Repo sync for protected branch

api-reference/beta/api/accesspackage-getapplicablepolicyrequirements.md

@@ -13,7 +13,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-In [Microsoft Entra entitlement management](../resources/entitlementmanagement-overview.md), this action retrieves a list of [accessPackageAssignmentRequestRequirements](../resources/accesspackageassignmentrequestrequirements.md) objects that the currently signed-in user can use to create an [accessPackageAssignmentRequest](../resources/accesspackageassignmentrequest.md).  Each requirement object corresponds to an access package assignment policy that the currently signed-in user is allowed to request an assignment for.
+In [Microsoft Entra entitlement management](../resources/entitlementmanagement-overview.md), this action retrieves [accessPackageAssignmentRequestRequirements](../resources/accesspackageassignmentrequestrequirements.md) objects for an [accessPackage](../resources/accesspackage.md) that the currently signed-in user can use to create an [accessPackageAssignmentRequest](../resources/accesspackageassignmentrequest.md). Each requirement object corresponds to an access package assignment policy that the currently signed-in user is allowed to request an assignment for.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/accesspackagecatalog-list-accesspackagecustomworkflowextensions.md

@@ -13,7 +13,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Get a list of the [accessPackageAssignmentRequestWorkflowExtension](../resources/accessPackageAssignmentRequestWorkflowExtension.md) and [accessPackageAssignmentWorkflowExtension](../resources/accessPackageAssignmentWorkflowExtension.md) objects and their properties. The resulting list includes all the **customAccessPackageWorkflowExtension** objects for the catalog that the caller has access to read. Each object includes an `@odata.type` property that indicates whether the object is an  **accessPackageAssignmentRequestWorkflowExtension** or an **accessPackageAssignmentWorkflowExtension**.
+List the [accessPackageAssignmentRequestWorkflowExtension](../resources/accesspackageassignmentrequestworkflowextension.md) and [accessPackageAssignmentWorkflowExtension](../resources/accesspackageassignmentworkflowextension.md) objects in the **accessPackageCustomWorkflowExtensions** relationship of an [accessPackageCatalog](../resources/accesspackagecatalog.md). The resulting list includes all the **customAccessPackageWorkflowExtension** objects for the catalog that the caller has access to read. Each object includes an `@odata.type` property that indicates whether the object is an **accessPackageAssignmentRequestWorkflowExtension** or an **accessPackageAssignmentWorkflowExtension**.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/accesspackagecatalog-post-accesspackagecustomworkflowextensions.md

@@ -13,9 +13,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Create a new [accessPackageAssignmentRequestWorkflowExtension](../resources/accesspackageassignmentrequestworkflowextension.md) or [accessPackageAssignmentWorkflowExtension](../resources/accessPackageAssignmentWorkflowExtension.md) object and add it to an existing [accessPackageCatalog](../resources/accesspackagecatalog.md) object.  
-
-You must explicitly provide an `@odata.type` property that indicates whether the object is an  **accessPackageAssignmentRequestWorkflowExtension** or an **accessPackageAssignmentWorkflowExtension**.
+Create a new [accessPackageAssignmentRequestWorkflowExtension](../resources/accesspackageassignmentrequestworkflowextension.md) or [accessPackageAssignmentWorkflowExtension](../resources/accesspackageassignmentworkflowextension.md) object in the **accessPackageCustomWorkflowExtensions** relationship of an [accessPackageCatalog](../resources/accesspackagecatalog.md). You must explicitly provide an `@odata.type` property that indicates whether the object is an **accessPackageAssignmentRequestWorkflowExtension** or an **accessPackageAssignmentWorkflowExtension**.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/approvalstep-update.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Apply approve or deny decision on an [approvalStep](../resources/approvalStep.md) object.
+Apply an approve or deny decision on an [approvalStep](../resources/approvalstep.md) object.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/auditlogroot-list-customsecurityattributeaudits.md

