Show / Hide Table of Contents

IdentityRiskyUser.ReadWrite.All

Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users.

Graph Methods

Type: A = Application Permission, D = Delegate Permission

Ver	Type	Method
V1	A,D	GET /identityProtection/riskyUsers/{id}/history/
V1	A,D	GET /identityProtection/riskyUsers/{userId}/history
V1	A,D	GET /identityProtection/riskyUsers/{userid}/history/{id}
V1	A,D	GET /riskyUsers/{id}/history
V1	A,D	GET /riskyUsers/{userid}/history/{id}
V1	D	POST /auditLogs/signIns/confirmCompromised
V1	D	POST /auditLogs/signIns/confirmSafe
V1	A,D	POST /identityProtection/riskyUsers/confirmCompromised
V1	A,D	POST /identityProtection/riskyUsers/dismiss
V1	A,D	POST /riskyUsers/confirmCompromised
V1	A,D	POST /riskyUsers/dismiss

Delegate Permission


Id	e0a7cdbb-08b0-4697-8264-0069786e9674
Consent Type	Admin
Display String	Read and write risky user information
Description	Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users.

Application Permission


Id	656f6061-f9fe-4807-9708-6a2e0934df76
Display String	Read and write all risky user information
Description	Allows the app to read and update identity risky user information for your organization without a signed-in user. Update operations include dismissing risky users.

Resources

riskyUser

Property	Type	Description
id	String	Unique ID of the user at risk.
isDeleted	Boolean	Indicates whether the user is deleted. Possible values are: `true`, `false`.
isProcessing	Boolean	Indicates whether a user's risky state is being processed by the backend.
riskDetail	riskDetail	Details of the detected risk. Possible values are: `none`, `adminGeneratedTemporaryPassword`, `userPerformedSecuredPasswordChange`, `userPerformedSecuredPasswordReset`, `adminConfirmedSigninSafe`, `aiConfirmedSigninSafe`, `userPassedMFADrivenByRiskBasedPolicy`, `adminDismissedAllRiskForUser`, `adminConfirmedSigninCompromised`, `hidden`, `adminConfirmedUserCompromised`, `unknownFutureValue`.
riskLastUpdatedDateTime	DateTimeOffset	The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
riskLevel	riskLevel	Level of the detected risky user. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
riskState	riskState	State of the user's risk. Possible values are: `none`, `confirmedSafe`, `remediated`, `dismissed`, `atRisk`, `confirmedCompromised`, `unknownFutureValue`.
userDisplayName	String	Risky user display name.
userPrincipalName	String	Risky user principal name.

riskyUserHistoryItem

Property	Type	Description
activity	riskUserActivity	The activity related to user risk level change.
id	String	The unique identifier for the riskyUserHistoryItem object. Inherited from entity.
initiatedBy	String	The ID of actor that does the operation.
isDeleted	Boolean	Indicates whether the user is deleted. Inherited from riskyUser.
isProcessing	Boolean	Indicates whether a user's risky state is being processed by the backend. Inherited from riskyUser.
riskDetail	riskDetail	Details of the detected risk. Inherited from riskyUser. Possible values are: `none`, `adminGeneratedTemporaryPassword`, `userPerformedSecuredPasswordChange`, `userPerformedSecuredPasswordReset`, `adminConfirmedSigninSafe`, `aiConfirmedSigninSafe`, `userPassedMFADrivenByRiskBasedPolicy`, `adminDismissedAllRiskForUser`, `adminConfirmedSigninCompromised`, `hidden`, `adminConfirmedUserCompromised`, `unknownFutureValue`.
riskLastUpdatedDateTime	DateTimeOffset	The date and time when the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Inherited from riskyUser.
riskLevel	riskLevel	Level of the detected risky user. Inherited from riskyUser. Possible values are: `low`, `medium`, `high`, `hidden`, `none`, `unknownFutureValue`.
riskState	riskState	State of the user's risk. Inherited from riskyUser. Possible values are: `none`, `confirmedSafe`, `remediated`, `dismissed`, `atRisk`, `confirmedCompromised`, `unknownFutureValue`.
userDisplayName	String	Risky user display name. Inherited from riskyUser.
userId	String	The ID of the user.
userPrincipalName	String	Risky user principal name. Inherited from riskyUser.