Show / Hide Table of Contents

IdentityRiskyUser.ReadWrite.All

Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users.

Graph Methods

Type: A = Application Permission, D = Delegate Permission

Ver Type Method
V1 A,D GET /identityProtection/riskyUsers/{id}/history/
V1 A,D GET /identityProtection/riskyUsers/{userId}/history
V1 A,D GET /identityProtection/riskyUsers/{userid}/history/{id}
V1 A,D GET /riskyUsers/{id}/history
V1 A,D GET /riskyUsers/{userid}/history/{id}
V1 D POST /auditLogs/signIns/confirmCompromised
V1 D POST /auditLogs/signIns/confirmSafe
V1 A,D POST /identityProtection/riskyUsers/confirmCompromised
V1 A,D POST /identityProtection/riskyUsers/dismiss
V1 A,D POST /riskyUsers/confirmCompromised
V1 A,D POST /riskyUsers/dismiss

Delegate Permission

Id e0a7cdbb-08b0-4697-8264-0069786e9674
Consent Type Admin
Display String Read and write risky user information
Description Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users.

Application Permission

Id 656f6061-f9fe-4807-9708-6a2e0934df76
Display String Read and write all risky user information
Description Allows the app to read and update identity risky user information for your organization without a signed-in user.  Update operations include dismissing risky users.

Resources

riskyUser

Property Type Description
id String Unique ID of the user at risk.
isDeleted Boolean Indicates whether the user is deleted. Possible values are: true, false.
isProcessing Boolean Indicates whether a user's risky state is being processed by the backend.
riskDetail riskDetail Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.
riskLastUpdatedDateTime DateTimeOffset The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
riskLevel riskLevel Level of the detected risky user. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState riskState State of the user's risk. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName String Risky user display name.
userPrincipalName String Risky user principal name.

riskyUserHistoryItem

Property Type Description
activity riskUserActivity The activity related to user risk level change.
id String The unique identifier for the riskyUserHistoryItem object. Inherited from entity.
initiatedBy String The ID of actor that does the operation.
isDeleted Boolean Indicates whether the user is deleted. Inherited from riskyUser.
isProcessing Boolean Indicates whether a user's risky state is being processed by the backend. Inherited from riskyUser.
riskDetail riskDetail Details of the detected risk. Inherited from riskyUser. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.
riskLastUpdatedDateTime DateTimeOffset The date and time when the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from riskyUser.
riskLevel riskLevel Level of the detected risky user. Inherited from riskyUser. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState riskState State of the user's risk. Inherited from riskyUser. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName String Risky user display name. Inherited from riskyUser.
userId String The ID of the user.
userPrincipalName String Risky user principal name. Inherited from riskyUser.
In This Article
Back to top Created by merill | Submit feedback