Skip to content

Commit 759a5fd

Browse files
ShocOneShocOne
authored
fix: docs for authentication strength and named locations (#751)
# Pull Request Description ## Summary [Provide a brief description of the changes in this PR] ### Issue Reference Fixes #[Issue Number] ### Motivation and Context - Why is this change needed? - What problem does it solve? - If it fixes an open issue, please link to the issue here ### Dependencies - List any dependencies that are required for this change - Include any configuration changes needed - Note any version updates required ## Type of Change Please mark the relevant option with an `x`: - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 📝 Documentation update (Wiki/README/Code comments) - [ ] ♻️ Refactor (code improvement without functional changes) - [ ] 🎨 Style update (formatting, renaming) - [ ] 🔧 Configuration change - [ ] 📦 Dependency update ## Testing - [ ] I have added unit tests that prove my fix is effective or that my feature works - [ ] New and existing unit tests pass locally with my changes - [ ] I have tested this code in the following browsers/environments: [list environments] ## Quality Checklist - [ ] I have reviewed my own code before requesting review - [ ] I have verified there are no other open Pull Requests for the same update/change - [ ] All CI/CD pipelines pass without errors or warnings - [ ] My code follows the established style guidelines of this project - [ ] I have added necessary documentation (if appropriate) - [ ] I have commented my code, particularly in complex areas - [ ] I have made corresponding changes to the README and other relevant documentation - [ ] My changes generate no new warnings - [ ] I have performed a self-review of my own code - [ ] My code is properly formatted according to project standards ## Screenshots/Recordings (if appropriate) [Add screenshots or recordings that demonstrate the changes] ## Additional Notes [Add any additional information that might be helpful for reviewers]
2 parents 0f7fad9 + 2fabdf8 commit 759a5fd

File tree

8 files changed

+368
-4
lines changed

8 files changed

+368
-4
lines changed

‎docs/resources/graph_beta_identity_and_access_authentication_strength.md‎

Lines changed: 76 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
2-
# generated by https://github.com/hashicorp/terraform-plugin-docs
32
page_title: "microsoft365_graph_beta_identity_and_access_authentication_strength Resource - terraform-provider-microsoft365"
4-
subcategory: ""
3+
subcategory: "Identity and Access"
54
description: |-
65
Manages Microsoft 365 Authentication Strength Policies using the /identity/conditionalAccess/authenticationStrength/policies endpoint. Authentication Strength Policies define authentication method combinations that can be used in Conditional Access policies. Learn more here: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strength-advanced-options
76
---
@@ -10,7 +9,69 @@ description: |-
109

1110
Manages Microsoft 365 Authentication Strength Policies using the `/identity/conditionalAccess/authenticationStrength/policies` endpoint. Authentication Strength Policies define authentication method combinations that can be used in Conditional Access policies. Learn more here: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strength-advanced-options
1211

12+
## Microsoft Documentation
1313

14+
- [namedLocation resource type](https://learn.microsoft.com/en-us/graph/api/resources/authenticationstrengthpolicy?view=graph-rest-beta)
15+
16+
## API Permissions
17+
18+
The following API permissions are required in order to use this resource.
19+
20+
### Microsoft Graph
21+
22+
- **Application**: `Policy.ReadWrite.ConditionalAccess`, `Policy.Read.All`
23+
24+
## Version History
25+
26+
| Version | Status | Notes |
27+
|---------|--------|-------|
28+
| v0.28.0-alpha | Experimental | Initial release |
29+
30+
## Example Usage
31+
32+
```terraform
33+
resource "microsoft365_graph_beta_identity_and_access_authentication_strength" "auth_strength_maximal" {
34+
display_name = "maximal example of authentication strength combinations"
35+
description = "maximal authentication strength policy with all combinations"
36+
37+
allowed_combinations = [
38+
"deviceBasedPush",
39+
"federatedMultiFactor",
40+
"federatedSingleFactor",
41+
"fido2",
42+
"hardwareOath,federatedSingleFactor",
43+
"microsoftAuthenticatorPush,federatedSingleFactor",
44+
"password",
45+
"password,hardwareOath",
46+
"password,microsoftAuthenticatorPush",
47+
"password,sms",
48+
"password,softwareOath",
49+
"password,voice",
50+
"qrCodePin",
51+
"sms",
52+
"sms,federatedSingleFactor",
53+
"softwareOath,federatedSingleFactor",
54+
"temporaryAccessPassMultiUse",
55+
"temporaryAccessPassOneTime",
56+
"voice,federatedSingleFactor",
57+
"windowsHelloForBusiness",
58+
"x509CertificateMultiFactor",
59+
"x509CertificateSingleFactor"
60+
]
61+
}
62+
63+
resource "microsoft365_graph_beta_identity_and_access_authentication_strength" "auth_strength_mfa_only" {
64+
display_name = "example mfa only authentication strength policy"
65+
description = "MFA-only authentication strength policy"
66+
67+
allowed_combinations = [
68+
"fido2",
69+
"windowsHelloForBusiness",
70+
"microsoftAuthenticatorPush,federatedSingleFactor",
71+
"x509CertificateMultiFactor"
72+
]
73+
}
74+
```
1475

