types and distinguish Teams-enabled groups from groups not used for Teams child traversal.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/groups` operation as a snapshot stream using full synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-groups-classification-d39c75354a3a" title="Classification" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `groups.classification`

            **Classification.** Classification of the group (e.g. Low, Medium, High) when classifications are configured for the organization. It distinguishes the provider-defined classification state or classification for the group.

            * **Enables:** Segment group entries in Groups by classification in `groups.classification`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports classification as a label from its own taxonomy on each group; preserve unknown labels rather than mapping them by assumption. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-createddatetime-0dadfbe9e415" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `groups.createdDateTime`

            **Created Date Time.** When the group was created. It anchors the group on the provider's reported timeline.

            * **Enables:** Order Groups by created date time in `groups.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-deleteddatetime-c2070849e743" title="Deleted Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `groups.deletedDateTime`

            **Deleted Date Time.** When the group was soft-deleted, if it is in the deleted items. It anchors the group on the provider's reported timeline.

            * **Enables:** Order Groups by deleted date time in `groups.deletedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports deleted date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-description-ed02eed2a8e0" title="Description" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `groups.description`

            **Description.** Description of the group. It defines the content surface available for this group.

            * **Enables:** Locate group records by description in `groups.description`; attribute each text match to its parent group and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies description as text on each group; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-displayname-0f5f9c3f49ed" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `groups.displayName`

            **Display Name.** Display name of the group. It distinguishes the provider-defined display name state or classification for the group.

            * **Enables:** Label each group with display name from `groups.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each group; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-expirationdatetime-d3ff56ce4ef8" title="Expiration Date Time" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `groups.expirationDateTime`

            **Expiration Date Time.** When the group is set to expire under the group lifecycle policy. It anchors the group on the provider's reported timeline.

            * **Enables:** Order Groups by expiration date time in `groups.expirationDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports expiration date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-grouptypes-3c45cda3cae7" title="Group Types" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `groups.groupTypes`

            **Group Types.** Group type markers (e.g. Unified for M365 groups, DynamicMembership). It preserves the nested context needed to interpret the parent group.

            * **Enables:** Compare the exact Microsoft 365-configured group types set in `groups.groupTypes` for each group; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns group types as an array of group type value entries on each group; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-id-6e4089c75357" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `groups.id`

            **ID.** Unique identifier for the group. It provides the reference needed to connect the group to the corresponding provider object.

            * **Enables:** Match repeated group entries on ID in `groups.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its group namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-mail-ca4d67641a92" title="Mail" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `groups.mail`

            **Mail.** SMTP address for the group. It supplies the provider-reported address or location facet for the group, not a residency determination.

            * **Enables:** Group Groups by the exact mail in `groups.mail` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports mail as an address or location facet on each group; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-mailenabled-2b202586a312" title="Mail Enabled" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `groups.mailEnabled`

            **Mail Enabled.** Whether the group is mail-enabled. It distinguishes the provider-defined mail enabled state or classification for the group.

            * **Enables:** Filter Groups by whether the group is mail-enabled in `groups.mailEnabled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the group is mail-enabled as a boolean on each group; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-mailnickname-dd1ec11cb4bd" title="Mail Nickname" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `groups.mailNickname`

            **Mail Nickname.** Mail alias for the group. It supplies the mail nickname profile facet used to reconcile or attribute the group.

            * **Enables:** Reconcile the group's mail nickname in `groups.mailNickname` with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
            * **Interpretation:** Microsoft 365 reports mail nickname as a mutable profile or directory attribute on each group; it may be absent, shared, or non-unique.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-reneweddatetime-38e41368fd9a" title="Renewed Date Time" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `groups.renewedDateTime`

            **Renewed Date Time.** When the group was last renewed under the group lifecycle policy. It anchors the group on the provider's reported timeline.

            * **Enables:** Order Groups by renewed date time in `groups.renewedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports renewed date time as a timestamp on each group; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-resourceprovisioningoptions-fb5580df8dea" title="Resource Provisioning Options" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `groups.resourceProvisioningOptions`

            **Resource Provisioning Options.** Provisioned resources for the group (e.g. Team). It preserves the nested context needed to interpret the parent group.

            * **Enables:** Compare the exact Microsoft 365-configured resource provisioning options set in `groups.resourceProvisioningOptions` for each group; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns resource provisioning options as an array of resource provisioning option value entries on each group; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-securityenabled-c7be3dafb39b" title="Security Enabled" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `groups.securityEnabled`

            **Security Enabled.** Whether the group is a security group. It distinguishes the provider-defined security enabled state or classification for the group.

            * **Enables:** Filter Groups by whether the group is a security group in `groups.securityEnabled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the group is a security group as a boolean on each group; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-groups-visibility-e5e2e42bdab5" title="Visibility" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `groups.visibility`

            **Visibility.** Group visibility: Public, Private, or HiddenMembership. It distinguishes the provider-defined visibility state or classification for the group.

            * **Enables:** Segment group entries in Groups by visibility in `groups.visibility`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports visibility as a label from its own taxonomy on each group; preserve unknown labels rather than mapping them by assumption.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-messages-2fece9ecb131" title="Messages" icon="comment-dots" iconType="sharp-duotone-solid">
        Developer identifier: `messages`

        **Messages.** Mailbox messages by user.

        * **Enables:** Attribute mailbox message metadata, recipient headers, and body previews to the owning user and conversation.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/users/{id}/messages` operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The selected fields include `bodyPreview`, not the full message body; expanded attachments provide metadata only unless the response explicitly contains content bytes. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-messages-bccrecipients-226f7be6ee45" title="Bcc Recipients" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `messages.bccRecipients`

            **Bcc Recipients.** Recipients on the Bcc line of the message. It preserves the nested context needed to interpret the parent message.

            * **Enables:** Attribute each returned recipient in `messages.bccRecipients` to the parent message; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
            * **Interpretation:** Microsoft 365 returns bcc recipients as an array of recipient entries on each message; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-bccrecipients-emailaddress-bdc23e288ec3" title="Email Address" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `messages.bccRecipients.emailAddress`

            **Email Address.** Email address and display name of the recipient. It preserves the nested context needed to interpret the parent message.

            * **Enables:** Match repeated recipient entries on email address in `messages.Recipient.emailAddress`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-bccrecipients-emailaddress-ad-b2f3a82530f4" title="Address" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `messages.bccRecipients.emailAddress.address`

            **Address.** Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

            * **Enables:** Match repeated email address entries on address in `messages.EmailAddress.address`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-bccrecipients-emailaddress-na-8a6d2d07abfb" title="Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `messages.bccRecipients.emailAddress.name`

            **Name.** Display name of the person or entity. It gives the email address a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each email address with name from `messages.EmailAddress.name`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-bodypreview-e9bdf3201d1a" title="Body Preview" icon="circle-info" iconType="sharp-duotone-solid">
            Developer identifier: `messages.bodyPreview`

            **Body Preview.** Short text preview of the message body. It defines the content surface available for this message.

            * **Enables:** Locate message records whose body preview in `messages.bodyPreview` contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
            * **Interpretation:** This is an excerpt supplied by the provider, not the complete body or an attachment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-ccrecipients-eebee6da32c5" title="Cc Recipients" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `messages.ccRecipients`

            **Cc Recipients.** Recipients on the Cc line of the message. It preserves the nested context needed to interpret the parent message.

            * **Enables:** Attribute each returned recipient in `messages.ccRecipients` to the parent message; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
            * **Interpretation:** Microsoft 365 returns cc recipients as an array of recipient entries on each message; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-conversationid-e55652ecd0fa" title="Conversation ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `messages.conversationId`

            **Conversation ID.** ID of the conversation the message belongs to. It provides the reference needed to connect the message to the corresponding provider object.

            * **Enables:** Connect each message in Messages to the referenced conversation through `messages.conversationId`; flag conversation ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports conversation ID as an identifier in its conversation namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-createddatetime-00e40483a8fd" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `messages.createdDateTime`

            **Created Date Time.** Date and time the message was created in ISO 8601 format. It anchors the message on the provider's reported timeline.

            * **Enables:** Order Messages by created date time in `messages.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-from-c8079fcecb6d" title="From" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `messages.from`

            **From.** Mailbox owner and sender of the message (the From header). It preserves the nested context needed to interpret the parent message.

            * **Enables:** Attribute from in `messages.from` to the parent message; identify parent records where that nested from object is absent.
            * **Interpretation:** Microsoft 365 reports from as a nested object on each message; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-hasattachments-545d727591ee" title="Has Attachments" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `messages.hasAttachments`

            **Has Attachments.** Whether the message has file attachments (excludes inline attachments). It distinguishes the provider-defined has attachments state or classification for the message.

            * **Enables:** Filter Messages by whether the message has file attachments (excludes inline attachments) in `messages.hasAttachments`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the message has file attachments (excludes inline attachments) as a boolean on each message; a missing field is unknown, not false. This stream treats the file or attachment as metadata and references; binary bytes are not included.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-id-9fbe1acda614" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `messages.id`

            **ID.** Unique identifier for the message. It provides the reference needed to connect the message to the corresponding provider object.

            * **Enables:** Match repeated message entries on ID in `messages.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its message namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-importance-5efb6411bc2c" title="Importance" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `messages.importance`

            **Importance.** Importance of the message: low, normal, or high. It distinguishes the provider-defined importance state or classification for the message.

            * **Enables:** Segment message entries in Messages by importance in `messages.importance`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports importance as a label from its own taxonomy on each message; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-internetmessageid-74d291e6fb53" title="Internet Message ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `messages.internetMessageId`

            **Internet Message ID.** RFC 2822 Internet message ID of the message (Message-ID header). It provides the reference needed to connect the message to the corresponding provider object.

            * **Enables:** Connect each message in Messages to the referenced internet message through `messages.internetMessageId`; flag internet message ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports internet message ID as an identifier in its internet message namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-isdraft-227f293c5df3" title="Is Draft" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `messages.isDraft`

            **Is Draft.** Whether the message is a draft that has not yet been sent. It distinguishes the provider-defined is draft state or classification for the message.

            * **Enables:** Filter Messages by whether the message is a draft that has not yet been sent in `messages.isDraft`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the message is a draft that has not yet been sent as a boolean on each message; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-isread-17a950e811ac" title="Is Read" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `messages.isRead`

            **Is Read.** Whether the message has been read. It distinguishes the provider-defined is read state or classification for the message.

            * **Enables:** Filter Messages by whether the message has been read in `messages.isRead`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the message has been read as a boolean on each message; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-lastmodifieddatetime-9e19336f19bd" title="Last Modified Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `messages.lastModifiedDateTime`

            **Last Modified Date Time.** Date and time the message was last modified in ISO 8601 format. It anchors the message on the provider's reported timeline.

            * **Enables:** Order Messages by last modified date time in `messages.lastModifiedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports last modified date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-parentfolderid-0698b4415b27" title="Parent Folder ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `messages.parentFolderId`

            **Parent Folder ID.** Unique identifier for the mailbox folder that contains the message. It provides the reference needed to connect the message to the corresponding provider object.

            * **Enables:** Connect each message in Messages to the referenced parent folder through `messages.parentFolderId`; flag parent folder ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports parent folder ID as an identifier in its parent folder namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-receiveddatetime-23127a1b0293" title="Received Date Time" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `messages.receivedDateTime`

            **Received Date Time.** Date and time the message was received in ISO 8601 format. Used as incremental sync cursor. It anchors the message on the provider's reported timeline.

            * **Enables:** Order Messages by received date time in `messages.receivedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports received date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-sender-c4b3fece7c08" title="Sender" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `messages.sender`

            **Sender.** Account actually used to generate the message. Differs from from when sending on behalf of another mailbox. It preserves the nested context needed to interpret the parent message.

            * **Enables:** Attribute sender in `messages.sender` to the parent message; identify parent records where that nested sender object is absent.
            * **Interpretation:** Microsoft 365 reports sender as a nested object on each message; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-sentdatetime-50d06fb11e44" title="Sent Date Time" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `messages.sentDateTime`

            **Sent Date Time.** Date and time the message was sent in ISO 8601 format. It anchors the message on the provider's reported timeline.

            * **Enables:** Order Messages by sent date time in `messages.sentDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports sent date time as a timestamp on each message; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-subject-ac1f31c5439c" title="Subject" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `messages.subject`

            **Subject.** Subject line of the message. It defines the content surface available for this message.

            * **Enables:** Locate message records by subject in `messages.subject`; attribute each text match to its parent message and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies subject as text on each message; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-torecipients-0be8fb25e7c1" title="To Recipients" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `messages.toRecipients`

            **To Recipients.** Recipients on the To line of the message. It preserves the nested context needed to interpret the parent message.

            * **Enables:** Attribute each returned recipient in `messages.toRecipients` to the parent message; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
            * **Interpretation:** Microsoft 365 returns to recipients as an array of recipient entries on each message; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-messages-user-id-2991834b7345" title="User ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `messages.user_id`

            **User ID.** Parent user reference copied into each message because the child operation does not return that relationship. It provides the reference needed to connect the message to the corresponding provider object.

            * **Enables:** Connect each message in Messages to the referenced user through `messages.user_id`; flag user ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies user ID from the parent traversal record into each message; the child Microsoft 365 operation does not return it.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-organization-1ae53c58a0bf" title="Organization" icon="address-book" iconType="sharp-duotone-solid">
        Developer identifier: `organization`

        **Organization.** Entra organization (tenant) metadata.

        * **Enables:** Inventory the Entra organization's identity, verified domains, directory settings, and synchronization metadata.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/organization` operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-organization-countrylettercode-5022296b38a0" title="Country Letter Code" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `organization.countryLetterCode`

            **Country Letter Code.** Country letter code. It supplies the provider-reported address or location facet for the organization, not a residency determination.

