riskDetail enum type

Namespace: microsoft.graph

Represents the reason behind a specific state of a risky user, sign-in, or service principal. This enumeration is used by multiple resources.

The following table lists the members of an [evolvable enumeration](/graph/best-practices-concept#handling-future-members-in-evolvable-enumerations). Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: m365DAdminDismissedDetection, adminConfirmedServicePrincipalCompromised, adminDismissedAllRiskForServicePrincipal, userChangedPasswordOnPremises, adminDismissedRiskForSignIn, adminConfirmedAccountSafe.

Members

Member	Description
none	No details are available for the risk state. Applies to: riskDetection riskServicePrincipalActivity riskUserActivity riskyServicePrincipal riskyUser servicePrincipalRiskDetection signIn
adminGeneratedTemporaryPassword	An admin generated a temporary password for the user. Applies to: riskDetection riskUserActivity riskyUser signIn
userPerformedSecuredPasswordChange	The user performed a secure password change. Applies to: riskDetection riskUserActivity riskyUser signIn
userPerformedSecuredPasswordReset	The user performed a secure password reset. Applies to: riskDetection riskUserActivity riskyUser signIn
adminConfirmedSigninSafe	An admin confirmed the sign-in as safe. Applies to: riskDetection riskUserActivity riskyUser signIn
aiConfirmedSigninSafe	AI confirmed the sign-in as safe. Applies to: riskDetection riskUserActivity riskyUser signIn
userPassedMFADrivenByRiskBasedPolicy	The user passed multifactor authentication (MFA) driven by a risk-based policy. Applies to: riskDetection riskUserActivity riskyUser signIn
adminDismissedAllRiskForUser	An admin dismissed all risk for the user. Applies to: riskDetection riskUserActivity riskyUser signIn
adminConfirmedSigninCompromised	An admin confirmed the sign-in as compromised. Applies to: riskDetection riskUserActivity riskyUser signIn
hidden	The risk state is hidden. Applies to: riskDetection riskServicePrincipalActivity riskUserActivity riskyServicePrincipal riskyUser servicePrincipalRiskDetection signIn
adminConfirmedUserCompromised	An admin confirmed the user as compromised. Applies to: riskDetection riskUserActivity riskyUser signIn
unknownFutureValue	Evolvable enumeration sentinel value. Don't use. Applies to: riskDetection riskServicePrincipalActivity riskUserActivity riskyServicePrincipal riskyUser servicePrincipalRiskDetection signIn
m365DAdminDismissedDetection	A Microsoft Defender XDR admin dismissed the detection. Applies to: riskDetection riskyUser signIn
adminConfirmedServicePrincipalCompromised	An admin confirmed the service principal as compromised. Applies to: riskDetection riskServicePrincipalActivity riskyServicePrincipal riskyUser servicePrincipalRiskDetection signIn
adminDismissedAllRiskForServicePrincipal	An admin dismissed all risk for the service principal. Applies to: riskDetection riskServicePrincipalActivity riskyServicePrincipal riskyUser servicePrincipalRiskDetection signIn
userChangedPasswordOnPremises	The user changed their password on-premises. Applies to: riskyUser signIn
adminDismissedRiskForSignIn	An admin dismissed the risk for the sign-in. Applies to: riskyUser signIn
adminConfirmedAccountSafe	An admin confirmed the account as safe. Applies to: riskyUser signIn

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.riskDetail"
}