@@ -13,7 +13,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Get the list of audit logs generated by activities related to custom security attribute management in Microsoft Entra ID.
+Get a list of [customSecurityAttributeAudit](../resources/customsecurityattributeaudit.md) objects representing audit logs generated by activities related to custom security attribute management in Microsoft Entra ID.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 
@@ -169,4 +169,3 @@ Content-Type: application/json
     }
 ]
 ```
-

api-reference/beta/api/connectedorganization-delete-externalsponsors.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Remove a user or a group from the connected organization's external sponsors. The external sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
+Remove a user or a group from the **externalSponsors** relationship of a [connectedOrganization](../resources/connectedorganization.md). External sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/connectedorganization-delete-internalsponsors.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Remove a user or a group from the connected organization's internal sponsors. The internal sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
+Remove a user or a group from the **internalSponsors** relationship of a [connectedOrganization](../resources/connectedorganization.md). Internal sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/connectedorganization-post-externalsponsors.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Add a user or a group to the connected organization's external sponsors. The external sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
+Add a user or a group to the **externalSponsors** relationship of a [connectedOrganization](../resources/connectedorganization.md). External sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/connectedorganization-post-internalsponsors.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Add a user or a group to the connected organization's internal sponsors. The internal sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
+Add a user or a group to the **internalSponsors** relationship of a [connectedOrganization](../resources/connectedorganization.md). Internal sponsors are a set of users who can approve requests on behalf of other users from that connected organization.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/customsecurityattributeaudit-get.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Get a specific audit log generated by activities related to custom security attribute management in Microsoft Entra ID.
+Get a specific [customSecurityAttributeAudit](../resources/customsecurityattributeaudit.md) object representing an audit log generated by activities related to custom security attribute management in Microsoft Entra ID.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 
@@ -167,4 +167,3 @@ Content-Type: application/json
    ]
 }
 ```
-

api-reference/beta/api/directoryaudit-get.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Get a specific Microsoft Entra audit log item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.
+Get a specific [directoryAudit](../resources/directoryaudit.md) item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-service and admin password resets), self-service group management, and so on.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/directoryaudit-list.md

@@ -14,7 +14,7 @@ Namespace: microsoft.graph
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-Get the list of audit logs generated by Microsoft Entra ID. This includes audit logs generated by various services within Microsoft Entra ID, including user, app, device and group Management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (SSPR and admin password resets), and self service group management.
+Get a list of [directoryAudit](../resources/directoryaudit.md) objects representing the audit logs generated by Microsoft Entra ID. This includes audit logs generated by various services within Microsoft Entra ID, including user, app, device and group Management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (SSPR and admin password resets), and self service group management.
 