            * **Enables:** Group Organization by country letter code in `organization.countryLetterCode` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports country letter code as a user, device, request, or resource location attribute on each organization; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-createddatetime-1a881514b60a" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `organization.createdDateTime`

            **Created Date Time.** When the organization was created. It anchors the organization on the provider's reported timeline.

            * **Enables:** Order Organization by created date time in `organization.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each organization; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-deleteddatetime-9495cd9fd5e2" title="Deleted Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `organization.deletedDateTime`

            **Deleted Date Time.** When the organization was soft-deleted, if ever. It anchors the organization on the provider's reported timeline.

            * **Enables:** Order Organization by deleted date time in `organization.deletedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports deleted date time as a timestamp on each organization; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-displayname-0e6450b323ec" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `organization.displayName`

            **Display Name.** Display name of the organization. It distinguishes the provider-defined display name state or classification for the organization.

            * **Enables:** Label each organization with display name from `organization.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each organization; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-id-450d666f9bfd" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `organization.id`

            **ID.** Tenant ID. It provides the reference needed to connect the organization to the corresponding provider object.

            * **Enables:** Match repeated organization entries on ID in `organization.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its organization namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-preferredlanguage-88e61861c57d" title="Preferred Language" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `organization.preferredLanguage`

            **Preferred Language.** Preferred language for the organization. It supplies the preferred language profile facet used to reconcile or attribute the organization.

            * **Enables:** Reconcile the organization's preferred language in `organization.preferredLanguage` with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
            * **Interpretation:** Microsoft 365 reports preferred language as a mutable profile or directory attribute on each organization; it may be absent, shared, or non-unique.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-tenanttype-c67597e2d7cb" title="Tenant Type" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `organization.tenantType`

            **Tenant Type.** Tenant type. It distinguishes the provider-defined tenant type state or classification for the organization.

            * **Enables:** Segment organization entries in Organization by tenant type in `organization.tenantType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports tenant type as a label from its own taxonomy on each organization; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-verifieddomains-55ea45da565b" title="Verified Domains" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `organization.verifiedDomains`

            **Verified Domains.** Verified domains for the organization. It preserves the nested context needed to interpret the parent organization.

            * **Enables:** Reconcile each returned verified domain in `organization.verifiedDomains` with the parent organization's provider profile; preserve distinct aliases, contact points, and organization attributes.
            * **Interpretation:** Microsoft 365 returns verified domains as an array of verified domain entries on each organization; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-verifieddomains-capabilit-7f4c072cb77c" title="Capabilities" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `organization.verifiedDomains.capabilities`

            **Capabilities.** The provider-reported capabilities for each verified domain in Organization. It distinguishes the provider-defined capabilities state or classification for the verified domain.

            * **Enables:** Filter Organization by the exact Microsoft 365-defined capabilities in `organization.VerifiedDomain.capabilities` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies capabilities from its own taxonomy on each verified domain; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-verifieddomains-isdefault-5987132859fc" title="Is Default" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `organization.verifiedDomains.isDefault`

            **Is Default.** The provider-reported is default for each verified domain in Organization. It distinguishes the provider-defined is default state or classification for the verified domain.

            * **Enables:** Filter Organization by whether is default in `organization.VerifiedDomain.isDefault`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports is default as a boolean on each verified domain; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-verifieddomains-isinitial-728382668d03" title="Is Initial" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `organization.verifiedDomains.isInitial`

            **Is Initial.** The provider-reported is initial for each verified domain in Organization. It distinguishes the provider-defined is initial state or classification for the verified domain.

            * **Enables:** Filter Organization by whether is initial in `organization.VerifiedDomain.isInitial`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports is initial as a boolean on each verified domain; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-verifieddomains-name-0fd91fb25efa" title="Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `organization.verifiedDomains.name`

            **Name.** Verified domain name. It gives the verified domain a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Match repeated verified domain entries on name in `organization.VerifiedDomain.name`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports name as display text for each verified domain; names are mutable and are not stable identities. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-organization-verifieddomains-type-7a8d46080e23" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `organization.verifiedDomains.type`

            **Type.** The provider-reported type for each verified domain in Organization. It distinguishes the provider-defined type state or classification for the verified domain.

            * **Enables:** Segment verified domain entries in Organization by type in `organization.VerifiedDomain.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each verified domain; preserve unknown labels rather than mapping them by assumption.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-sign-in-logs-5111917fc31e" title="Sign In Logs" icon="badge-check" iconType="sharp-duotone-solid">
        Developer identifier: `sign_in_logs`

        **Sign In Logs.** Microsoft Entra sign-in logs.

        * **Enables:** Trace Microsoft Entra sign-in attempts to users, applications, devices, network attributes, and provider outcomes.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/auditLogs/signIns` operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-sign-in-logs-appdisplayname-cd0653574f13" title="App Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.appDisplayName`

            **App Display Name.** Name of the application the user signed into. It distinguishes the provider-defined app display name state or classification for the sign in log.

            * **Enables:** Label each sign in log with app display name from `sign_in_logs.appDisplayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports app display name as display text for each sign in log; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-appid-d583d2fd48fd" title="App ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.appId`

            **App ID.** Application ID of the app signed into. It provides the reference needed to connect the sign in log to the corresponding provider object.

            * **Enables:** Connect each sign in log in Sign In Logs to the referenced app through `sign_in_logs.appId`; flag app ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports app ID as an identifier in its app namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-clientappused-d1dc4ffcc366" title="Client App Used" icon="phone" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.clientAppUsed`

            **Client App Used.** Client app used for sign-in (e.g., Browser, Mobile Apps). It distinguishes the provider-defined client app used state or classification for the sign in log.

            * **Enables:** Filter Sign In Logs by the exact Microsoft 365-defined client app used in `sign_in_logs.clientAppUsed` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies client app used from its own taxonomy on each sign in log; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-conditionalaccessstatus-d893fb1aab04" title="Conditional Access Status" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.conditionalAccessStatus`

            **Conditional Access Status.** Status of conditional access policies applied. It distinguishes the provider-defined conditional access status state or classification for the sign in log.

            * **Enables:** Segment sign in log entries in Sign In Logs by conditional access status in `sign_in_logs.conditionalAccessStatus`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports conditional access status as a label from its own taxonomy on each sign in log; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-correlationid-7b9070f023d6" title="Correlation ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.correlationId`

            **Correlation ID.** Identifier that correlates all sign-in activity for a single sign-in flow. It provides the reference needed to connect the sign in log to the corresponding provider object.

            * **Enables:** Connect each sign in log in Sign In Logs to the referenced correlation through `sign_in_logs.correlationId`; flag correlation ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports correlation ID as an identifier in its correlation namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-createddatetime-94598bed48eb" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.createdDateTime`

            **Created Date Time.** When the sign-in occurred. It anchors the sign in log on the provider's reported timeline.

            * **Enables:** Order Sign In Logs by created date time in `sign_in_logs.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each sign in log; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-624942e83ab2" title="Device Detail" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail`

            **Device Detail.** Device information including device ID, OS, browser, and management state. It preserves the nested context needed to interpret the parent sign in log.

            * **Enables:** Attribute device detail in `sign_in_logs.deviceDetail` to the parent sign in log; identify parent records where that nested device detail object is absent.
            * **Interpretation:** Microsoft 365 reports device detail as a nested object on each sign in log; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-browser-688168103929" title="Browser" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail.browser`

            **Browser.** Browser used for the sign-in. It distinguishes the provider-defined browser state or classification for the device detail.

            * **Enables:** Filter Sign In Logs by the exact Microsoft 365-defined browser in `sign_in_logs.DeviceDetail.browser` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies browser from its own taxonomy on each device detail; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-deviceid-eaac48697a1b" title="Device ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail.deviceId`

            **Device ID.** Identifier of the device used for the sign-in. It provides the reference needed to connect the sign in log to the corresponding provider object.

            * **Enables:** Connect each device detail in Sign In Logs to the referenced device through `sign_in_logs.DeviceDetail.deviceId`; flag device ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports device ID as an identifier in its device namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-displayname-c4f7ee4694f2" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail.displayName`

            **Display Name.** Display name of the device. It distinguishes the provider-defined display name state or classification for the device detail.

            * **Enables:** Label each device detail with display name from `sign_in_logs.DeviceDetail.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each device detail; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-iscompliant-de74e3003f9e" title="Is Compliant" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail.isCompliant`

            **Is Compliant.** Whether the device is compliant with organization policy. It distinguishes the provider-defined is compliant state or classification for the device detail.

            * **Enables:** Filter Sign In Logs by whether the device is compliant with organization policy in `sign_in_logs.DeviceDetail.isCompliant`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the device is compliant with organization policy as a boolean on each device detail; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-ismanaged-4d1430becc71" title="Is Managed" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail.isManaged`

            **Is Managed.** Whether the device is managed by the organization. It distinguishes the provider-defined is managed state or classification for the device detail.

            * **Enables:** Filter Sign In Logs by whether the device is managed by the organization in `sign_in_logs.DeviceDetail.isManaged`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the device is managed by the organization as a boolean on each device detail; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-operatingsys-316f2751f50e" title="Operating System" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail.operatingSystem`

            **Operating System.** Operating system name and version of the device. It distinguishes the provider-defined operating system state or classification for the device detail.

            * **Enables:** Filter Sign In Logs by the exact Microsoft 365-defined operating system in `sign_in_logs.DeviceDetail.operatingSystem` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies operating system from its own taxonomy on each device detail; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-devicedetail-trusttype-accdaa94c7c5" title="Trust Type" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.deviceDetail.trustType`

            **Trust Type.** Trust type of the device (e.g. AzureAd, ServerAd, Workplace). It distinguishes the provider-defined trust type state or classification for the device detail.

            * **Enables:** Segment device detail entries in Sign In Logs by trust type in `sign_in_logs.DeviceDetail.trustType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports trust type as a label from its own taxonomy on each device detail; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-id-d8e164c75642" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.id`

            **ID.** Unique identifier for the sign-in event. It provides the reference needed to connect the sign in log to the corresponding provider object.

            * **Enables:** Match repeated sign in log entries on ID in `sign_in_logs.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its sign in log namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-ipaddress-4023b6eee147" title="IP Address" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.ipAddress`

            **IP Address.** IP address of the client used for sign-in. It supplies the provider-reported address or location facet for the sign in log, not a residency determination.

            * **Enables:** Correlate sign in log records that report the same network address in `sign_in_logs.ipAddress` during an authorized investigation; account for shared, proxied, or translated addresses.
            * **Interpretation:** Microsoft 365 reports this as an IP network address on each sign in log. It is not verified geolocation, does not identify a person by itself, and does not establish data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-isinteractive-4f18e6f24fc3" title="Is Interactive" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.isInteractive`

            **Is Interactive.** Whether the sign-in was interactive or non-interactive. It distinguishes the provider-defined is interactive state or classification for the sign in log.

            * **Enables:** Filter Sign In Logs by whether the sign-in was interactive or non-interactive in `sign_in_logs.isInteractive`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the sign-in was interactive or non-interactive as a boolean on each sign in log; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-e745108e53b7" title="Location" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location`

            **Location.** City, state, country, and geo-coordinates from which the sign-in occurred. It preserves the nested context needed to interpret the parent sign in log.

            * **Enables:** Attribute location in `sign_in_logs.location` to the parent sign in log; identify parent records where that nested location object is absent.
            * **Interpretation:** Microsoft 365 reports location as a nested object on each sign in log; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-city-dc67958a53a3" title="City" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location.city`

            **City.** City the sign-in originated from. It supplies the provider-reported address or location facet for the sign in location, not a residency determination.

            * **Enables:** Group Sign In Logs by city in `sign_in_logs.SignInLocation.city` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports city as a user, device, request, or resource location attribute on each sign in location; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-countryorregion-1616366e222b" title="Country Or Region" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location.countryOrRegion`

            **Country Or Region.** Country or region code the sign-in originated from. It supplies the provider-reported address or location facet for the sign in location, not a residency determination.

            * **Enables:** Group Sign In Logs by country or region in `sign_in_logs.SignInLocation.countryOrRegion` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports country or region as a user, device, request, or resource location attribute on each sign in location; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-geocoordinates-4a0e3c6e6f1e" title="Geo Coordinates" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location.geoCoordinates`

            **Geo Coordinates.** Latitude, longitude, and altitude of the sign-in location. It preserves the nested context needed to interpret the parent sign in log.

            * **Enables:** Attribute geo coordinates in `sign_in_logs.SignInLocation.geoCoordinates` to the parent sign in log; identify parent records where that nested geo coordinates object is absent.
            * **Interpretation:** Microsoft 365 reports geo coordinates as a nested object on each sign in location; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-geocoordinates-a-9f61093c3e9d" title="Altitude" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location.geoCoordinates.altitude`

            **Altitude.** Altitude of the location, in meters. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Sign In Logs by the exact altitude in `sign_in_logs.GeoCoordinates.altitude` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports altitude as an address or location facet on each geo coordinate; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-geocoordinates-l-6fa4007b126e" title="Latitude" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location.geoCoordinates.latitude`

            **Latitude.** Latitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Sign In Logs by latitude in `sign_in_logs.GeoCoordinates.latitude` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports latitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-geocoordinates-l-4ade68ea23d4" title="Longitude" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location.geoCoordinates.longitude`

            **Longitude.** Longitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Sign In Logs by longitude in `sign_in_logs.GeoCoordinates.longitude` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports longitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-location-state-f1d332bbaa01" title="State" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.location.state`

            **State.** State or province the sign-in originated from. It distinguishes the provider-defined state state or classification for the sign in location.

            * **Enables:** Group Sign In Logs by state in `sign_in_logs.SignInLocation.state` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports state as a user, device, request, or resource location attribute on each sign in location; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-resourcedisplayname-351add7daacf" title="Resource Display Name" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.resourceDisplayName`

            **Resource Display Name.** Display name of the resource the user signed into. It distinguishes the provider-defined resource display name state or classification for the sign in log.

