IdentityRiskyAgent.Read.All

Allows the app to read risky agents information in your organization, on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the IdentityRiskyAgent.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	4aadfb66-d49a-414a-a883-d8c240b6fa33	3215c57f-3faa-4295-95c2-6f14a5bc6124
DisplayText	Read all risky agents information	Read risky agents information
Description	Allows the app to read the risky agents information in your organization without a signed-in user.	Allows the app to read risky agents information in your organization, on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

• API [v1.0]
• API [beta]
• PowerShell [v1.0]
• PowerShell [beta]

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

• riskyAgent
• riskyAgentIdentity
• riskyAgentIdentityBlueprintPrincipal
• riskyAgentUser

Graph reference: riskyAgent

Property	Type	Description
agentDisplayName	String	Name of the agent. Supports $filter (eq, startsWith).
id	String	The object id of the riskyAgentIdentity, riskyAgentIdentityBlueprintPrincipal or riskyAgentUser. Inherited from entity. Supports $filter (eq, startsWith).
isDeleted	Boolean	Indicates whether the agent is deleted.
isEnabled	Boolean	Indicates whether the agent is enabled.
isProcessing	Boolean	Indicates whether an agent's risky state is processing in the backend.
riskDetail	riskDetail	Details of the detected risk of the agent. The possible values are: none, adminConfirmedAgentSafe, adminConfirmedAgentCompromised, adminDismissedRiskForAgent. Supports $filter (eq).
riskLastModifiedDateTime	DateTimeOffset	The date and time that the risky agent was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, le, and ge).
riskLevel	riskLevel	Level of the detected risky agent. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Supports $filter (eq).
riskState	riskState	State of the agent's risk. The possible values are: none, confirmedSafe, dismissed, atRisk, confirmedCompromised, unknownFutureValue. Supports $filter (eq).