 [!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
 

api-reference/beta/api/driveitem-lock.md

@@ -0,0 +1,194 @@
+---
+title: "driveItem: lock"
+description: "Acquire an exclusive lock on a drive item file, or extend an existing lock held by the calling user."
+author: "adwaitkumar"
+ms.author: "adwaitkumar"
+ms.localizationpriority: medium
+ms.subservice: "onedrive"
+doc_type: apiPageType
+ms.date: 05/14/2026
+---
+
+# driveItem: lock
+
+Namespace: microsoft.graph
+
+[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
+
+Acquire an exclusive lock on a file represented by a [driveItem](../resources/driveitem.md), or extend an existing lock you already hold. While the lock is held, other users are prevented from acquiring a lock on the same file. The lock automatically expires after the duration specified in the request elapses.
+
+> [!NOTE]
+> This API applies only to **driveItems** that represent files. Locks can't be applied to folders or other non-file **driveItems**. Requests that target a non-file **driveItem** are rejected with `400 Bad Request`.
+
+A single endpoint handles both initial acquisition and refresh. The server determines which behavior applies based on the file's current lock state and the caller's identity. The caller doesn't need to track whether they previously locked the file, and doesn't need to manage a lock identifier.
+
+Only exclusive locks are currently supported.
+
+
+## Permissions
+
+Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
+
+<!-- { "blockType": "permissions", "name": "driveitem_lock" } -->
+[!INCLUDE [permissions-table](../includes/permissions/driveitem-lock-permissions.md)]
+
+[!INCLUDE [app-permissions](../includes/sharepoint-embedded-app-driveitem-permissions.md)]
+
+## HTTP request
+
+<!-- {
+  "blockType": "ignored"
+}
+-->
+```http
+POST /drives/{drive-id}/items/{item-id}/lock
+```
+
+## Request headers
+
+|Name|Description|
+|:---|:---|
+|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
+|Content-Type|application/json. Required.|
+
+## Request body
+
+In the request body, supply a JSON representation of the lock parameters.
+
+|Property|Type|Required|Description|
+|:---|:---|:---|:---|
+|durationMinutes|Int32|Yes|Lock duration in minutes. Must be between 1 and 30 minutes. The lock expires at the request time plus this value.|
+
+The lock identifier and lock type are server-determined and must not be provided by the caller.
+
+## Response
+
+The server determines whether this request acquires a new lock or refreshes an existing one based on the file's current lock state and the caller's identity:
+
+|Current state|Caller identity|Action|
+|:---|:---|:---|
+|File isn't locked, or the existing lock expired.|Any caller with permission.|Acquire a new lock.|
+|File is locked, and the caller holds the lock.|Same caller as the lock owner.|Refresh the existing lock; **expirationDateTime** is updated.|
+|File is locked by another user.|Different caller.|Return `409 Conflict`. The caller can't acquire a lock until the existing lock is released or expires.|
+
+If successful, this method returns a `200 OK` response code and a [lockInfo](../resources/lockinfo.md) resource in the response body.
+
+This method returns the following error response codes.
+
+| HTTP code | Description |
+|:----------|:------------|
+| 400 | Bad request. The **durationMinutes** is missing, non-positive, or exceeds the 30-minute maximum. Also returned when the target **driveItem** isn't a file (for example, a folder). |
+| 401 | Request lacks valid authentication credentials. |
+| 403 | The caller doesn't have permission to lock this file. |
+| 404 | The **driveItem** wasn't found at the specified path. |
+| 409 | The file is locked by another user. The caller must wait for the existing lock to be released or expire before acquiring a new lock. |
+
+For more information about how errors are returned, see [Error responses and resource types for differences between Microsoft Graph for Microsoft accounts and Microsoft Graph for work or school accounts](/graph/errors).
+
+## Examples
+
+### Example 1: Acquire a lock on an unlocked file
+
+#### Request
+
+The following example shows a request.
+<!-- {
+  "blockType": "request",
+  "name": "driveItem_lock"
+}
+-->
+
+```http
+POST https://graph.microsoft.com/beta/drives/{drive-id}/items/{item-id}/lock
+Content-Type: application/json
+
+{
+  "durationMinutes": 30
+}
+```
+
+#### Response
+
+The following example shows the response.
+
+<!-- {
+  "blockType": "response",
+  "truncated": true,
+  "@odata.type": "microsoft.graph.lockInfo"
+}
+-->
+
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+  "lockType": "exclusive",
+  "expirationDateTime": "2026-05-13T14:30:00Z",
+  "createdDateTime": "2026-05-13T14:00:00Z"
+}
+```
+
+### Example 2: Refresh an existing lock the caller already holds
+
+The request body is identical to the acquire case; only the file's current state differs.
+
+#### Request
+
+The following example shows a request.
+<!-- {
+  "blockType": "request",
+  "name": "driveItem_lock_refresh"
+}
+-->
+
+```http
+POST https://graph.microsoft.com/beta/drives/{drive-id}/items/{item-id}/lock
+Content-Type: application/json
+
+{
+  "durationMinutes": 10
+}
+```
+
+#### Response
+
+The following example shows the response. The **expirationDateTime** is updated.
+
+<!-- {
+  "blockType": "response",
+  "truncated": true,
+  "@odata.type": "microsoft.graph.lockInfo"
+}
+-->
+
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+  "lockType": "exclusive",
+  "expirationDateTime": "2026-05-13T14:39:00Z",
+  "createdDateTime": "2026-05-13T14:00:00Z"
+}
+```
+
+## Remarks
+
+- Only exclusive locks are currently supported. The **lockType** in the response is always `exclusive`.
+- Lock duration is capped at 30 minutes per request. For longer holds, call this API again before the existing lock expires; the call is automatically handled as a refresh.
+- The new **expirationDateTime** is calculated as the request time plus **durationMinutes**; it replaces the prior expiration rather than extending it. Calling with a shorter duration than the time remaining effectively reduces the lock window.
+- The **createdDateTime** and **expirationDateTime** are returned in UTC.
+- This API is idempotent and retry-safe: if a network failure leaves the caller uncertain whether the lock succeeded, retrying naturally results in a refresh (if the first call succeeded) or a fresh acquire (if it didn't).
+
+<!--
+{
+  "type": "#page.annotation",
+  "description": "Acquire or refresh an exclusive lock on a file.",
+  "keywords": "lock,driveItem,file lock,exclusive lock",
+  "section": "documentation",
+  "tocPath": "Items/Lock",
+  "suppressions": [
+  ]
+}
+-->