            * **Enables:** Label each sign in log with resource display name from `sign_in_logs.resourceDisplayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports resource display name as display text for each sign in log; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-resourceid-5cfa89685b98" title="Resource ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.resourceId`

            **Resource ID.** Identifier of the resource the user signed into. It provides the reference needed to connect the sign in log to the corresponding provider object.

            * **Enables:** Connect each sign in log in Sign In Logs to the referenced resource through `sign_in_logs.resourceId`; flag resource ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports resource ID as an identifier in its resource namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-riskdetail-127d124546a3" title="Risk Detail" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.riskDetail`

            **Risk Detail.** Reason behind the sign-in risk state (evolvable enum, e.g. none, hidden, adminConfirmedSigninSafe). Stored as string because Microsoft may add values. It supplies the returned risk detail text needed to understand the sign in log in context.

            * **Enables:** Search the returned risk detail text in `sign_in_logs.riskDetail` and attribute each match to its parent sign in log and reported author when available.
            * **Interpretation:** Microsoft 365 supplies risk detail as returned text on each sign in log; truncation, formatting, and access boundaries can limit completeness.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-riskeventtypes-v2-ac5620fbb966" title="Risk Event Types V2" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.riskEventTypes_v2`

            **Risk Event Types V2.** Risk event types associated with the sign-in. It preserves the nested context needed to interpret the parent sign in log.

            * **Enables:** Compare the exact Microsoft 365-configured risk event types v2 set in `sign_in_logs.riskEventTypes_v2` for each sign in log; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns risk event types v2 as an array of risk event types v2 value entries on each sign in log; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-risklevelaggregated-6416b0276c6a" title="Risk Level Aggregated" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.riskLevelAggregated`

            **Risk Level Aggregated.** Aggregated risk level of the sign-in (evolvable enum: none, low, medium, high, hidden). Stored as string because Microsoft may add values. It distinguishes the provider-defined risk level aggregated state or classification for the sign in log.

            * **Enables:** Filter Sign In Logs by the exact Microsoft 365-defined risk level aggregated in `sign_in_logs.riskLevelAggregated` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies risk level aggregated from its own taxonomy on each sign in log; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-risklevelduringsignin-9e6759b25e85" title="Risk Level During Sign In" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.riskLevelDuringSignIn`

            **Risk Level During Sign In.** Risk level during the sign-in (evolvable enum: none, low, medium, high, hidden). Stored as string because Microsoft may add values. It distinguishes the provider-defined risk level during sign in state or classification for the sign in log.

            * **Enables:** Filter Sign In Logs by the exact Microsoft 365-defined risk level during sign in in `sign_in_logs.riskLevelDuringSignIn` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies risk level during sign in from its own taxonomy on each sign in log; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-riskstate-604d2052da51" title="Risk State" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.riskState`

            **Risk State.** Risk state of the sign-in (evolvable enum: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised). Stored as string because Microsoft may add values. It distinguishes the provider-defined risk state state or classification for the sign in log.

            * **Enables:** Segment sign in log entries in Sign In Logs by risk state in `sign_in_logs.riskState`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports risk state as a label from its own taxonomy on each sign in log; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-status-39605203af5c" title="Status" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.status`

            **Status.** Sign-in status including error code, failure reason, and additional details. It preserves the nested context needed to interpret the parent sign in log.

            * **Enables:** Attribute status in `sign_in_logs.status` to the parent sign in log; identify parent records where that nested status object is absent.
            * **Interpretation:** Microsoft 365 reports status as a nested object on each sign in log; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-status-additionaldetails-29f4728c1e17" title="Additional Details" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.status.additionalDetails`

            **Additional Details.** Additional details about the sign-in status. It supplies the returned additional details text needed to understand the sign in status in context.

            * **Enables:** Search the returned additional details text in `sign_in_logs.SignInStatus.additionalDetails` and attribute each match to its parent sign in log and reported author when available.
            * **Interpretation:** Microsoft 365 supplies additional details as returned text on each sign in status; truncation, formatting, and access boundaries can limit completeness.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-status-errorcode-b5c7757b64f6" title="Error Code" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.status.errorCode`

            **Error Code.** Sign-in error code. 0 indicates success. It distinguishes the provider-defined error code state or classification for the sign in status.

            * **Enables:** Filter Sign In Logs by the exact Microsoft 365-defined error code in `sign_in_logs.SignInStatus.errorCode` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies error code from its own taxonomy on each sign in status; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-status-failurereason-ddb981f7032f" title="Failure Reason" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.status.failureReason`

            **Failure Reason.** Human-readable failure reason when the sign-in did not succeed. It supplies the returned failure reason text needed to understand the sign in status in context.

            * **Enables:** Search the returned failure reason text in `sign_in_logs.SignInStatus.failureReason` and attribute each match to its parent sign in log and reported author when available.
            * **Interpretation:** Microsoft 365 supplies failure reason as returned text on each sign in status; truncation, formatting, and access boundaries can limit completeness.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-userdisplayname-edd03699613e" title="User Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.userDisplayName`

            **User Display Name.** Display name of the user who signed in. It distinguishes the provider-defined user display name state or classification for the sign in log.

            * **Enables:** Label each sign in log with user display name from `sign_in_logs.userDisplayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports user display name as display text for each sign in log; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-userid-53d077b59c4f" title="User ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.userId`

            **User ID.** Entra ID object ID of the user. It provides the reference needed to connect the sign in log to the corresponding provider object.

            * **Enables:** Connect each sign in log in Sign In Logs to the referenced user through `sign_in_logs.userId`; flag user ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports user ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-sign-in-logs-userprincipalname-26b099ac179c" title="User Principal Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `sign_in_logs.userPrincipalName`

            **User Principal Name.** UPN of the user who signed in. It gives the sign in log a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each sign in log with user principal name from `sign_in_logs.userPrincipalName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports user principal name as display text for each sign in log; names are mutable and are not stable identities.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-team-calendar-events-e54139093396" title="Team Calendar Events" icon="calendar-check" iconType="sharp-duotone-solid">
        Developer identifier: `team_calendar_events`

        **Team Calendar Events.** Team calendar events by group.

        * **Enables:** Attribute group calendar events to the parent Team, organizer, attendees, recurrence, and time interval.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/groups/{id}/calendar/calendarView` operation as an event stream using incremental synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The selected fields are event, organizer, attendee, and time metadata; full body and attachment bytes are not fetched. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-402ef981857d" title="Attendees" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees`

            **Attendees.** List of attendees with email, name, and response status. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute each returned attendee in `team_calendar_events.attendees` to the parent team calendar event; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
            * **Interpretation:** Microsoft 365 returns attendees as an array of attendee entries on each team calendar event; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-emailad-b725b01bb2fe" title="Email Address" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.emailAddress`

            **Email Address.** Email address and display name of the attendee. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Match repeated attendee entries on email address in `team_calendar_events.Attendee.emailAddress`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports email address as a nested object on each attendee; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-emailad-825bc9de214e" title="Address" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.emailAddress.address`

            **Address.** Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

            * **Enables:** Attribute each email address to a person or account by the exact address in `team_calendar_events.EmailAddress.address`; identify addresses that do not match the Microsoft 365 directory.
            * **Interpretation:** Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-emailad-e25d4703e41b" title="Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.emailAddress.name`

            **Name.** Display name of the person or entity. It gives the email address a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each email address with name from `team_calendar_events.EmailAddress.name`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-propose-1e3a3acdd611" title="Proposed New Time" icon="calendar-days" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.proposedNewTime`

            **Proposed New Time.** An alternate date/time proposed by the attendee. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute proposed new time in `team_calendar_events.Attendee.proposedNewTime` to the parent team calendar event; identify parent records where that nested proposed new time object is absent.
            * **Interpretation:** Microsoft 365 reports proposed new time as a nested object on each attendee; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-propose-1911148c43b8" title="End" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.proposedNewTime.end`

            **End.** End of the time slot. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute end in `team_calendar_events.TimeSlot.end` to the parent team calendar event; identify parent records where that nested end object is absent.
            * **Interpretation:** Microsoft 365 reports end as a nested object on each time slot; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-propose-cb31dcf4139b" title="Date Time" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.proposedNewTime.end.dateTime`

            **Date Time.** Date and time in ISO 8601 format without timezone offset (e.g. 2024-01-15T09:00:00.0000000). It anchors the team calendar event on the provider's reported timeline.

            * **Enables:** Order Team Calendar Events by date time in `team_calendar_events.DateTimeTimeZone.dateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports date time as a timestamp on each date time time zone; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-propose-92212b68f652" title="Time Zone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.proposedNewTime.end.timeZone`

            **Time Zone.** IANA or Windows time zone identifier (e.g. Pacific Standard Time, America/New\_York). It is needed to interpret companion dates and times for the date time time zone in the provider's intended zone.

            * **Enables:** Apply the zone in `team_calendar_events.DateTimeTimeZone.timeZone` when converting the team calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports time zone as a timezone identifier for each date time time zone; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-propose-6787540c246c" title="Start" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.proposedNewTime.start`

            **Start.** Start of the time slot. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute start in `team_calendar_events.TimeSlot.start` to the parent team calendar event; identify parent records where that nested start object is absent.
            * **Interpretation:** Microsoft 365 reports start as a nested object on each time slot; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-status-3ce2edded467" title="Status" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.status`

            **Status.** The attendee's response status for the event. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute status in `team_calendar_events.Attendee.status` to the parent team calendar event; identify parent records where that nested status object is absent.
            * **Interpretation:** Microsoft 365 reports status as a nested object on each attendee; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-status--9843cd991e5a" title="Response" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.status.response`

            **Response.** The response type. It distinguishes the provider-defined response state or classification for the response status.

            * **Enables:** Segment response status entries in Team Calendar Events by response in `team_calendar_events.ResponseStatus.response`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports response as a label from its own taxonomy on each response status; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-status--a62927f81e1b" title="Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.status.time`

            **Time.** Date and time the response was submitted. It anchors the team calendar event on the provider's reported timeline.

            * **Enables:** Order Team Calendar Events by time in `team_calendar_events.ResponseStatus.time` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports time as a timestamp on each response status; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-attendees-type-2dc089595ab8" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.attendees.type`

            **Type.** Attendee type: required, optional, or resource. It distinguishes the provider-defined type state or classification for the attendee.

            * **Enables:** Segment attendee entries in Team Calendar Events by type in `team_calendar_events.Attendee.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each attendee; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-bodypreview-34960bc5767e" title="Body Preview" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.bodyPreview`

            **Body Preview.** Short text preview of the event body content. It defines the content surface available for this team calendar event.

            * **Enables:** Locate team calendar event records whose body preview in `team_calendar_events.bodyPreview` contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
            * **Interpretation:** This is an excerpt supplied by the provider, not the complete body or an attachment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-calendar-57b54efa9573" title="Calendar" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.calendar`

            **Calendar.** The calendar navigation property or calendar ID associated with the event. It identifies the related provider object that gives the team calendar event its parent, owner, or container context.

            * **Enables:** Connect each team calendar event to the related calendar in `team_calendar_events.calendar` and verify that the referenced provider object resolves in the expected parent or container.
            * **Interpretation:** Microsoft 365 reports calendar as relationship context on each team calendar event; resolve it in the named provider namespace rather than by display text alone.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-categories-60401cc7933c" title="Categories" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.categories`

            **Categories.** User-assigned categories/labels on the event. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Compare the exact Microsoft 365-configured categories set in `team_calendar_events.categories` for each team calendar event; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns categories as an array of category value entries on each team calendar event; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-changekey-5957fbbcb2b4" title="Change Key" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.changeKey`

            **Change Key.** Version identifier of the event; changes each time the event is modified. It provides the reference needed to connect the team calendar event to the corresponding provider object.

            * **Enables:** Connect each team calendar event in Team Calendar Events to the referenced change through `team_calendar_events.changeKey`; flag change key values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports change key as an identifier in its change namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-createddatetime-9e501626059b" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.createdDateTime`

            **Created Date Time.** Date and time the event was created in ISO 8601 format. It anchors the team calendar event on the provider's reported timeline.

            * **Enables:** Order Team Calendar Events by created date time in `team_calendar_events.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each team calendar event; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-end-36fb4311a4d1" title="End" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.end`

            **End.** End date/time and timezone of the event. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute end in `team_calendar_events.end` to the parent team calendar event; identify parent records where that nested end object is absent.
            * **Interpretation:** Microsoft 365 reports end as a nested object on each team calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-icaluid-f48c3740c08e" title="I Cal U ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.iCalUId`

            **I Cal U ID.** Unique identifier for the event across calendars. Stable when the event moves between calendars, unlike ID. It provides the reference needed to connect the team calendar event to the corresponding provider object.

            * **Enables:** Connect each team calendar event in Team Calendar Events to the referenced i cal u through `team_calendar_events.iCalUId`; flag i cal u ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports i cal u ID as an identifier in its i cal u namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-id-12baf637b9d7" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.id`

            **ID.** Unique identifier for the event. It provides the reference needed to connect the team calendar event to the corresponding provider object.

            * **Enables:** Match repeated team calendar event entries on ID in `team_calendar_events.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its team calendar event namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-importance-4c24dcdd4c5b" title="Importance" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.importance`

            **Importance.** Importance level of the event. It distinguishes the provider-defined importance state or classification for the team calendar event.

            * **Enables:** Segment team calendar event entries in Team Calendar Events by importance in `team_calendar_events.importance`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports importance as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-isallday-db69ad9ee6ba" title="Is All Day" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.isAllDay`

            **Is All Day.** Whether the event lasts all day. It distinguishes the provider-defined is all day state or classification for the team calendar event.

