diff --git a/schemas/2020-01-01/Microsoft.SecurityInsights.json b/schemas/2020-01-01/Microsoft.SecurityInsights.json
index 9cc1689a91..5cb2df2498 100644
--- a/schemas/2020-01-01/Microsoft.SecurityInsights.json
+++ b/schemas/2020-01-01/Microsoft.SecurityInsights.json
@@ -165,10 +165,10 @@
           "$ref": "#/definitions/MDATPDataConnector"
         },
         {
-          "$ref": "#/definitions/OfficeDataConnector"
+          "$ref": "#/definitions/TIDataConnector"
         },
         {
-          "$ref": "#/definitions/TIDataConnector"
+          "$ref": "#/definitions/OfficeDataConnector"
         }
       ],
       "properties": {
diff --git a/schemas/2021-04-01/Microsoft.SecurityInsights.json b/schemas/2021-04-01/Microsoft.SecurityInsights.json
index ce56290105..203a32122f 100644
--- a/schemas/2021-04-01/Microsoft.SecurityInsights.json
+++ b/schemas/2021-04-01/Microsoft.SecurityInsights.json
@@ -146,6 +146,102 @@
         "type"
       ],
       "description": "Microsoft.SecurityInsights/incidents/relations"
+    },
+    "watchlists": {
+      "type": "object",
+      "properties": {
+        "apiVersion": {
+          "type": "string",
+          "enum": [
+            "2021-04-01"
+          ]
+        },
+        "etag": {
+          "type": "string",
+          "description": "Etag of the azure resource"
+        },
+        "name": {
+          "type": "string",
+          "description": "The watchlist alias"
+        },
+        "properties": {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/WatchlistProperties"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "Describes watchlist properties"
+        },
+        "resources": {
+          "type": "array",
+          "items": {
+            "oneOf": [
+              {
+                "$ref": "#/definitions/watchlists_watchlistItems_childResource"
+              }
+            ]
+          }
+        },
+        "type": {
+          "type": "string",
+          "enum": [
+            "Microsoft.SecurityInsights/watchlists"
+          ]
+        }
+      },
+      "required": [
+        "apiVersion",
+        "name",
+        "properties",
+        "type"
+      ],
+      "description": "Microsoft.SecurityInsights/watchlists"
+    },
+    "watchlists_watchlistItems": {
+      "type": "object",
+      "properties": {
+        "apiVersion": {
+          "type": "string",
+          "enum": [
+            "2021-04-01"
+          ]
+        },
+        "etag": {
+          "type": "string",
+          "description": "Etag of the azure resource"
+        },
+        "name": {
+          "type": "string",
+          "description": "The watchlist item id (GUID)"
+        },
+        "properties": {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/WatchlistItemProperties"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "Describes watchlist item properties"
+        },
+        "type": {
+          "type": "string",
+          "enum": [
+            "Microsoft.SecurityInsights/watchlists/watchlistItems"
+          ]
+        }
+      },
+      "required": [
+        "apiVersion",
+        "name",
+        "properties",
+        "type"
+      ],
+      "description": "Microsoft.SecurityInsights/watchlists/watchlistItems"
     }
   },
   "definitions": {
@@ -428,6 +524,285 @@
         "relatedResourceId"
       ],
       "description": "Relation property bag."
+    },
+    "UserInfo": {
+      "type": "object",
+      "properties": {
+        "objectId": {
+          "oneOf": [
+            {
+              "type": "string",
+              "pattern": "^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "The object id of the user."