1576
<!-- schema generated by tfplugindocs -->
1677
## Schema
@@ -42,3 +103,16 @@ Optional:
42103
- `delete` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
43104
- `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
44105
- `update` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
106+
107+
## Important Notes
108+
A collection of settings that define specific combinations of authentication methods and metadata. The authentication strength policy, when applied to a given scenario using Microsoft Entra Conditional Access, defines which authentication methods must be used to authenticate in that scenario. An authentication strength may be built-in or custom (defined by the tenant) and may or may not fulfill the requirements to grant an MFA claim.
109+
110+
## Import
111+
112+
Import is supported using the following syntax:
113+
114+
```shell
115+
#!/bin/bash
116+
# Import using composite ID format: {id}
117+
terraform import microsoft365_graph_beta_identity_and_access_authentication_strength.example 00000000-0000-0000-0000-000000000000
118+
```

‎docs/resources/graph_beta_identity_and_access_named_location.md‎

Lines changed: 96 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
---
2-
# generated by https://github.com/hashicorp/terraform-plugin-docs
32
page_title: "microsoft365_graph_beta_identity_and_access_named_location Resource - terraform-provider-microsoft365"
4-
subcategory: ""
3+
subcategory: "Identity and Access"
54
description: |-
65
Manages Microsoft 365 Named Locations using the /identity/conditionalAccess/namedLocations endpoint. Named Locations define network locations that can be used in Conditional Access policies. Supports both IP-based and country-based named locations.
76
---
@@ -10,7 +9,87 @@ description: |-
109

1110
Manages Microsoft 365 Named Locations using the `/identity/conditionalAccess/namedLocations` endpoint. Named Locations define network locations that can be used in Conditional Access policies. Supports both IP-based and country-based named locations.
1211

12+
## Microsoft Documentation
1313

14+
- [namedLocation resource type](https://learn.microsoft.com/en-us/graph/api/resources/namedlocation?view=graph-rest-beta)
15+
16+
## API Permissions
17+
18+
The following API permissions are required in order to use this resource.
19+
20+
### Microsoft Graph
21+
22+
- **Application**: `Policy.ReadWrite.ConditionalAccess`, `Policy.Read.All`
23+
24+
## Version History
25+
26+
| Version | Status | Notes |
27+
|---------|--------|-------|
28+
| v0.28.0-alpha | Experimental | Initial release |
29+
30+
## Example Usage
31+
32+
```terraform
33+
resource "microsoft365_graph_beta_identity_and_access_named_location" "ipv6_only" {
34+
display_name = "example ipv6 named location"
35+
is_trusted = true
36+
37+
ipv6_ranges = [
38+
"2001:db8::/32",
39+
"fe80::/10"
40+
]
41+
}
42+
43+
resource "microsoft365_graph_beta_identity_and_access_named_location" "ipv4_only" {
44+
display_name = "example ipv4 named location"
45+
is_trusted = false
46+
47+
ipv4_ranges = [
48+
"192.168.1.0/24"
49+
]
50+
}
51+
52+
resource "microsoft365_graph_beta_identity_and_access_named_location" "ip_ranges" {
53+
display_name = "example ip ranges named location"
54+
is_trusted = true
55+
56+
ipv4_ranges = [
57+
"192.168.0.0/16",
58+
"172.16.0.0/12"
59+
]
60+
61+
ipv6_ranges = [
62+
"2001:db8::/32",
63+
"fe80::/10",
64+
"2001:4860:4860::/48"
65+
]
66+
}
67+
68+
resource "microsoft365_graph_beta_identity_and_access_named_location" "country_client_ip" {
69+
display_name = "example country client ip named location"
70+
country_lookup_method = "clientIpAddress"
71+
include_unknown_countries_and_regions = false
72+
73+
countries_and_regions = [
74+
"US",
75+
"CA",
76+
"GB"
77+
]
78+
}
79+
80+
resource "microsoft365_graph_beta_identity_and_access_named_location" "country_authenticator_gps" {
81+
display_name = "example country authenticator gps named location"
82+
country_lookup_method = "authenticatorAppGps"
83+
include_unknown_countries_and_regions = true
84+
85+
countries_and_regions = [
86+
"AD",
87+
"AO",
88+
"AI",
89+
"AQ"
90+
]
91+
}
92+
```
1493