            * **Enables:** Filter Team Calendar Events by whether the event lasts all day in `team_calendar_events.isAllDay`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the event lasts all day as a boolean on each team calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-iscancelled-2a89c8d2827a" title="Is Cancelled" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.isCancelled`

            **Is Cancelled.** Whether the event has been cancelled. It distinguishes the provider-defined is cancelled state or classification for the team calendar event.

            * **Enables:** Filter Team Calendar Events by whether the event has been cancelled in `team_calendar_events.isCancelled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the event has been cancelled as a boolean on each team calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-isonlinemeeting-5cd4bbd5c1a8" title="Is Online Meeting" icon="headset" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.isOnlineMeeting`

            **Is Online Meeting.** Whether the event is an online meeting. It distinguishes the provider-defined is online meeting state or classification for the team calendar event.

            * **Enables:** Filter Team Calendar Events by whether the event is an online meeting in `team_calendar_events.isOnlineMeeting`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the event is an online meeting as a boolean on each team calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-lastmodifieddatet-a2f9111ccc33" title="Last Modified Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.lastModifiedDateTime`

            **Last Modified Date Time.** Date and time the event was last modified in ISO 8601 format. Used as incremental sync cursor. It anchors the team calendar event on the provider's reported timeline.

            * **Enables:** Order Team Calendar Events by last modified date time in `team_calendar_events.lastModifiedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports last modified date time as a timestamp on each team calendar event; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-48c2dbd6bf06" title="Location" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location`

            **Location.** Location of the event. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute location in `team_calendar_events.location` to the parent team calendar event; identify parent records where that nested location object is absent.
            * **Interpretation:** Microsoft 365 reports location as a nested object on each team calendar event; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-address-4b6f0cf4e12c" title="Address" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.address`

            **Address.** Physical street address of the location. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute address in `team_calendar_events.Location.address` to the parent team calendar event; identify parent records where that nested address object is absent.
            * **Interpretation:** Microsoft 365 reports address as a nested object on each location; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-address--66522a9efdc1" title="City" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.address.city`

            **City.** City. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Team Calendar Events by city in `team_calendar_events.PhysicalAddress.city` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports city as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-address--26a19f3ba044" title="Country Or Region" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.address.countryOrRegion`

            **Country Or Region.** Country or region. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Team Calendar Events by country or region in `team_calendar_events.PhysicalAddress.countryOrRegion` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports country or region as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-address--266c2b21f2be" title="Postal Code" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.address.postalCode`

            **Postal Code.** Postal/ZIP code. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Team Calendar Events by the exact postal code in `team_calendar_events.PhysicalAddress.postalCode` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports postal code as an address or location facet on each physical address; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-address--9ed489d52a76" title="State" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.address.state`

            **State.** State or province. It distinguishes the provider-defined state state or classification for the physical address.

            * **Enables:** Group Team Calendar Events by state in `team_calendar_events.PhysicalAddress.state` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports state as a user, device, request, or resource location attribute on each physical address; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-address--1f9d0dd6c2a6" title="Street" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.address.street`

            **Street.** Street address. It supplies the provider-reported address or location facet for the physical address, not a residency determination.

            * **Enables:** Group Team Calendar Events by the exact street in `team_calendar_events.PhysicalAddress.street` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports street as an address or location facet on each physical address; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-coordina-9174d5245a6c" title="Coordinates" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.coordinates`

            **Coordinates.** Geographic coordinates and elevation of the location. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute coordinates in `team_calendar_events.Location.coordinates` to the parent team calendar event; identify parent records where that nested coordinates object is absent.
            * **Interpretation:** Microsoft 365 reports coordinates as a nested object on each location; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-coordina-f6fe65cad5f9" title="Accuracy" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.coordinates.accuracy`

            **Accuracy.** Accuracy of the coordinates in meters. It supplies the accuracy measure for the geo coordinate at the provider's declared unit and grain.

            * **Enables:** Measure accuracy through `team_calendar_events.GeoCoordinates.accuracy` for each geo coordinate and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-coordina-3953cd056b2b" title="Altitude" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.coordinates.altitude`

            **Altitude.** Altitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Team Calendar Events by the exact altitude in `team_calendar_events.GeoCoordinates.altitude` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports altitude as an address or location facet on each geo coordinate; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-coordina-269965bec9b0" title="Altitude Accuracy" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.coordinates.altitudeAccuracy`

            **Altitude Accuracy.** Accuracy of the altitude in meters. It supplies the altitude accuracy measure for the geo coordinate at the provider's declared unit and grain.

            * **Enables:** Measure altitude accuracy through `team_calendar_events.GeoCoordinates.altitudeAccuracy` for each geo coordinate and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports altitude accuracy as a measure on each geo coordinate; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-coordina-86ae4e76786a" title="Latitude" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.coordinates.latitude`

            **Latitude.** Latitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Team Calendar Events by latitude in `team_calendar_events.GeoCoordinates.latitude` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports latitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-coordina-2ab376144998" title="Longitude" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.coordinates.longitude`

            **Longitude.** Longitude of the location. It supplies the provider-reported address or location facet for the geo coordinate, not a residency determination.

            * **Enables:** Group Team Calendar Events by longitude in `team_calendar_events.GeoCoordinates.longitude` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports longitude as a user, device, request, or resource location attribute on each geo coordinate; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-displayn-1a90c2cb8f63" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.displayName`

            **Display Name.** Display name of the location. It distinguishes the provider-defined display name state or classification for the location.

            * **Enables:** Label each location with display name from `team_calendar_events.Location.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each location; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-location-b182c6e7aca1" title="Location Email Address" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.locationEmailAddress`

            **Location Email Address.** Email address associated with the location (e.g. a conference room). It supplies the provider-reported address or location facet for the location, not a residency determination.

            * **Enables:** Attribute each location to a person or account by the exact location email address in `team_calendar_events.Location.locationEmailAddress`; identify addresses that do not match the Microsoft 365 directory.
            * **Interpretation:** Microsoft 365 reports location email address as an address on each location; aliases, casing, and unverified addresses can prevent a one-to-one person match.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-location-23ab8ff02021" title="Location Type" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.locationType`

            **Location Type.** Type of location. It distinguishes the provider-defined location type state or classification for the location.

            * **Enables:** Segment location entries in Team Calendar Events by location type in `team_calendar_events.Location.locationType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports location type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-location-d96d83523503" title="Location URI" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.locationUri`

            **Location URI.** URI representing the location. It supplies the provider-reported address or location facet for the location, not a residency determination.

            * **Enables:** Associate each location with the resource identified by location URI in `team_calendar_events.Location.locationUri`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports location URI as a resource locator for each location; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-uniqueid-8cbf6f2d4871" title="Unique ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.uniqueId`

            **Unique ID.** Unique identifier of the location, if available. It provides the reference needed to connect the team calendar event to the corresponding provider object.

            * **Enables:** Connect each location in Team Calendar Events to the referenced unique through `team_calendar_events.Location.uniqueId`; flag unique ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports unique ID as an identifier in its unique namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-location-uniqueid-55cbdc134d05" title="Unique ID Type" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.location.uniqueIdType`

            **Unique ID Type.** Type of the unique ID for the location. It distinguishes the provider-defined unique ID type state or classification for the location.

            * **Enables:** Segment location entries in Team Calendar Events by unique ID type in `team_calendar_events.Location.uniqueIdType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports unique ID type as a label from its own taxonomy on each location; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-869151a3c0df" title="Online Meeting" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting`

            **Online Meeting.** Details for joining an online meeting, including join URL and conference ID. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute online meeting in `team_calendar_events.onlineMeeting` to the parent team calendar event; identify parent records where that nested online meeting object is absent.
            * **Interpretation:** Microsoft 365 reports online meeting as a nested object on each team calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-con-81ea6d569d60" title="Conference ID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.conferenceId`

            **Conference ID.** Conference ID for dial-in access. It provides the reference needed to connect the team calendar event to the corresponding provider object.

            * **Enables:** Connect each online meeting info in Team Calendar Events to the referenced conference through `team_calendar_events.OnlineMeetingInfo.conferenceId`; flag conference ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports conference ID as an identifier in its conference namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-dia-f992c40f2f89" title="Dialin URL" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.dialinUrl`

            **Dialin URL.** URL with dial-in information. It locates the provider resource or path associated with the online meeting info.

            * **Enables:** Associate each online meeting info with the resource identified by dialin URL in `team_calendar_events.OnlineMeetingInfo.dialinUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports dialin URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-joi-bdc0eb5893a3" title="Join URL" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.joinUrl`

            **Join URL.** URL to join the online meeting. It locates the provider resource or path associated with the online meeting info.

            * **Enables:** Associate each online meeting info with the resource identified by join URL in `team_calendar_events.OnlineMeetingInfo.joinUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports join URL as a resource locator for each online meeting info; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-pho-af3b68ac230e" title="Phones" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.phones`

            **Phones.** Phone numbers associated with the online meeting. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Reconcile each returned online meeting phone in `team_calendar_events.OnlineMeetingInfo.phones` with the parent team calendar event's provider profile; preserve distinct aliases, contact points, and organization attributes.
            * **Interpretation:** Microsoft 365 returns phones as an array of online meeting phone entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-pho-b230040c878f" title="Number" icon="headset" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.phones.number`

            **Number.** The phone number. It supplies the number measure for the online meeting phone at the provider's declared unit and grain.

            * **Enables:** Measure number through `team_calendar_events.OnlineMeetingPhone.number` for each online meeting phone and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports number as a measure on each online meeting phone; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-pho-34327e265b0f" title="Type" icon="headset" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.phones.type`

            **Type.** Type of phone number (e.g. toll, tollFree). It distinguishes the provider-defined type state or classification for the online meeting phone.

            * **Enables:** Segment online meeting phone entries in Team Calendar Events by type in `team_calendar_events.OnlineMeetingPhone.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each online meeting phone; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-qui-4d67696fb9e5" title="Quick Dial" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.quickDial`

            **Quick Dial.** Quick dial code for the meeting. It supplies the sensitive provider access code needed to join the online meeting info, not a stable record identifier.

            * **Enables:** Reconcile `team_calendar_events.OnlineMeetingInfo.quickDial` with the same conference entry point or meeting instructions when validating join access; handle it as sensitive access metadata.
            * **Interpretation:** Microsoft 365 returns quick dial as meeting or conference access metadata on each online meeting info; it can rotate and does not identify the meeting by itself.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-tol-c40a298abb77" title="Toll Free Numbers" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.tollFreeNumbers`

            **Toll Free Numbers.** List of toll-free phone numbers for dial-in. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Reconcile each returned toll free number value in `team_calendar_events.OnlineMeetingInfo.tollFreeNumbers` with the parent team calendar event's provider profile; preserve distinct aliases, contact points, and organization attributes.
            * **Interpretation:** Microsoft 365 returns toll free numbers as an array of toll free number value entries on each online meeting info; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeeting-tol-98ccc98b2237" title="Toll Number" icon="phone" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeeting.tollNumber`

            **Toll Number.** Toll phone number for dial-in. It supplies the toll number measure for the online meeting info at the provider's declared unit and grain.

            * **Enables:** Measure toll number through `team_calendar_events.OnlineMeetingInfo.tollNumber` for each online meeting info and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports toll number as a measure on each online meeting info; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-onlinemeetingurl-d892344dff2f" title="Online Meeting URL" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.onlineMeetingUrl`

            **Online Meeting URL.** URL for joining the online meeting (legacy property). It locates the provider resource or path associated with the team calendar event.

            * **Enables:** Associate each team calendar event with the resource identified by online meeting URL in `team_calendar_events.onlineMeetingUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports online meeting URL as a resource locator for each team calendar event; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-organizer-49c652f234fe" title="Organizer" icon="envelope" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.organizer`

            **Organizer.** Organizer of the event with email and name. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute organizer in `team_calendar_events.organizer` to the parent team calendar event; identify parent records where that nested organizer object is absent.
            * **Interpretation:** Microsoft 365 reports organizer as a nested object on each team calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-organizer-emailad-b3d62a9fd229" title="Email Address" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.organizer.emailAddress`

            **Email Address.** Email address and display name of the recipient. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute email address in `team_calendar_events.Recipient.emailAddress` to the parent team calendar event; identify parent records where that nested email address object is absent.
            * **Interpretation:** Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-originalendtimezo-c28fbb00bdf8" title="Original End Time Zone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.originalEndTimeZone`

            **Original End Time Zone.** End time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the team calendar event in the provider's intended zone.

            * **Enables:** Apply the zone in `team_calendar_events.originalEndTimeZone` when converting the team calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports original end time zone as a timezone identifier for each team calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-originalstarttime-5abceafbfc5e" title="Original Start Time Zone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.originalStartTimeZone`

            **Original Start Time Zone.** Start time zone the event was created in (IANA or Windows identifier). It is needed to interpret companion dates and times for the team calendar event in the provider's intended zone.

            * **Enables:** Apply the zone in `team_calendar_events.originalStartTimeZone` when converting the team calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports original start time zone as a timezone identifier for each team calendar event; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-4074015c3e22" title="Recurrence" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence`

            **Recurrence.** Recurrence pattern and range for recurring events. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute recurrence in `team_calendar_events.recurrence` to the parent team calendar event; identify parent records where that nested recurrence object is absent.
            * **Interpretation:** Microsoft 365 reports recurrence as a nested object on each team calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-5e3c294bd315" title="Pattern" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern`

            **Pattern.** The frequency and rules of the recurrence. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute pattern in `team_calendar_events.PatternedRecurrence.pattern` to the parent team calendar event; identify parent records where that nested pattern object is absent.
            * **Interpretation:** Microsoft 365 reports pattern as a nested object on each patterned recurrence; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-2fc151f904b4" title="Day Of Month" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern.dayOfMonth`

            **Day Of Month.** Day of the month for absoluteMonthly/absoluteYearly patterns. It supplies the day of month measure for the recurrence pattern at the provider's declared unit and grain.

