Skip to main content

risky_service_principals

Creates, updates, deletes, gets or lists a risky_service_principals resource.

Overview​

Namerisky_service_principals
TypeResource
Identra_id.identity_protection.risky_service_principals

Fields​

The following fields are returned by SELECT queries:

Retrieved navigation property

NameDatatypeDescription
idstringThe unique identifier for an entity. Read-only.
appIdstringThe globally unique identifier for the associated application (its appId property), if any.
displayNamestringThe display name for the service principal.
historyarrayRepresents the risk history of Microsoft Entra service principals.
isEnabledbooleantrue if the service principal account is enabled; otherwise, false.
isProcessingbooleanIndicates whether Microsoft Entra ID is currently processing the service principal's risky state.
riskDetailDetails of the detected risk. Note: Details for this property are only available for Workload Identities Premium customers. Events in tenants without this license will be returned hidden.
riskLastUpdatedDateTimestring (date-time)The date and time that the risk state was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2021 is 2021-01-01T00:00:00Z. Supports $filter (eq). (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
riskLevelLevel of the detected risky workload identity. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Supports $filter (eq).
riskStateState of the service principal's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
servicePrincipalTypestringIdentifies whether the service principal represents an Application, a ManagedIdentity, or a legacy application (socialIdp). This is set by Microsoft Entra ID internally and is inherited from servicePrincipal.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectrisky_service_principal_idRead the properties and relationships of a riskyServicePrincipal object.
listselectRetrieve the properties and relationships of riskyServicePrincipal objects.
insertinsert
updateupdaterisky_service_principal_id
deletedeleterisky_service_principal_idIf-Match
confirm_compromisedexecConfirm one or more riskyServicePrincipal objects as compromised. This action sets the targeted service principal account's risk level to high.
dismissexecDismiss the risk of one or more riskyServicePrincipal objects. This action sets the targeted service principal account's risk level to none. You can dismiss up to 60 service principal accounts in one request.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
risky_service_principal_idstringThe unique identifier of riskyServicePrincipal
If-MatchstringETag

SELECT examples​

Read the properties and relationships of a riskyServicePrincipal object.

SELECT
id,
appId,
displayName,
history,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType
FROM entra_id.identity_protection.risky_service_principals
WHERE risky_service_principal_id = '{{ risky_service_principal_id }}' -- required
;

INSERT examples​

No description available.

INSERT INTO entra_id.identity_protection.risky_service_principals (
id,
appId,
displayName,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType,
history
)
SELECT 
'{{ id }}',
'{{ appId }}',
'{{ displayName }}',
{{ isEnabled }},
{{ isProcessing }},
'{{ riskDetail }}',
'{{ riskLastUpdatedDateTime }}',
'{{ riskLevel }}',
'{{ riskState }}',
'{{ servicePrincipalType }}',
'{{ history }}'
RETURNING
id,
appId,
displayName,
history,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType
;

UPDATE examples​

No description available.

UPDATE entra_id.identity_protection.risky_service_principals
SET 
id = '{{ id }}',
appId = '{{ appId }}',
displayName = '{{ displayName }}',
isEnabled = {{ isEnabled }},
isProcessing = {{ isProcessing }},
riskDetail = '{{ riskDetail }}',
riskLastUpdatedDateTime = '{{ riskLastUpdatedDateTime }}',
riskLevel = '{{ riskLevel }}',
riskState = '{{ riskState }}',
servicePrincipalType = '{{ servicePrincipalType }}',
history = '{{ history }}'
WHERE 
risky_service_principal_id = '{{ risky_service_principal_id }}' --required
RETURNING
id,
appId,
displayName,
history,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType;

DELETE examples​

No description available.

DELETE FROM entra_id.identity_protection.risky_service_principals
WHERE risky_service_principal_id = '{{ risky_service_principal_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Lifecycle Methods​

Confirm one or more riskyServicePrincipal objects as compromised. This action sets the targeted service principal account's risk level to high.

EXEC entra_id.identity_protection.risky_service_principals.confirm_compromised 
@@json=
'{
"servicePrincipalIds": "{{ servicePrincipalIds }}"
}'
;