riskyUserHistoryItem resource type
Namespace: microsoft.graph
Represents the risk history of an Azure Active Directory (Azure AD) user as determined by Azure AD Identity Protection.
Inherits from riskyUser.
Note
- Using this API requires an Azure AD Premium P2 license.
- The availability of risk history data is governed by the Azure AD data retention policies.
Methods
Method | Return type | Description |
---|---|---|
List history | riskyUserHistoryItem collection | Get the riskyUserHistoryItems from the history navigation property. |
Get history | riskyUserHistoryItem | Read the properties and relationships of a riskyUserHistoryItem object. |
Properties
Property | Type | Description |
---|---|---|
activity | riskUserActivity | The activity related to user risk level change. |
id | String | The unique identifier for the riskyUserHistoryItem object. Inherited from entity. |
initiatedBy | String | The ID of actor that does the operation. |
isDeleted | Boolean | Indicates whether the user is deleted. Inherited from riskyUser. |
isProcessing | Boolean | Indicates whether a user's risky state is being processed by the backend. Inherited from riskyUser. |
riskDetail | riskDetail | Details of the detected risk. Inherited from riskyUser. Possible values are: none , adminGeneratedTemporaryPassword , userPerformedSecuredPasswordChange , userPerformedSecuredPasswordReset , adminConfirmedSigninSafe , aiConfirmedSigninSafe , userPassedMFADrivenByRiskBasedPolicy , adminDismissedAllRiskForUser , adminConfirmedSigninCompromised , hidden , adminConfirmedUserCompromised , unknownFutureValue . |
riskLastUpdatedDateTime | DateTimeOffset | The date and time when the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z . Inherited from riskyUser. |
riskLevel | riskLevel | Level of the detected risky user. Inherited from riskyUser. Possible values are: low , medium , high , hidden , none , unknownFutureValue . |
riskState | riskState | State of the user's risk. Inherited from riskyUser. Possible values are: none , confirmedSafe , remediated , dismissed , atRisk , confirmedCompromised , unknownFutureValue . |
userDisplayName | String | Risky user display name. Inherited from riskyUser. |
userId | String | The ID of the user. |
userPrincipalName | String | Risky user principal name. Inherited from riskyUser. |
Relationships
Relationship | Type | Description |
---|---|---|
history | riskyUserHistoryItem collection | The activity related to user risk level change. Inherited from riskyUser. |
JSON representation
The following is a JSON representation of the resource.
{
"@odata.type": "#microsoft.graph.riskyUserHistoryItem",
"id": "String (identifier)",
"isDeleted": "Boolean",
"isProcessing": "Boolean",
"riskLastUpdatedDateTime": "String (timestamp)",
"riskLevel": "String",
"riskState": "String",
"riskDetail": "String",
"userDisplayName": "String",
"userPrincipalName": "String",
"userId": "String",
"initiatedBy": "String",
"activity": {
"@odata.type": "microsoft.graph.riskUserActivity"
}
}
Feedback
Submit and view feedback for