            * **Enables:** Measure day of month through `team_calendar_events.RecurrencePattern.dayOfMonth` for each recurrence pattern and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports day of month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-a91f1408f871" title="Days Of Week" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern.daysOfWeek`

            **Days Of Week.** Days of the week the event occurs on. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Compare the exact Microsoft 365-configured days of week set in `team_calendar_events.RecurrencePattern.daysOfWeek` for each recurrence pattern; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns days of week as an array of recurrence pattern day of week enum entries on each recurrence pattern; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-560234b3d3a6" title="First Day Of Week" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern.firstDayOfWeek`

            **First Day Of Week.** First day of the week for weekly patterns. It distinguishes the provider-defined first day of week state or classification for the recurrence pattern.

            * **Enables:** Segment recurrence pattern entries in Team Calendar Events by first day of week in `team_calendar_events.RecurrencePattern.firstDayOfWeek`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports first day of week as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-c7ab7b25e071" title="Index" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern.index`

            **Index.** Week index for relativeMonthly/relativeYearly patterns. It distinguishes the provider-defined index state or classification for the recurrence pattern.

            * **Enables:** Segment recurrence pattern entries in Team Calendar Events by index in `team_calendar_events.RecurrencePattern.index`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports index as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-5818a9630b98" title="Interval" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern.interval`

            **Interval.** Number of units between occurrences (e.g. every 2 weeks). It supplies the interval boundary, band, or unit needed to interpret the companion measure.

            * **Enables:** Interpret `team_calendar_events.RecurrencePattern.interval` with its companion minimum, maximum, interval, or unit before comparing the interval across like-for-like records.
            * **Interpretation:** Microsoft 365 reports interval as a boundary, band, interval, or unit on each recurrence pattern; it is meaningful only with its companion measure and provider scale.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-168fa8f48cac" title="Month" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern.month`

            **Month.** Month in which the event occurs (1-12), for yearly patterns. It supplies the month measure for the recurrence pattern at the provider's declared unit and grain.

            * **Enables:** Measure month through `team_calendar_events.RecurrencePattern.month` for each recurrence pattern and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports month as a measure on each recurrence pattern; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-patter-f59852829eb1" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.pattern.type`

            **Type.** The recurrence pattern type. It distinguishes the provider-defined type state or classification for the recurrence pattern.

            * **Enables:** Segment recurrence pattern entries in Team Calendar Events by type in `team_calendar_events.RecurrencePattern.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each recurrence pattern; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-range-426c93f16979" title="Range" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.range`

            **Range.** The duration/bounds of the recurrence. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute range in `team_calendar_events.PatternedRecurrence.range` to the parent team calendar event; identify parent records where that nested range object is absent.
            * **Interpretation:** Microsoft 365 reports range as a nested object on each patterned recurrence; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-range--2990ff728da8" title="End Date" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.range.endDate`

            **End Date.** End date of the recurrence range (YYYY-MM-DD). Used when type is endDate. It anchors the team calendar event on the provider's reported timeline.

            * **Enables:** Filter Team Calendar Events by end date in `team_calendar_events.RecurrenceRange.endDate`; pair that boundary with the corresponding start before measuring elapsed time.
            * **Interpretation:** Microsoft 365 reports end date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-range--d4191fbe563a" title="Number Of Occurrences" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.range.numberOfOccurrences`

            **Number Of Occurrences.** Number of occurrences. Used when type is numbered. It supplies the number of occurrences measure for the recurrence range at the provider's declared unit and grain.

            * **Enables:** Measure number of occurrences through `team_calendar_events.RecurrenceRange.numberOfOccurrences` for each recurrence range and compare only values with the same unit and record grain.
            * **Interpretation:** Microsoft 365 reports number of occurrences as a measure on each recurrence range; compare only records with the same unit and aggregation grain.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-range--e6dbb6e39cb2" title="Recurrence Time Zone" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.range.recurrenceTimeZone`

            **Recurrence Time Zone.** Time zone for the start and end dates. It is needed to interpret companion dates and times for the recurrence range in the provider's intended zone.

            * **Enables:** Apply the zone in `team_calendar_events.RecurrenceRange.recurrenceTimeZone` when converting the team calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports recurrence time zone as a timezone identifier for each recurrence range; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-range--acf8e4310587" title="Start Date" icon="stopwatch" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.range.startDate`

            **Start Date.** Start date of the recurrence range (YYYY-MM-DD). It anchors the team calendar event on the provider's reported timeline.

            * **Enables:** Filter Team Calendar Events by start date in `team_calendar_events.RecurrenceRange.startDate`; pair that boundary with the corresponding end before measuring elapsed time.
            * **Interpretation:** Microsoft 365 reports start date as a calendar date on each recurrence range; its grain is one day and no time of day should be inferred.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-recurrence-range--6b3b9cdc55fb" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.recurrence.range.type`

            **Type.** The recurrence range type. It distinguishes the provider-defined type state or classification for the recurrence range.

            * **Enables:** Segment recurrence range entries in Team Calendar Events by type in `team_calendar_events.RecurrenceRange.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each recurrence range; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-responsestatus-4a2f935c333e" title="Response Status" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.responseStatus`

            **Response Status.** The response status and time of the current user for this event. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute response status in `team_calendar_events.responseStatus` to the parent team calendar event; identify parent records where that nested response status object is absent.
            * **Interpretation:** Microsoft 365 reports response status as a nested object on each team calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-sensitivity-6a33fa5579c1" title="Sensitivity" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.sensitivity`

            **Sensitivity.** Sensitivity level of the event. It distinguishes the provider-defined sensitivity state or classification for the team calendar event.

            * **Enables:** Segment team calendar event entries in Team Calendar Events by sensitivity in `team_calendar_events.sensitivity`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports sensitivity as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-seriesmasterid-e261dff64ee3" title="Series Master ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.seriesMasterId`

            **Series Master ID.** The ID of the recurring series master event, if this event is part of a recurring series. It provides the reference needed to connect the team calendar event to the corresponding provider object.

            * **Enables:** Connect each team calendar event in Team Calendar Events to the referenced series master through `team_calendar_events.seriesMasterId`; flag series master ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports series master ID as an identifier in its series master namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-showas-55d3737bae3e" title="Show As" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.showAs`

            **Show As.** Free/busy status shown during the event. It distinguishes the provider-defined show as state or classification for the team calendar event.

            * **Enables:** Segment team calendar event entries in Team Calendar Events by show as in `team_calendar_events.showAs`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports show as as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-start-bc4d72923194" title="Start" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.start`

            **Start.** Start date/time and timezone of the event. It preserves the nested context needed to interpret the parent team calendar event.

            * **Enables:** Attribute start in `team_calendar_events.start` to the parent team calendar event; identify parent records where that nested start object is absent.
            * **Interpretation:** Microsoft 365 reports start as a nested object on each team calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-subject-dea38bfa57ca" title="Subject" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.subject`

            **Subject.** Subject/title of the calendar event. It defines the content surface available for this team calendar event.

            * **Enables:** Locate team calendar event records by subject in `team_calendar_events.subject`; attribute each text match to its parent team calendar event and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies subject as text on each team calendar event; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-team-id-d84c3408c5eb" title="Team ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.team_id`

            **Team ID.** Parent team reference copied into each team calendar event because the child operation does not return that relationship. It provides the reference needed to connect the team calendar event to the corresponding provider object.

            * **Enables:** Connect each team calendar event in Team Calendar Events to the referenced team through `team_calendar_events.team_id`; flag team ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies team ID from the parent traversal record into each team calendar event; the child Microsoft 365 operation does not return it.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-type-f20ac2c9d137" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.type`

            **Type.** The event type: singleInstance, occurrence, exception, or seriesMaster. It distinguishes the provider-defined type state or classification for the team calendar event.

            * **Enables:** Segment team calendar event entries in Team Calendar Events by type in `team_calendar_events.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each team calendar event; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-calendar-events-weblink-09613fbda38e" title="Web Link" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `team_calendar_events.webLink`

            **Web Link.** URL to open the event in Outlook on the web. It locates the provider resource or path associated with the team calendar event.

            * **Enables:** Associate each team calendar event with the resource identified by web link in `team_calendar_events.webLink`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports web link as a resource locator for each team calendar event; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-team-details-ba21696cfa21" title="Team Details" icon="sitemap" iconType="sharp-duotone-solid">
        Developer identifier: `team_details`

        **Team Details.** Detailed settings for each team.

        * **Enables:** Match each Team to its detailed messaging, member, guest, discovery, and archival settings.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/teams/{id}` operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-team-details-classification-7931f445b033" title="Classification" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.classification`

            **Classification.** Classification of the team (e.g. low, medium, high business impact) when classifications are configured for the organization. It identifies the related provider object that gives the team detail its parent, owner, or container context.

            * **Enables:** Segment team detail entries in Team Details by classification in `team_details.classification`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports classification as a label from its own taxonomy on each team detail; preserve unknown labels rather than mapping them by assumption. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-createddatetime-267b7b7ccb2c" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.createdDateTime`

            **Created Date Time.** When the team was created. It anchors the team detail on the provider's reported timeline.

            * **Enables:** Order Team Details by created date time in `team_details.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each team detail; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-description-59a8c75c0ed0" title="Description" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.description`

            **Description.** Optional description of the team. It defines the content surface available for this team detail.

            * **Enables:** Locate team detail records by description in `team_details.description`; attribute each text match to its parent team detail and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies description as text on each team detail; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-displayname-ca5ecf88cbb2" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.displayName`

            **Display Name.** Name of the team as displayed to users. It distinguishes the provider-defined display name state or classification for the team detail.

            * **Enables:** Label each team detail with display name from `team_details.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each team detail; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-funsettings-d93b322983f7" title="Fun Settings" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.funSettings`

            **Fun Settings.** Settings that control fun content (giphy, stickers, memes) in the team. It preserves the nested context needed to interpret the parent team detail.

            * **Enables:** Attribute fun settings in `team_details.funSettings` to the parent team detail; identify parent records where that nested fun settings object is absent.
            * **Interpretation:** Microsoft 365 reports fun settings as a nested object on each team detail; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-funsettings-allowcustomme-ce2ba5ecedb0" title="Allow Custom Memes" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.funSettings.allowCustomMemes`

            **Allow Custom Memes.** Whether custom memes can be used in the team. It distinguishes the provider-defined allow custom memes state or classification for the team fun setting.

            * **Enables:** Filter Team Details by whether custom memes can be used in the team in `team_details.TeamFunSettings.allowCustomMemes`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports custom memes can be used in the team as a boolean on each team fun setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-funsettings-allowgiphy-a03050a9f2f5" title="Allow Giphy" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.funSettings.allowGiphy`

            **Allow Giphy.** Whether Giphy can be used in the team. It distinguishes the provider-defined allow giphy state or classification for the team fun setting.

            * **Enables:** Filter Team Details by whether giphy can be used in the team in `team_details.TeamFunSettings.allowGiphy`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports giphy can be used in the team as a boolean on each team fun setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-funsettings-allowstickers-42417aa2c555" title="Allow Stickers And Memes" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.funSettings.allowStickersAndMemes`

            **Allow Stickers And Memes.** Whether stickers and memes can be used in the team. It distinguishes the provider-defined allow stickers and memes state or classification for the team fun setting.

            * **Enables:** Filter Team Details by whether stickers and memes can be used in the team in `team_details.TeamFunSettings.allowStickersAndMemes`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports stickers and memes can be used in the team as a boolean on each team fun setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-funsettings-giphycontentr-6023c4c6c974" title="Giphy Content Rating" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.funSettings.giphyContentRating`

            **Giphy Content Rating.** Giphy content rating: moderate or strict. It distinguishes the provider-defined giphy content rating state or classification for the team fun setting.

            * **Enables:** Segment team fun setting entries in Team Details by giphy content rating in `team_details.TeamFunSettings.giphyContentRating`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports giphy content rating as a label from its own taxonomy on each team fun setting; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-guestsettings-40427e2d2b56" title="Guest Settings" icon="code-merge" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.guestSettings`

            **Guest Settings.** Settings that control what guests can do in the team. It preserves the nested context needed to interpret the parent team detail.

            * **Enables:** Attribute guest settings in `team_details.guestSettings` to the parent team detail; identify parent records where that nested guest settings object is absent.
            * **Interpretation:** Microsoft 365 reports guest settings as a nested object on each team detail; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-guestsettings-allowcreate-e1e1548db5e3" title="Allow Create Update Channels" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.guestSettings.allowCreateUpdateChannels`

            **Allow Create Update Channels.** Whether guests can add and update channels. It distinguishes the provider-defined allow create update channels state or classification for the team guest setting.

            * **Enables:** Filter Team Details by whether guests can add and update channels in `team_details.TeamGuestSettings.allowCreateUpdateChannels`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports guests can add and update channels as a boolean on each team guest setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-guestsettings-allowdelete-8e44411d8fdd" title="Allow Delete Channels" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.guestSettings.allowDeleteChannels`

            **Allow Delete Channels.** Whether guests can delete channels. It distinguishes the provider-defined allow delete channels state or classification for the team guest setting.

            * **Enables:** Filter Team Details by whether guests can delete channels in `team_details.TeamGuestSettings.allowDeleteChannels`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports guests can delete channels as a boolean on each team guest setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-id-82bb4ab81bac" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.id`

            **ID.** Unique identifier for the team. It provides the reference needed to connect the team detail to the corresponding provider object.

            * **Enables:** Match repeated team detail entries on ID in `team_details.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its team detail namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-internalid-2b04ac0576c4" title="Internal ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.internalId`

            **Internal ID.** Unique identifier used by Teams telemetry (not the same as ID). It provides the reference needed to connect the team detail to the corresponding provider object.

