Edit

riskServicePrincipalActivity resource type

  • Article

Namespace: microsoft.graph

Represents the risk activity of a Microsoft Entra service principal as determined by Microsoft Entra ID Protection.

Properties

Property Type Description
detail riskDetail Details of the detected risk.
Note: Details for this property are only available for Workload Identities Premium customers. Events in tenants without this license will be returned hidden.
The possible values are: none, hidden, adminConfirmedServicePrincipalCompromised, adminDismissedAllRiskForServicePrincipal. Note that you must use the Prefer: include-unknown-enum-members request header to get the following value(s) in this evolvable enum: adminConfirmedServicePrincipalCompromised , adminDismissedAllRiskForServicePrincipal.
riskEventType String collection The type of risk event detected. The possible values are: investigationsThreatIntelligence, generic, adminConfirmedServicePrincipalCompromised, suspiciousSignins, leakedCredentials, anomalousServicePrincipalActivity, maliciousApplication, suspiciousApplication.

JSON representation

{
    "riskEventTypes": ["String"],
    "detail": "String"
}