1594
<!-- schema generated by tfplugindocs -->
1695
## Schema
@@ -44,3 +123,18 @@ Optional:
44123
- `delete` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
45124
- `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
46125
- `update` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
126+
127+
## Important Notes
128+
129+
Represents a Microsoft Entra ID named location defined by countries and regions. Named locations are custom rules that define network locations which can then be used in a Conditional Access policy.
130+
Represents a Microsoft Entra ID named location defined by IP ranges. Named locations are custom rules that define network locations that can then be used in a Conditional Access policy.
131+
132+
## Import
133+
134+
Import is supported using the following syntax:
135+
136+
```shell
137+
#!/bin/bash
138+
# Import using composite ID format: {id}
139+
terraform import microsoft365_graph_beta_identity_and_access_named_location.example 00000000-0000-0000-0000-000000000000
140+
```

‎examples/microsoft365_graph_beta/microsoft365_graph_beta_identity_and_access_authentication_strength/import.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
# Import using composite ID format: {id}
3+
terraform import microsoft365_graph_beta_identity_and_access_authentication_strength.example 00000000-0000-0000-0000-000000000000
4+

‎examples/microsoft365_graph_beta/microsoft365_graph_beta_identity_and_access_authentication_strength/resource.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
resource "microsoft365_graph_beta_identity_and_access_authentication_strength" "auth_strength_maximal" {
2+
display_name = "maximal example of authentication strength combinations"
3+
description = "maximal authentication strength policy with all combinations"
4+
5+
allowed_combinations = [
6+
"deviceBasedPush",
7+
"federatedMultiFactor",
8+
"federatedSingleFactor",
9+
"fido2",
10+
"hardwareOath,federatedSingleFactor",
11+
"microsoftAuthenticatorPush,federatedSingleFactor",
12+
"password",
13+
"password,hardwareOath",
14+
"password,microsoftAuthenticatorPush",
15+
"password,sms",
16+
"password,softwareOath",
17+
"password,voice",
18+
"qrCodePin",
19+
"sms",
20+
"sms,federatedSingleFactor",
21+
"softwareOath,federatedSingleFactor",
22+
"temporaryAccessPassMultiUse",
23+
"temporaryAccessPassOneTime",
24+
"voice,federatedSingleFactor",
25+
"windowsHelloForBusiness",
26+
"x509CertificateMultiFactor",
27+
"x509CertificateSingleFactor"
28+
]
29+
}
30+
31+
resource "microsoft365_graph_beta_identity_and_access_authentication_strength" "auth_strength_mfa_only" {
32+
display_name = "example mfa only authentication strength policy"
33+
description = "MFA-only authentication strength policy"
34+
35+
allowed_combinations = [
36+
"fido2",
37+
"windowsHelloForBusiness",
38+
"microsoftAuthenticatorPush,federatedSingleFactor",
39+
"x509CertificateMultiFactor"
40+
]
41+
}