            * **Enables:** Connect each team detail in Team Details to the referenced internal through `team_details.internalId`; flag internal ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports internal ID as an identifier in its internal namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-isarchived-eb0150c51dca" title="Is Archived" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.isArchived`

            **Is Archived.** Whether the team is currently archived (read-only). It distinguishes the provider-defined is archived state or classification for the team detail.

            * **Enables:** Filter Team Details by whether the team is currently archived (read-only) in `team_details.isArchived`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the team is currently archived (read-only) as a boolean on each team detail; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-membersettings-24c0056d53bb" title="Member Settings" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.memberSettings`

            **Member Settings.** Settings that control what members can do in the team. It preserves the nested context needed to interpret the parent team detail.

            * **Enables:** Attribute member settings in `team_details.memberSettings` to the parent team detail; identify parent records where that nested member settings object is absent.
            * **Interpretation:** Microsoft 365 reports member settings as a nested object on each team detail; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-membersettings-allowaddre-99b6d1bb98aa" title="Allow Add Remove Apps" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.memberSettings.allowAddRemoveApps`

            **Allow Add Remove Apps.** Whether members can add or remove apps. It distinguishes the provider-defined allow add remove apps state or classification for the team member setting.

            * **Enables:** Filter Team Details by whether members can add or remove apps in `team_details.TeamMemberSettings.allowAddRemoveApps`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports members can add or remove apps as a boolean on each team member setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-membersettings-allowcreat-60b7d5f81b51" title="Allow Create Private Channels" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.memberSettings.allowCreatePrivateChannels`

            **Allow Create Private Channels.** Whether members can add private channels. It distinguishes the provider-defined allow create private channels state or classification for the team member setting.

            * **Enables:** Filter Team Details by whether members can add private channels in `team_details.TeamMemberSettings.allowCreatePrivateChannels`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports members can add private channels as a boolean on each team member setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-membersettings-allowcreat-bb4ae0ba31bc" title="Allow Create Update Channels" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.memberSettings.allowCreateUpdateChannels`

            **Allow Create Update Channels.** Whether members can add and update channels. It distinguishes the provider-defined allow create update channels state or classification for the team member setting.

            * **Enables:** Filter Team Details by whether members can add and update channels in `team_details.TeamMemberSettings.allowCreateUpdateChannels`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports members can add and update channels as a boolean on each team member setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-membersettings-allowcreat-38458f5db21d" title="Allow Create Update Remove Connectors" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.memberSettings.allowCreateUpdateRemoveConnectors`

            **Allow Create Update Remove Connectors.** Whether members can add, update, and remove connectors. It distinguishes the provider-defined allow create update remove connectors state or classification for the team member setting.

            * **Enables:** Filter Team Details by whether members can add, update, and remove connectors in `team_details.TeamMemberSettings.allowCreateUpdateRemoveConnectors`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports members can add, update, and remove connectors as a boolean on each team member setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-membersettings-allowcreat-b75b555b4935" title="Allow Create Update Remove Tabs" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.memberSettings.allowCreateUpdateRemoveTabs`

            **Allow Create Update Remove Tabs.** Whether members can add, update, and remove tabs. It distinguishes the provider-defined allow create update remove tabs state or classification for the team member setting.

            * **Enables:** Filter Team Details by whether members can add, update, and remove tabs in `team_details.TeamMemberSettings.allowCreateUpdateRemoveTabs`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports members can add, update, and remove tabs as a boolean on each team member setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-membersettings-allowdelet-2e328f94e6b2" title="Allow Delete Channels" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.memberSettings.allowDeleteChannels`

            **Allow Delete Channels.** Whether members can delete channels. It distinguishes the provider-defined allow delete channels state or classification for the team member setting.

            * **Enables:** Filter Team Details by whether members can delete channels in `team_details.TeamMemberSettings.allowDeleteChannels`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports members can delete channels as a boolean on each team member setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-messagingsettings-186551a8034d" title="Messaging Settings" icon="brackets-curly" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.messagingSettings`

            **Messaging Settings.** Settings that control messaging and mentions in the team. It preserves the nested context needed to interpret the parent team detail.

            * **Enables:** Attribute messaging settings in `team_details.messagingSettings` to the parent team detail; identify parent records where that nested messaging settings object is absent.
            * **Interpretation:** Microsoft 365 reports messaging settings as a nested object on each team detail; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-messagingsettings-allowch-fd9a93b643cb" title="Allow Channel Mentions" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.messagingSettings.allowChannelMentions`

            **Allow Channel Mentions.** Whether @channel mentions are allowed. It distinguishes the provider-defined allow channel mentions state or classification for the team messaging setting.

            * **Enables:** Filter Team Details by whether @channel mentions are allowed in `team_details.TeamMessagingSettings.allowChannelMentions`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports @channel mentions are allowed as a boolean on each team messaging setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-messagingsettings-allowow-a4a101bdf23d" title="Allow Owner Delete Messages" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.messagingSettings.allowOwnerDeleteMessages`

            **Allow Owner Delete Messages.** Whether owners can delete any message. It distinguishes the provider-defined allow owner delete messages state or classification for the team messaging setting.

            * **Enables:** Filter Team Details by whether owners can delete any message in `team_details.TeamMessagingSettings.allowOwnerDeleteMessages`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports owners can delete any message as a boolean on each team messaging setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-messagingsettings-allowte-67a65f21f3d7" title="Allow Team Mentions" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.messagingSettings.allowTeamMentions`

            **Allow Team Mentions.** Whether @team mentions are allowed. It distinguishes the provider-defined allow team mentions state or classification for the team messaging setting.

            * **Enables:** Filter Team Details by whether @team mentions are allowed in `team_details.TeamMessagingSettings.allowTeamMentions`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports @team mentions are allowed as a boolean on each team messaging setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-messagingsettings-allowus-bda60bb9e26d" title="Allow User Delete Messages" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.messagingSettings.allowUserDeleteMessages`

            **Allow User Delete Messages.** Whether users can delete their own messages. It distinguishes the provider-defined allow user delete messages state or classification for the team messaging setting.

            * **Enables:** Filter Team Details by whether users can delete their own messages in `team_details.TeamMessagingSettings.allowUserDeleteMessages`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports users can delete their own messages as a boolean on each team messaging setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-messagingsettings-allowus-c42f79f383a4" title="Allow User Edit Messages" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.messagingSettings.allowUserEditMessages`

            **Allow User Edit Messages.** Whether users can edit their own messages. It distinguishes the provider-defined allow user edit messages state or classification for the team messaging setting.

            * **Enables:** Filter Team Details by whether users can edit their own messages in `team_details.TeamMessagingSettings.allowUserEditMessages`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports users can edit their own messages as a boolean on each team messaging setting; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-specialization-6b42f572be70" title="Specialization" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.specialization`

            **Specialization.** Creation-time specialization of the team (evolvable enum, e.g. none, educationStandard, educationClass, healthcareStandard). Stored as string because Microsoft adds values over time (education/healthcare variants) and a strict enum would quarantine records on any new value. It identifies the related provider object that gives the team detail its parent, owner, or container context.

            * **Enables:** Connect each team detail to the related specialization in `team_details.specialization` and verify that the referenced provider object resolves in the expected parent or container.
            * **Interpretation:** Microsoft 365 reports specialization as relationship context on each team detail; resolve it in the named provider namespace rather than by display text alone.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-team-id-f698e0eca4a9" title="Team ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.team_id`

            **Team ID.** Parent team reference copied into each team detail because the child operation does not return that relationship. It provides the reference needed to connect the team detail to the corresponding provider object.

            * **Enables:** Connect each team detail in Team Details to the referenced team through `team_details.team_id`; flag team ID values that do not resolve in that provider namespace.
            * **Interpretation:** Parable copies team ID from the parent traversal record into each team detail; the child Microsoft 365 operation does not return it.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-tenantid-4889a41324ed" title="Tenant ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.tenantId`

            **Tenant ID.** Identifier (GUID) of the Microsoft Entra tenant the team belongs to. Kept as string (not Identity.UUID) to match this connector's ID-field convention. It provides the reference needed to connect the team detail to the corresponding provider object.

            * **Enables:** Connect each team detail in Team Details to the referenced tenant through `team_details.tenantId`; flag tenant ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports tenant ID as an identifier in its tenant namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-visibility-81699127c2bf" title="Visibility" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.visibility`

            **Visibility.** Visibility of the underlying group: private, public, or hiddenMembership. It distinguishes the provider-defined visibility state or classification for the team detail.

            * **Enables:** Segment team detail entries in Team Details by visibility in `team_details.visibility`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports visibility as a label from its own taxonomy on each team detail; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-team-details-weburl-9afe43ffaa7b" title="Web URL" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `team_details.webUrl`

            **Web URL.** URL to open the team in the Microsoft Teams client. It locates the provider resource or path associated with the team detail.

            * **Enables:** Associate each team detail with the resource identified by web URL in `team_details.webUrl`; verify the link resolves to the expected Microsoft 365 object.
            * **Interpretation:** Microsoft 365 reports web URL as a resource locator for each team detail; access still depends on viewer permissions and the URL may expire or change.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-teams-3113c76a78f5" title="Teams" icon="address-book" iconType="sharp-duotone-solid">
        Developer identifier: `teams`

        **Teams.** Microsoft Teams represented as groups.

        * **Enables:** Inventory Entra groups provisioned as Teams and preserve their visibility, lifecycle, and mail settings for child traversal.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/groups` operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-teams-classification-c8ddf45f71f1" title="Classification" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `teams.classification`

            **Classification.** Classification of the group (e.g. Low, Medium, High) when classifications are configured for the organization. It distinguishes the provider-defined classification state or classification for the team.

            * **Enables:** Segment team entries in Teams by classification in `teams.classification`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports classification as a label from its own taxonomy on each team; preserve unknown labels rather than mapping them by assumption. Microsoft 365 generated or classified this result; it may be incomplete and is not a Parable-authored judgment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-createddatetime-1b390057546e" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `teams.createdDateTime`

            **Created Date Time.** When the group was created. It anchors the team on the provider's reported timeline.

            * **Enables:** Order Teams by created date time in `teams.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-deleteddatetime-fe1ffa562c1e" title="Deleted Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `teams.deletedDateTime`

            **Deleted Date Time.** When the group was soft-deleted, if it is in the deleted items. It anchors the team on the provider's reported timeline.

            * **Enables:** Order Teams by deleted date time in `teams.deletedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports deleted date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-description-34b275c39a25" title="Description" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `teams.description`

            **Description.** Description of the group. It defines the content surface available for this team.

            * **Enables:** Locate team records by description in `teams.description`; attribute each text match to its parent team and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies description as text on each team; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-displayname-c973c46d6b37" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `teams.displayName`

            **Display Name.** Display name of the group. It distinguishes the provider-defined display name state or classification for the team.

            * **Enables:** Label each team with display name from `teams.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each team; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-expirationdatetime-c294b7adea73" title="Expiration Date Time" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `teams.expirationDateTime`

            **Expiration Date Time.** When the group is set to expire under the group lifecycle policy. It anchors the team on the provider's reported timeline.

            * **Enables:** Order Teams by expiration date time in `teams.expirationDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports expiration date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-grouptypes-c4d80855dc2a" title="Group Types" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `teams.groupTypes`

            **Group Types.** Group type markers (e.g. Unified for M365 groups, DynamicMembership). It preserves the nested context needed to interpret the parent team.

            * **Enables:** Compare the exact Microsoft 365-configured group types set in `teams.groupTypes` for each team; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns group types as an array of group type value entries on each team; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-id-1d6cbc1607df" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `teams.id`

            **ID.** Unique identifier for the group. It provides the reference needed to connect the team to the corresponding provider object.

            * **Enables:** Match repeated team entries on ID in `teams.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its team namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-mail-4c773645e91d" title="Mail" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `teams.mail`

            **Mail.** SMTP address for the group. It supplies the provider-reported address or location facet for the team, not a residency determination.

            * **Enables:** Group Teams by the exact mail in `teams.mail` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports mail as an address or location facet on each team; it does not establish verified geolocation or data residency.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-mailenabled-38e0e85cb1ec" title="Mail Enabled" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `teams.mailEnabled`

            **Mail Enabled.** Whether the group is mail-enabled. It distinguishes the provider-defined mail enabled state or classification for the team.

            * **Enables:** Filter Teams by whether the group is mail-enabled in `teams.mailEnabled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the group is mail-enabled as a boolean on each team; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-mailnickname-c0710c7e892c" title="Mail Nickname" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `teams.mailNickname`

            **Mail Nickname.** Mail alias for the group. It supplies the mail nickname profile facet used to reconcile or attribute the team.

            * **Enables:** Reconcile the team's mail nickname in `teams.mailNickname` with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
            * **Interpretation:** Microsoft 365 reports mail nickname as a mutable profile or directory attribute on each team; it may be absent, shared, or non-unique.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-reneweddatetime-2c4ba07c87f9" title="Renewed Date Time" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `teams.renewedDateTime`

            **Renewed Date Time.** When the group was last renewed under the group lifecycle policy. It anchors the team on the provider's reported timeline.

            * **Enables:** Order Teams by renewed date time in `teams.renewedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports renewed date time as a timestamp on each team; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-resourceprovisioningoptions-2734796f44ee" title="Resource Provisioning Options" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `teams.resourceProvisioningOptions`

            **Resource Provisioning Options.** Provisioned resources for the group (e.g. Team). It preserves the nested context needed to interpret the parent team.

            * **Enables:** Compare the exact Microsoft 365-configured resource provisioning options set in `teams.resourceProvisioningOptions` for each team; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns resource provisioning options as an array of resource provisioning option value entries on each team; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-securityenabled-542e6403fa6e" title="Security Enabled" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `teams.securityEnabled`

            **Security Enabled.** Whether the group is a security group. It distinguishes the provider-defined security enabled state or classification for the team.

