Customize "Users at risk detected" email

Question

I'm sending these "User at risk detected" alerts in Azure to Servicenow, where I have an inbound action to automatically open incidents. Unfortunately, they are all identical and just have a link to the azure queue. I'm looking for a way to customize the email to include "user" in the subject. Does anyone know if there is a way to do that?

Thanks

Answer 1

Hello @John Hirst , in order to include user information in a custom email you can query the directory using MS Graph List riskDetections operation. You will get useful information such as the user id (userId), displayName (userDisplayName) and upn (userDisplayName), which may match his email. You can use the user Id to get more information (Eg. mail, phone, etc) about a user using the MS Graph Get a user operation. Keep in mind delta queries are not yet supported for the List riskDetections operation so you may want to store the latest risk detection timestamp (activityDateTime) in order to use it as a filter for your next query.

Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it so that others in the community with similar questions can more easily find a solution.