riskyUser resource type
Namespace: microsoft.graph
Important
APIs under the /beta
version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Represents Azure AD users who are at risk. Azure AD continually evaluates user risk based on various signals and machine learning. This API provides programmatic access to all at-risk users in your Azure AD.
For more information about risk events, see Azure Active Directory Identity Protection.
Note
- Using the riskyUsers API requires an Azure AD Premium P2 license.
- The availability of risky user data is governed by the Azure AD data retention policies.
Methods
Method | Return Type | Description |
---|---|---|
List riskyUsers | riskyUser collection | List risky users and their properties. |
Get riskyUser | riskyUser | Get a specific risky user and its properties. |
List history | riskyUserHistoryItem collection | Get the risk history of an Azure AD user. |
Confirm riskyUsers compromised | None | Confirm a risky user as compromised. |
Dismiss riskyUsers | None | Dismiss the risk of a risky user. |
Properties
Property | Type | Description |
---|---|---|
id | string | Unique ID of the user at risk. |
isDeleted | boolean | Indicates whether the user is deleted. Possible values are: true , false . |
isProcessing | boolean | Indicates whether a user's risky state is being processed by the backend. |
riskLastUpdatedDateTime | DateTimeOffset | The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . |
riskLevel | riskLevel | Level of the detected risky user. The possible values are low , medium , high , hidden , none , unknownFutureValue . |
riskState | riskState | State of the user's risk. Possible values are: none , confirmedSafe , remediated , dismissed , atRisk , confirmedCompromised , unknownFutureValue . |
riskDetail | riskDetail | The possible values are none , adminGeneratedTemporaryPassword , userPerformedSecuredPasswordChange , userPerformedSecuredPasswordReset , adminConfirmedSigninSafe , aiConfirmedSigninSafe , userPassedMFADrivenByRiskBasedPolicy , adminDismissedAllRiskForUser , adminConfirmedSigninCompromised , hidden , adminConfirmedUserCompromised , unknownFutureValue . |
userDisplayName | string | Risky user display name. |
userPrincipalName | string | Risky user principal name. |
Relationships
None.
JSON representation
The following is a JSON representation of the resource.
{
"id": "string",
"riskLastUpdatedDateTime": "dateTimeOffset",
"isProcessing": "boolean",
"isDeleted": "boolean",
"riskDetail": "string",
"riskLevel": "string",
"riskState": "string",
"userDisplayName": "string",
"userPrincipalName": "string"
}
Feedback
Submit and view feedback for