Queries for the AADServicePrincipalRiskEvents table
Active service principal risk detections
Gets a list of active service principal risk detections.
AADServicePrincipalRiskEvents
| summarize arg_max(LastUpdatedDateTime, *) by RequestId, ServicePrincipalId
| where RiskState == "atRisk"
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for