Edit

riskyUserHistoryItem resource type

  • Article

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents the risk history of a Microsoft Entra user as determined by Microsoft Entra ID Protection.

Inherits from riskyUser.

Note

  1. Using this API requires a Microsoft Entra ID P2 license.
  2. The availability of risk history data is governed by the Microsoft Entra data retention policies.

Methods

Method Return Type Description
List history riskyUserHistoryItem collection Get the risk history of a Microsoft Entra user.

Properties

Property Type Description
activity riskUserActivity The activity related to user risk level change.
id String The unique identifier for the riskyUserHistoryItem object. Inherited from entity.
initiatedBy String The ID of actor that does the operation.
isDeleted Boolean Indicates whether the user is deleted. Inherited from riskyUser.
isProcessing Boolean Indicates whether a user's risky state is being processed by the backend. Inherited from riskyUser.
riskDetail riskDetail Details of the detected risk. Inherited from riskyUser. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.
riskLastUpdatedDateTime DateTimeOffset The date and time when the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from riskyUser.
riskLevel riskLevel Level of the detected risky user. Inherited from riskyUser. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState riskState State of the user's risk. Inherited from riskyUser. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName String Risky user display name. Inherited from riskyUser.
userId String The ID of the user.
userPrincipalName String Risky user principal name. Inherited from riskyUser.

Relationships

Relationship Type Description
history riskyUserHistoryItem collection The activity related to user risk level change. Inherited from riskyUser.

JSON representation

The following is a JSON representation of the resource.

{
    "userId": "string",
    "initiatedBy": "string",
    "activity": {"@odata.type": "microsoft.graph.riskUserActivity"}
}