‎examples/microsoft365_graph_beta/microsoft365_graph_beta_identity_and_access_named_location/import.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
# Import using composite ID format: {id}
3+
terraform import microsoft365_graph_beta_identity_and_access_named_location.example 00000000-0000-0000-0000-000000000000
4+

‎examples/microsoft365_graph_beta/microsoft365_graph_beta_identity_and_access_named_location/resource.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
resource "microsoft365_graph_beta_identity_and_access_named_location" "ipv6_only" {
2+
display_name = "example ipv6 named location"
3+
is_trusted = true
4+
5+
ipv6_ranges = [
6+
"2001:db8::/32",
7+
"fe80::/10"
8+
]
9+
}
10+
11+
resource "microsoft365_graph_beta_identity_and_access_named_location" "ipv4_only" {
12+
display_name = "example ipv4 named location"
13+
is_trusted = false
14+
15+
ipv4_ranges = [
16+
"192.168.1.0/24"
17+
]
18+
}
19+
20+
resource "microsoft365_graph_beta_identity_and_access_named_location" "ip_ranges" {
21+
display_name = "example ip ranges named location"
22+
is_trusted = true
23+
24+
ipv4_ranges = [
25+
"192.168.0.0/16",
26+
"172.16.0.0/12"
27+
]
28+
29+
ipv6_ranges = [
30+
"2001:db8::/32",
31+
"fe80::/10",
32+
"2001:4860:4860::/48"
33+
]
34+
}
35+
36+
resource "microsoft365_graph_beta_identity_and_access_named_location" "country_client_ip" {
37+
display_name = "example country client ip named location"
38+
country_lookup_method = "clientIpAddress"
39+
include_unknown_countries_and_regions = false
40+
41+
countries_and_regions = [
42+
"US",
43+
"CA",
44+
"GB"
45+
]
46+
}
47+
48+
resource "microsoft365_graph_beta_identity_and_access_named_location" "country_authenticator_gps" {
49+
display_name = "example country authenticator gps named location"
50+
country_lookup_method = "authenticatorAppGps"
51+
include_unknown_countries_and_regions = true
52+
53+
countries_and_regions = [
54+
"AD",
55+
"AO",
56+
"AI",
57+
"AQ"
58+
]
59+
}

‎templates/resources/graph_beta_identity_and_access_authentication_strength.md.tmpl‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
page_title: "{{.Name}} {{.Type}} - {{.ProviderName}}"
3+
subcategory: "Identity and Access"
4+
description: |-
5+
{{ .Description | plainmarkdown | trimspace | prefixlines " " }}
6+
---
7+
8+
# {{.Name}} ({{.Type}})
9+
10+
{{ .Description | trimspace }}
11+
12+
## Microsoft Documentation
13+
14+
- [namedLocation resource type](https://learn.microsoft.com/en-us/graph/api/resources/authenticationstrengthpolicy?view=graph-rest-beta)
15+
16+
## API Permissions
17+
18+
The following API permissions are required in order to use this resource.
19+
20+
### Microsoft Graph
21+
22+
- **Application**: `Policy.ReadWrite.ConditionalAccess`, `Policy.Read.All`
23+
24+
## Version History
25+
26+
| Version | Status | Notes |
27+
|---------|--------|-------|
28+
| v0.28.0-alpha | Experimental | Initial release |
29+
30+
## Example Usage
31+
32+
{{ tffile "examples/microsoft365_graph_beta/microsoft365_graph_beta_identity_and_access_authentication_strength/resource.tf" }}
33+
34+
{{ .SchemaMarkdown | trimspace }}
35+
36+
## Important Notes
37+
A collection of settings that define specific combinations of authentication methods and metadata. The authentication strength policy, when applied to a given scenario using Microsoft Entra Conditional Access, defines which authentication methods must be used to authenticate in that scenario. An authentication strength may be built-in or custom (defined by the tenant) and may or may not fulfill the requirements to grant an MFA claim.
38+
39+
## Import
40+
41+
Import is supported using the following syntax:
42+
43+
{{ codefile "shell" "examples/microsoft365_graph_beta/microsoft365_graph_beta_identity_and_access_authentication_strength/import.sh" }}

0 commit comments

Comments
 (0)