            * **Enables:** Filter Teams by whether the group is a security group in `teams.securityEnabled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the group is a security group as a boolean on each team; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-teams-visibility-0f3809ffdb2d" title="Visibility" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `teams.visibility`

            **Visibility.** Group visibility: Public, Private, or HiddenMembership. It distinguishes the provider-defined visibility state or classification for the team.

            * **Enables:** Segment team entries in Teams by visibility in `teams.visibility`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports visibility as a label from its own taxonomy on each team; preserve unknown labels rather than mapping them by assumption.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-user-calendar-events-37d3ce1a5ce1" title="User Calendar Events" icon="calendar-check" iconType="sharp-duotone-solid">
        Developer identifier: `user_calendar_events`

        **User Calendar Events.** DEPRECATED expansion tap. Duplicates the calendar\_events tap with a narrower \$select. The legacy ingestion-service only defines a single user-calendar tap (calendar\_events). Disabled by default; retained for backward compatibility.

        * **Enables:** Preserve the deprecated narrower calendar projection for compatibility while directing new workflows to Calendar Events.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/users/{id}/calendarView` operation as an event stream using incremental synchronization. This stream is opt-in. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. This opt-in stream is deprecated, duplicates Calendar Events with a narrower selection, and is retained only for compatibility. This stream supplies no reliable deletion signal.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-user-calendar-events-odata-etag-a5bdae52d1cb" title="@odata ETag" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.@odata.etag`

            **@odata ETag.** OData entity tag for concurrency. It is needed for conditional reads and provider-version checks, not as a stable business identifier.

            * **Enables:** Use `user_calendar_events.@odata.etag` for conditional provider reads and revision checks; pair the ETag with the user calendar event ID rather than joining on it.
            * **Interpretation:** Microsoft 365 returns this ETag as an opaque revision token for each user calendar event; it can change when the resource changes and is not a universal identifier.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-53a928dc03b3" title="Attendees" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees`

            **Attendees.** List of attendees. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Attribute each returned attendee in `user_calendar_events.attendees` to the parent user calendar event; preserve whether the field represents an attendee, To, Cc, or Bcc relationship.
            * **Interpretation:** Microsoft 365 returns attendees as an array of attendee entries on each user calendar event; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-emailad-ecee70003096" title="Email Address" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees.emailAddress`

            **Email Address.** The structured email address details attached to each attendee in User Calendar Events. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Match repeated attendee entries on email address in `user_calendar_events.Attendee.emailAddress`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports email address as a nested object on each attendee; optional children may be absent from a valid response. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-emailad-b563e77df1d2" title="Address" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees.emailAddress.address`

            **Address.** Email/contact address returned for this recipient or account; needed to attribute it to the corresponding Microsoft 365 identity.

            * **Enables:** Attribute each email address to a person or account by the exact address in `user_calendar_events.EmailAddress.address`; identify addresses that do not match the Microsoft 365 directory.
            * **Interpretation:** Microsoft 365 reports address as an address on each email address; aliases, casing, and unverified addresses can prevent a one-to-one person match.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-emailad-870bdc500d03" title="Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees.emailAddress.name`

            **Name.** The provider-reported name for each email address in User Calendar Events. It gives the email address a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each email address with name from `user_calendar_events.EmailAddress.name`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports name as display text for each email address; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-status-3075d39b3b1d" title="Status" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees.status`

            **Status.** The structured status details attached to each attendee in User Calendar Events. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Attribute status in `user_calendar_events.Attendee.status` to the parent user calendar event; identify parent records where that nested status object is absent.
            * **Interpretation:** Microsoft 365 reports status as a nested object on each attendee; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-status--bfc76aa3d991" title="Response" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees.status.response`

            **Response.** Response type (none, organizer, tentativelyAccepted, accepted, declined, notResponded). It defines the content surface available for this user calendar event.

            * **Enables:** Locate response status records by response in `user_calendar_events.ResponseStatus.response`; attribute each text match to its parent user calendar event and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies response as text on each response status; referenced files or media are not implied unless explicitly represented.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-status--937fe5665f12" title="Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees.status.time`

            **Time.** Response timestamp. It anchors the user calendar event on the provider's reported timeline.

            * **Enables:** Order User Calendar Events by time in `user_calendar_events.ResponseStatus.time` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports time as a timestamp on each response status; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-attendees-type-1de5381f22cb" title="Type" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.attendees.type`

            **Type.** Attendee type (required, optional, resource). It distinguishes the provider-defined type state or classification for the attendee.

            * **Enables:** Segment attendee entries in User Calendar Events by type in `user_calendar_events.Attendee.type`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports type as a label from its own taxonomy on each attendee; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-bodypreview-4ee309e1d4ee" title="Body Preview" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.bodyPreview`

            **Body Preview.** Plain text preview of the event body. It defines the content surface available for this user calendar event.

            * **Enables:** Locate user calendar event records whose body preview in `user_calendar_events.bodyPreview` contains the search term; open the Microsoft 365 record when the excerpt lacks needed context.
            * **Interpretation:** This is an excerpt supplied by the provider, not the complete body or an attachment.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-createddatetime-22137eba806b" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.createdDateTime`

            **Created Date Time.** Event creation timestamp. It anchors the user calendar event on the provider's reported timeline.

            * **Enables:** Order User Calendar Events by created date time in `user_calendar_events.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each user calendar event; timezone and precision follow this API field, and absence is not an inferred event time. The schema designates this field as the event timestamp.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-end-1ef4cbebb955" title="End" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.end`

            **End.** Event end date/time with timezone. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Attribute end in `user_calendar_events.end` to the parent user calendar event; identify parent records where that nested end object is absent.
            * **Interpretation:** Microsoft 365 reports end as a nested object on each user calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-end-datetime-0a1d571a549a" title="Date Time" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.end.dateTime`

            **Date Time.** Date and time in ISO 8601 format. It anchors the user calendar event on the provider's reported timeline.

            * **Enables:** Order User Calendar Events by date time in `user_calendar_events.DateTimeTimeZone.dateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports date time as a timestamp on each date time time zone; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-end-timezone-940d358bd53c" title="Time Zone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.end.timeZone`

            **Time Zone.** IANA timezone identifier. It is needed to interpret companion dates and times for the date time time zone in the provider's intended zone.

            * **Enables:** Apply the zone in `user_calendar_events.DateTimeTimeZone.timeZone` when converting the user calendar event's companion start, end, or scheduled timestamps; do not infer it from locale.
            * **Interpretation:** Microsoft 365 reports time zone as a timezone identifier for each date time time zone; supported IANA or provider-specific names and daylight-saving behavior must be preserved.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-id-ab1d618e3bea" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.id`

            **ID.** Unique event identifier. It provides the reference needed to connect the user calendar event to the corresponding provider object.

            * **Enables:** Match repeated user calendar event entries on ID in `user_calendar_events.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its user calendar event namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-importance-f2126e6d5270" title="Importance" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.importance`

            **Importance.** Event importance (low, normal, high). It distinguishes the provider-defined importance state or classification for the user calendar event.

            * **Enables:** Filter User Calendar Events by the exact Microsoft 365-defined importance in `user_calendar_events.importance` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies importance from its own taxonomy on each user calendar event; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-isallday-d4780f98eba4" title="Is All Day" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.isAllDay`

            **Is All Day.** Whether this is an all-day event. It distinguishes the provider-defined is all day state or classification for the user calendar event.

            * **Enables:** Filter User Calendar Events by whether this is an all-day event in `user_calendar_events.isAllDay`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports this is an all-day event as a boolean on each user calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-iscancelled-6dc3a7bc1f61" title="Is Cancelled" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.isCancelled`

            **Is Cancelled.** Whether the event is cancelled. It distinguishes the provider-defined is cancelled state or classification for the user calendar event.

            * **Enables:** Filter User Calendar Events by whether the event is cancelled in `user_calendar_events.isCancelled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the event is cancelled as a boolean on each user calendar event; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-lastmodifieddatet-614b08cdb7cf" title="Last Modified Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.lastModifiedDateTime`

            **Last Modified Date Time.** Last modification timestamp. It anchors the user calendar event on the provider's reported timeline.

            * **Enables:** Order User Calendar Events by last modified date time in `user_calendar_events.lastModifiedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports last modified date time as a timestamp on each user calendar event; timezone and precision follow this API field, and absence is not an inferred event time. A connector directive uses this field to order records for latest-state or incremental processing.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-location-7694d3f5a701" title="Location" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.location`

            **Location.** Event location. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Attribute location in `user_calendar_events.location` to the parent user calendar event; identify parent records where that nested location object is absent.
            * **Interpretation:** Microsoft 365 reports location as a nested object on each user calendar event; optional children may be absent from a valid response. This nested location attribute does not establish where data is stored or processed and is not a residency signal.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-location-displayn-e0327b4cbfc7" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.location.displayName`

            **Display Name.** Location display name. It distinguishes the provider-defined display name state or classification for the location.

            * **Enables:** Label each location with display name from `user_calendar_events.Location.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each location; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-location-location-4cc66a507759" title="Location Type" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.location.locationType`

            **Location Type.** Location type. It supplies the provider-reported address or location facet for the location, not a residency determination.

            * **Enables:** Group User Calendar Events by location type in `user_calendar_events.Location.locationType` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports location type as a user, device, request, or resource location attribute on each location; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-organizer-0771115ccb67" title="Organizer" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.organizer`

            **Organizer.** Event organizer. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Attribute organizer in `user_calendar_events.organizer` to the parent user calendar event; identify parent records where that nested organizer object is absent.
            * **Interpretation:** Microsoft 365 reports organizer as a nested object on each user calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-organizer-emailad-d9bc912b02e6" title="Email Address" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.organizer.emailAddress`

            **Email Address.** The structured email address details attached to each recipient in User Calendar Events. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Attribute email address in `user_calendar_events.Recipient.emailAddress` to the parent user calendar event; identify parent records where that nested email address object is absent.
            * **Interpretation:** Microsoft 365 reports email address as a nested object on each recipient; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-sensitivity-5850e5244ca5" title="Sensitivity" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.sensitivity`

            **Sensitivity.** Event sensitivity (normal, personal, private, confidential). It distinguishes the provider-defined sensitivity state or classification for the user calendar event.

            * **Enables:** Filter User Calendar Events by the exact Microsoft 365-defined sensitivity in `user_calendar_events.sensitivity` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies sensitivity from its own taxonomy on each user calendar event; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-showas-dc8fd3ba8c15" title="Show As" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.showAs`

            **Show As.** Free/busy status (free, tentative, busy, oof, workingElsewhere, unknown). It distinguishes the provider-defined show as state or classification for the user calendar event.

            * **Enables:** Filter User Calendar Events by the exact Microsoft 365-defined show as in `user_calendar_events.showAs` and preserve unknown values as distinct categories.
            * **Interpretation:** Microsoft 365 supplies show as from its own taxonomy on each user calendar event; preserve unknown and newly introduced labels.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-start-c10f8bc64974" title="Start" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.start`

            **Start.** Event start date/time with timezone. It preserves the nested context needed to interpret the parent user calendar event.

            * **Enables:** Attribute start in `user_calendar_events.start` to the parent user calendar event; identify parent records where that nested start object is absent.
            * **Interpretation:** Microsoft 365 reports start as a nested object on each user calendar event; optional children may be absent from a valid response.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-user-calendar-events-subject-9a5726a05778" title="Subject" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `user_calendar_events.subject`

            **Subject.** Event subject/title. It defines the content surface available for this user calendar event.

            * **Enables:** Locate user calendar event records by subject in `user_calendar_events.subject`; attribute each text match to its parent user calendar event and, when present, its reported author.
            * **Interpretation:** Microsoft 365 supplies subject as text on each user calendar event; referenced files or media are not implied unless explicitly represented.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-microsoft-users-93f44a14bec9" title="Users" icon="address-book" iconType="sharp-duotone-solid">
        Developer identifier: `users`

        **Users.** Microsoft Entra ID users.

        * **Enables:** Reconcile Microsoft Entra users to account status, directory identity, organization, licenses, job attributes, and synchronization state.
        * **Scope:** Reads the records selected by Microsoft 365's `/v1.0/users` operation as a snapshot stream using full synchronization. Visibility is limited to the Microsoft Graph application permissions and tenant resources granted to the configured app. The stream does not include records the credential, parent traversal, configured filters, or provider API omits. A later complete read can treat a previously seen record that is absent as removed.

        <AccordionGroup>
          <Accordion id="provider-permission-field-microsoft-users-accountenabled-8902b7e208e0" title="Account Enabled" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.accountEnabled`

            **Account Enabled.** Whether the user account is enabled. It distinguishes the provider-defined account enabled state or classification for the user.

            * **Enables:** Filter Users by whether the user account is enabled in `users.accountEnabled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the user account is enabled as a boolean on each user; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-assignedlicenses-69664caf9c6f" title="Assigned Licenses" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `users.assignedLicenses`

            **Assigned Licenses.** Licenses assigned to the user, including inherited (group-based) licenses. It preserves the nested context needed to interpret the parent user.

            * **Enables:** Compare the exact Microsoft 365-configured assigned licenses set in `users.assignedLicenses` for each user; preserve provider labels and unknown entries.
            * **Interpretation:** Microsoft 365 returns assigned licenses as an array of assigned license entries on each user; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-assignedlicenses-disabledplans-f974ca5fd46f" title="Disabled Plans" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `users.assignedLicenses.disabledPlans`

            **Disabled Plans.** Unique identifiers (GUIDs) for the service plans disabled within this license assignment. It preserves the nested context needed to interpret the parent user.

