How to Dismiss stale Risky user

Question

How to Dismiss stale Risky user

Dale Goff 20

We have multiple Risky users that were not remediated timely and now unable to remediate or remove from the Risky users list. The users are identified as Risky users, medium and high, but the risky signins and detections are no longer visible. Attempted to Dismiss user risk and Confirm user safe but to no effect. Is there a way to force remove risky status?

Thanks,

Rukmini 43,905 Reputation points Microsoft External Staff Moderator

2025-12-18T21:42:08.64+00:00
Hey Dale Goff, it sounds like you're facing an issue with stale Risky users that you can't seem to remove from the list, even after trying to dismiss their risk. Here’s what you can do:

Manual Dismissal: Since you mentioned that the risky sign-ins and detections are no longer visible but you still want to dismiss the users, you can manually dismiss the risk. Navigate to the Microsoft Entra Risky users report, select the impacted user, and click on the Dismiss user risk option. Keep in mind that this may take a few minutes to update.

PowerShell Bulk Dismiss: If there are multiple users you need to dismiss, consider using the Microsoft Graph PowerShell SDK. You can bulk dismiss risky users by using the Invoke-AzureADIPDismissRiskyUser.ps1 script found in the Microsoft Entra GitHub repo. This allows you to programmatically dismiss users all at once.

Check Known Issues: Sometimes, there might be known issues that prevent the dismissal. Make sure to check the dismiss user risk known issues documentation to see if there are any relevant developments impacting your situation.

Confirm Compromised Status: If you believe some users were compromised, you can attempt to reset their password or confirm that they are compromised to help remediate their status.

If these steps don’t resolve the issue, you might want to consider contacting Microsoft Support for further assistance.

Follow-Up Questions

To assist you better, could you provide the following details?

Have you confirmed if there are any users affected by known issues when trying to dismiss risk?

Are there any specific error messages you see when trying to dismiss the users?

How many users are you currently trying to dismiss from the Risky users list?

Are you utilizing any specific policies or settings in Microsoft Entra that might affect risk management?

Hope this helps you out! Let me know if you have any more questions.
Dale Goff 20 Reputation points

2025-12-18T21:47:19.7733333+00:00

I've attempted manual dismissal - 'Dismiss user risk' and 'Confirm user safe' have no effect. The associated Risky activity has aged out and is no longer visible in any portal.

2 answers

Your answer

Dale Goff 20 Reputation points

2025-12-18T21:47:19.7733333+00:00

I've attempted manual dismissal - 'Dismiss user risk' and 'Confirm user safe' have no effect. The associated Risky activity has aged out and is no longer visible in any portal.

Answer 1

Dale Goff 20

This is resolved now. The users no longer appear as risky users after Dismissing and waiting.

0 comments

Answer 2

Dale Goff 20

The stale entries are no longer appearing in the list about 3 days after Dismissing risk. It seems to be a matter of patience in some cases.

0 comments

How to Dismiss stale Risky user

Follow-Up Questions

2 answers

Your answer