+        }
+      },
+      "description": "User information that made some action"
+    },
+    "WatchlistItemProperties": {
+      "type": "object",
+      "properties": {
+        "created": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The time the watchlist item was created"
+        },
+        "createdBy": {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/UserInfo"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "User information that made some action"
+        },
+        "entityMapping": {
+          "type": "object",
+          "properties": {},
+          "description": "key-value pairs for a watchlist item entity mapping"
+        },
+        "isDeleted": {
+          "oneOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "A flag that indicates if the watchlist item is deleted or not"
+        },
+        "itemsKeyValue": {
+          "type": "object",
+          "properties": {},
+          "description": "key-value pairs for a watchlist item"
+        },
+        "tenantId": {
+          "type": "string",
+          "description": "The tenantId to which the watchlist item belongs to"
+        },
+        "updated": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The last time the watchlist item was updated"
+        },
+        "updatedBy": {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/UserInfo"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "User information that made some action"
+        },
+        "watchlistItemId": {
+          "type": "string",
+          "description": "The id (a Guid) of the watchlist item"
+        },
+        "watchlistItemType": {
+          "type": "string",
+          "description": "The type of the watchlist item"
+        }
+      },
+      "required": [
+        "itemsKeyValue"
+      ],
+      "description": "Describes watchlist item properties"
+    },
+    "WatchlistProperties": {
+      "type": "object",
+      "properties": {
+        "contentType": {
+          "type": "string",
+          "description": "The content type of the raw content. For now, only text/csv is valid"
+        },
+        "created": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The time the watchlist was created"
+        },
+        "createdBy": {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/UserInfo"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "User information that made some action"
+        },
+        "defaultDuration": {
+          "type": "string",
+          "format": "duration",
+          "description": "The default duration of a watchlist (in ISO 8601 duration format)"
+        },
+        "description": {
+          "type": "string",
+          "description": "A description of the watchlist"
+        },
+        "displayName": {
+          "type": "string",
+          "description": "The display name of the watchlist"
+        },
+        "isDeleted": {
+          "oneOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "A flag that indicates if the watchlist is deleted or not"
+        },
+        "itemsSearchKey": {
+          "type": "string",
+          "description": "The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address."
+        },
+        "labels": {
+          "oneOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "List of labels relevant to this watchlist"
+        },
+        "numberOfLinesToSkip": {
+          "oneOf": [
+            {
+              "type": "integer"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "The number of lines in a csv content to skip before the header"
+        },
+        "provider": {
+          "type": "string",
+          "description": "The provider of the watchlist"
+        },
+        "rawContent": {
+          "type": "string",
+          "description": "The raw content that represents to watchlist items to create. Example : This line will be skipped\nheader1,header2\nvalue1,value2"
+        },
+        "source": {
+          "oneOf": [
+            {
+              "type": "string",
+              "enum": [
+                "Local file",
+                "Remote storage"
+              ]
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "The source of the watchlist."
+        },
+        "tenantId": {
+          "type": "string",
+          "description": "The tenantId where the watchlist belongs to"
+        },
+        "updated": {
+          "type": "string",
+          "format": "date-time",
+          "description": "The last time the watchlist was updated"
+        },
+        "updatedBy": {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/UserInfo"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "User information that made some action"
+        },
+        "uploadStatus": {
+          "type": "string",
+          "description": "The status of the Watchlist upload : New, InProgress or Complete. **Note** : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted"
+        },
+        "watchlistAlias": {
+          "type": "string",
+          "description": "The alias of the watchlist"
+        },
+        "watchlistId": {
+          "type": "string",
+          "description": "The id (a Guid) of the watchlist"
+        },
+        "watchlistType": {
+          "type": "string",
+          "description": "The type of the watchlist"
+        }
+      },
+      "required": [
+        "displayName",
+        "itemsSearchKey",
+        "provider",
+        "source"
+      ],
+      "description": "Describes watchlist properties"
+    },
+    "watchlists_watchlistItems_childResource": {
+      "type": "object",
+      "properties": {
+        "apiVersion": {
+          "type": "string",
+          "enum": [
+            "2021-04-01"
+          ]
+        },
+        "etag": {
+          "type": "string",
+          "description": "Etag of the azure resource"
+        },
+        "name": {
+          "type": "string",
+          "description": "The watchlist item id (GUID)"
+        },
+        "properties": {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/WatchlistItemProperties"
+            },
+            {
+              "$ref": "https://schema.management.azure.com/schemas/common/definitions.json#/definitions/expression"
+            }
+          ],
+          "description": "Describes watchlist item properties"
+        },
+        "type": {
+          "type": "string",
+          "enum": [
+            "watchlistItems"
+          ]
+        }
+      },
+      "required": [
+        "apiVersion",
+        "name",
+        "properties",
+        "type"
+      ],
+      "description": "Microsoft.SecurityInsights/watchlists/watchlistItems"
     }
   }
 }
\ No newline at end of file