            * **Enables:** Connect the parent user to every referenced disabled plan value in `users.AssignedLicense.disabledPlans`; identify provider IDs that do not resolve to the expected related object.
            * **Interpretation:** Microsoft 365 returns disabled plans as an array of disabled plan value entries on each assigned license; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-assignedlicenses-skuid-71edf7817e47" title="Sku ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.assignedLicenses.skuId`

            **Sku ID.** Unique identifier (GUID) for the SKU of the assigned license. Kept as string (not Identity.UUID) to match this connector's ID-field convention and avoid quarantining records if Microsoft returns a non-canonical GUID form. It provides the reference needed to connect the user to the corresponding provider object.

            * **Enables:** Match repeated assigned license entries on sku ID in `users.AssignedLicense.skuId`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports sku ID as an identifier in its sku namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-city-7b2c58a4d5dd" title="City" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.city`

            **City.** City of the user's address. It supplies the provider-reported address or location facet for the user, not a residency determination.

            * **Enables:** Group Users by city in `users.city` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports city as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-companyname-c4afb9828d3d" title="Company Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.companyName`

            **Company Name.** Company name associated with the user. It gives the user a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each user with company name from `users.companyName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports company name as display text for each user; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-country-246f7fdf708e" title="Country" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `users.country`

            **Country.** Country or region of the user's address. It supplies the provider-reported address or location facet for the user, not a residency determination.

            * **Enables:** Group Users by country in `users.country` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports country as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-createddatetime-0e4a43758cfb" title="Created Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.createdDateTime`

            **Created Date Time.** When the user account was created. It anchors the user on the provider's reported timeline.

            * **Enables:** Order Users by created date time in `users.createdDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports created date time as a timestamp on each user; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-creationtype-0b97aa89035f" title="Creation Type" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `users.creationType`

            **Creation Type.** How the user account was created (e.g. Invitation, LocalAccount). It distinguishes the provider-defined creation type state or classification for the user.

            * **Enables:** Segment user entries in Users by creation type in `users.creationType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports creation type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-deleteddatetime-088b6a32195e" title="Deleted Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.deletedDateTime`

            **Deleted Date Time.** When the user was soft-deleted, if in the deleted items. It anchors the user on the provider's reported timeline.

            * **Enables:** Order Users by deleted date time in `users.deletedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports deleted date time as a timestamp on each user; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-department-2bad90765414" title="Department" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `users.department`

            **Department.** Department the user belongs to. It identifies the related provider object that gives the user its parent, owner, or container context.

            * **Enables:** Connect each user to the related department in `users.department` and verify that the referenced provider object resolves in the expected parent or container.
            * **Interpretation:** Microsoft 365 reports department as relationship context on each user; resolve it in the named provider namespace rather than by display text alone.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-displayname-587b26e07f11" title="Display Name" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.displayName`

            **Display Name.** Full display name of the user. It distinguishes the provider-defined display name state or classification for the user.

            * **Enables:** Label each user with display name from `users.displayName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports display name as display text for each user; names are mutable and are not stable identities. A connector directive maps this field to a person's display name.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-employeeid-31dab15dfc1a" title="Employee ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.employeeId`

            **Employee ID.** Employee identifier assigned by the organization. It provides the reference needed to connect the user to the corresponding provider object.

            * **Enables:** Connect each user in Users to the referenced employee through `users.employeeId`; flag employee ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports employee ID as an identifier in its employee namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-employeetype-62b1739f0a0f" title="Employee Type" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `users.employeeType`

            **Employee Type.** Type of worker (e.g. Employee, Contractor, Vendor). It distinguishes the provider-defined employee type state or classification for the user.

            * **Enables:** Segment user entries in Users by employee type in `users.employeeType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports employee type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-givenname-d37612f9ca34" title="Given Name" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.givenName`

            **Given Name.** First name of the user. It gives the user a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each user with given name from `users.givenName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports given name as display text for each user; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-id-7a6d85988b64" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.id`

            **ID.** Unique identifier for the user in Entra ID. It provides the reference needed to connect the user to the corresponding provider object.

            * **Enables:** Match repeated user entries on ID in `users.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its user namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key. A connector directive maps this field to account identity.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-identities-c454a8cb30d9" title="Identities" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.identities`

            **Identities.** Identities used to sign in to the account (local, social, or federated). It preserves the nested context needed to interpret the parent user.

            * **Enables:** Reconcile each returned object identity in `users.identities` with the parent user's provider profile; preserve distinct aliases, contact points, and organization attributes.
            * **Interpretation:** Microsoft 365 returns identities as an array of object identity entries on each user; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-identities-issuer-1eec34473d6d" title="Issuer" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.identities.issuer`

            **Issuer.** Issuer of the identity (e.g. the tenant domain or an external identity provider). It supplies the issuer profile facet used to reconcile or attribute the object identity.

            * **Enables:** Match repeated object identity entries on issuer in `users.ObjectIdentity.issuer`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports issuer on each object identity; missing and empty values can have different meanings. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-identities-issuerassignedid-e9e246b1b4b5" title="Issuer Assigned ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.identities.issuerAssignedId`

            **Issuer Assigned ID.** Identifier assigned to the user by the issuer. It provides the reference needed to connect the user to the corresponding provider object.

            * **Enables:** Match repeated object identity entries on issuer assigned ID in `users.ObjectIdentity.issuerAssignedId`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports issuer assigned ID as an identifier in its issuer assigned namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-identities-signintype-f7da3310bf71" title="Sign In Type" icon="inbox" iconType="sharp-duotone-solid">
            Developer identifier: `users.identities.signInType`

            **Sign In Type.** Sign-in type of the identity (e.g. emailAddress, userName, federated). It distinguishes the provider-defined sign in type state or classification for the object identity.

            * **Enables:** Segment object identity entries in Users by sign in type in `users.ObjectIdentity.signInType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports sign in type as a label from its own taxonomy on each object identity; preserve unknown labels rather than mapping them by assumption.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-jobtitle-e8ae067aa9d2" title="Job Title" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `users.jobTitle`

            **Job Title.** User's job title. It supplies the job title profile facet used to reconcile or attribute the user.

            * **Enables:** Label each user with job title from `users.jobTitle`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports job title as display text for each user; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-lastpasswordchangedatetime-d9288a0de4b3" title="Last Password Change Date Time" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `users.lastPasswordChangeDateTime`

            **Last Password Change Date Time.** When the user last changed their password. It anchors the user on the provider's reported timeline.

            * **Enables:** Order Users by last password change date time in `users.lastPasswordChangeDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports last password change date time as a timestamp on each user; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-mail-3fe214f03954" title="Mail" icon="comments" iconType="sharp-duotone-solid">
            Developer identifier: `users.mail`

            **Mail.** SMTP email address of the user. It supplies the provider-reported address or location facet for the user, not a residency determination.

            * **Enables:** Group Users by the exact mail in `users.mail` while keeping that address or location separate from geolocation and residency claims.
            * **Interpretation:** Microsoft 365 reports mail as an address or location facet on each user; it does not establish verified geolocation or data residency. A connector directive maps this field to a person's email identity.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-mailnickname-5bf7c4debca8" title="Mail Nickname" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.mailNickname`

            **Mail Nickname.** Mail alias for the user. It supplies the mail nickname profile facet used to reconcile or attribute the user.

            * **Enables:** Reconcile the user's mail nickname in `users.mailNickname` with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
            * **Interpretation:** Microsoft 365 reports mail nickname as a mutable profile or directory attribute on each user; it may be absent, shared, or non-unique.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-memberof-1b1053c64014" title="Member Of" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `users.memberOf`

            **Member Of.** Groups and directory roles the user is a member of, expanded via $expand=memberOf($select=ID,deletedDateTime). It preserves the nested context needed to interpret the parent user.

            * **Enables:** Match every returned directory object ref in `users.memberOf` to the parent user; use the element's provider identity or role to reconcile membership and attribution.
            * **Interpretation:** Microsoft 365 returns member of as an array of directory object ref entries on each user; missing, empty, and permission-redacted arrays are not equivalent.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-memberof-deleteddatetime-99e331c36d28" title="Deleted Date Time" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.memberOf.deletedDateTime`

            **Deleted Date Time.** When the directory object was soft-deleted, if applicable. It anchors the user on the provider's reported timeline.

            * **Enables:** Order Users by deleted date time in `users.DirectoryObjectRef.deletedDateTime` and isolate records inside an exact provider reporting window.
            * **Interpretation:** Microsoft 365 reports deleted date time as a timestamp on each directory object ref; timezone and precision follow this API field, and absence is not an inferred event time.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-memberof-id-dce63b4318f8" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.memberOf.id`

            **ID.** Unique identifier of the directory object. It provides the reference needed to connect the user to the corresponding provider object.

            * **Enables:** Match repeated directory object ref entries on ID in `users.DirectoryObjectRef.id`; collapse only entries that share this declared transform key.
            * **Interpretation:** Microsoft 365 reports ID as an identifier in its directory object ref namespace; it is not a universal identity outside Microsoft 365. The connector explicitly marks this field as a transform deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-officelocation-5b48d9581d4d" title="Office Location" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `users.officeLocation`

            **Office Location.** Physical office location of the user. It supplies the provider-reported address or location facet for the user, not a residency determination.

            * **Enables:** Group Users by office location in `users.officeLocation` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports office location as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-onpremisesimmutableid-6a451279a9f6" title="On Premises Immutable ID" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `users.onPremisesImmutableId`

            **On Premises Immutable ID.** Immutable identifier associating an on-premises AD user with the Entra ID user. It provides the reference needed to connect the user to the corresponding provider object.

            * **Enables:** Connect each user in Users to the referenced on premises immutable through `users.onPremisesImmutableId`; flag on premises immutable ID values that do not resolve in that provider namespace.
            * **Interpretation:** Microsoft 365 reports on premises immutable ID as an identifier in its on premises immutable namespace; it is not a universal identity outside Microsoft 365.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-onpremisessamaccountname-de1f02433cad" title="On Premises Sam Account Name" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `users.onPremisesSamAccountName`

            **On Premises Sam Account Name.** On-premises SAM account name synchronized from the on-premises directory. It locates the provider resource or path associated with the user.

            * **Enables:** Label each user with on premises sam account name from `users.onPremisesSamAccountName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports on premises sam account name as display text for each user; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-onpremisessyncenabled-0eafb7977a69" title="On Premises Sync Enabled" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `users.onPremisesSyncEnabled`

            **On Premises Sync Enabled.** Whether the user is synchronized from an on-premises directory. It distinguishes the provider-defined on premises sync enabled state or classification for the user.

            * **Enables:** Filter Users by whether the user is synchronized from an on-premises directory in `users.onPremisesSyncEnabled`; count true, false, and missing results separately.
            * **Interpretation:** Microsoft 365 reports the user is synchronized from an on-premises directory as a boolean on each user; a missing field is unknown, not false.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-state-f47946e67a07" title="State" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `users.state`

            **State.** State or province of the user's address. It supplies the provider-reported address or location facet for the user, not a residency determination.

            * **Enables:** Group Users by state in `users.state` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports state as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-surname-bc520ea35a0c" title="Surname" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.surname`

            **Surname.** Last name (family name) of the user. It supplies the surname profile facet used to reconcile or attribute the user.

            * **Enables:** Reconcile the user's surname in `users.surname` with its provider profile or directory identity; confirm ambiguous matches with the stable provider ID.
            * **Interpretation:** Microsoft 365 reports surname as a mutable profile or directory attribute on each user; it may be absent, shared, or non-unique.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-usagelocation-1fe7a00b5be8" title="Usage Location" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `users.usageLocation`

            **Usage Location.** Two-letter country code used for license assignment compliance. It supplies the provider-reported address or location facet for the user, not a residency determination.

            * **Enables:** Group Users by usage location in `users.usageLocation` without treating that user, device, or request attribute as a data-residency signal.
            * **Interpretation:** Microsoft 365 reports usage location as a user, device, request, or resource location attribute on each user; it does not establish where data is stored or processed.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-userprincipalname-a29f2bff517f" title="User Principal Name" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.userPrincipalName`

            **User Principal Name.** Sign-in name (typically email format) for the user. It gives the user a human-readable provider label while its identifier remains the stable reference.

            * **Enables:** Label each user with user principal name from `users.userPrincipalName`; distinguish records that share that display name but have different Microsoft 365 identifiers.
            * **Interpretation:** Microsoft 365 reports user principal name as display text for each user; names are mutable and are not stable identities.
          </Accordion>

          <Accordion id="provider-permission-field-microsoft-users-usertype-36a3307a1b5d" title="User Type" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `users.userType`

            **User Type.** Type of user: Member or Guest. It supplies the user type profile facet used to reconcile or attribute the user.

            * **Enables:** Segment user entries in Users by user type in `users.userType`; compare counts only within the same Microsoft 365 taxonomy.
            * **Interpretation:** Microsoft 365 reports user type as a label from its own taxonomy on each user; preserve unknown labels rather than mapping them by assumption.
          </Accordion>
        </AccordionGroup>
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Troubleshooting">
    | Error           | Meaning               | Solution                                      |
    | --------------- | --------------------- | --------------------------------------------- |
    | `AADSTS700016`  | App not found         | Verify Client ID and Tenant ID                |
    | `AADSTS7000215` | Invalid client secret | Regenerate client secret                      |
    | `AADSTS65001`   | Consent not granted   | Grant admin consent for permissions           |
    | `403 Forbidden` | Missing permission    | Add required API permission and grant consent |

    #### Common Issues

    #### "Insufficient privileges to complete the operation"

    Ensure admin consent was granted for all required permissions. Check **API permissions** in the app registration.

    #### Token expires quickly

    Access tokens are valid for \~1 hour. Implement proper token refresh using the client credentials flow.

    **[Microsoft Graph API](https://docs.microsoft.com/en-us/graph/overview)** - Official Graph API documentation

    **[App Registration](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)** - Azure AD app registration guide
  </Tab>
</Tabs>