risky_service_principals_history

Creates, updates, deletes, gets or lists a risky_service_principals_history resource.

Overview

Name	`risky_service_principals_history`
Type	Resource
Id	`entra_id.identity_protection.risky_service_principals_history`

Fields

The following fields are returned by SELECT queries:

get
list

Retrieved navigation property

Name	Datatype	Description
`id`	`string`	The unique identifier for an entity. Read-only.
`activity`		The activity related to service principal risk level change.
`appId`	`string`	The globally unique identifier for the associated application (its appId property), if any.
`displayName`	`string`	The display name for the service principal.
`history`	`array`	Represents the risk history of Microsoft Entra service principals.
`initiatedBy`	`string`	The identifier of the actor of the operation.
`isEnabled`	`boolean`	true if the service principal account is enabled; otherwise, false.
`isProcessing`	`boolean`	Indicates whether Microsoft Entra ID is currently processing the service principal's risky state.
`riskDetail`		Details of the detected risk. Note: Details for this property are only available for Workload Identities Premium customers. Events in tenants without this license will be returned hidden.
`riskLastUpdatedDateTime`	`string (date-time)`	The date and time that the risk state was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2021 is 2021-01-01T00:00:00Z. Supports $filter (eq). (pattern: `^[0-9]{4,}-(0[1-9]\|1[012])-(0[1-9]\|[12][0-9]\|3[01])T([01][0-9]\|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z\|[+-][0-9][0-9]:[0-9][0-9])$`)
`riskLevel`		Level of the detected risky workload identity. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Supports $filter (eq).
`riskState`		State of the service principal's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
`servicePrincipalType`	`string`	Identifies whether the service principal represents an Application, a ManagedIdentity, or a legacy application (socialIdp). This is set by Microsoft Entra ID internally and is inherited from servicePrincipal.

Retrieved collection

Name	Datatype	Description
`id`	`string`	The unique identifier for an entity. Read-only.
`activity`		The activity related to service principal risk level change.
`appId`	`string`	The globally unique identifier for the associated application (its appId property), if any.
`displayName`	`string`	The display name for the service principal.
`history`	`array`	Represents the risk history of Microsoft Entra service principals.
`initiatedBy`	`string`	The identifier of the actor of the operation.
`isEnabled`	`boolean`	true if the service principal account is enabled; otherwise, false.
`isProcessing`	`boolean`	Indicates whether Microsoft Entra ID is currently processing the service principal's risky state.
`riskDetail`		Details of the detected risk. Note: Details for this property are only available for Workload Identities Premium customers. Events in tenants without this license will be returned hidden.
`riskLastUpdatedDateTime`	`string (date-time)`	The date and time that the risk state was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2021 is 2021-01-01T00:00:00Z. Supports $filter (eq). (pattern: `^[0-9]{4,}-(0[1-9]\|1[012])-(0[1-9]\|[12][0-9]\|3[01])T([01][0-9]\|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z\|[+-][0-9][0-9]:[0-9][0-9])$`)
`riskLevel`		Level of the detected risky workload identity. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Supports $filter (eq).
`riskState`		State of the service principal's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
`servicePrincipalType`	`string`	Identifies whether the service principal represents an Application, a ManagedIdentity, or a legacy application (socialIdp). This is set by Microsoft Entra ID internally and is inherited from servicePrincipal.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get`	`select`	`risky_service_principal_id`, `risky_service_principal_history_item_id`		Represents the risk history of Microsoft Entra service principals.
`list`	`select`	`risky_service_principal_id`		Get the risk history of a riskyServicePrincipal object.
`insert`	`insert`	`risky_service_principal_id`
`update`	`update`	`risky_service_principal_id`, `risky_service_principal_history_item_id`
`delete`	`delete`	`risky_service_principal_id`, `risky_service_principal_history_item_id`	`If-Match`

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`risky_service_principal_history_item_id`	`string`	The unique identifier of riskyServicePrincipalHistoryItem
`risky_service_principal_id`	`string`	The unique identifier of riskyServicePrincipal
`If-Match`	`string`	ETag

`SELECT` examples

get
list

Represents the risk history of Microsoft Entra service principals.

SELECT
id,
activity,
appId,
displayName,
history,
initiatedBy,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType
FROM entra_id.identity_protection.risky_service_principals_history
WHERE risky_service_principal_id = '{{ risky_service_principal_id }}' -- required
AND risky_service_principal_history_item_id = '{{ risky_service_principal_history_item_id }}' -- required
;

Get the risk history of a riskyServicePrincipal object.

SELECT
id,
activity,
appId,
displayName,
history,
initiatedBy,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType
FROM entra_id.identity_protection.risky_service_principals_history
WHERE risky_service_principal_id = '{{ risky_service_principal_id }}' -- required
;

`INSERT` examples

insert
Manifest

No description available.

INSERT INTO entra_id.identity_protection.risky_service_principals_history (
id,
appId,
displayName,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType,
history,
activity,
initiatedBy,
risky_service_principal_id
)
SELECT 
'{{ id }}',
'{{ appId }}',
'{{ displayName }}',
{{ isEnabled }},
{{ isProcessing }},
'{{ riskDetail }}',
'{{ riskLastUpdatedDateTime }}',
'{{ riskLevel }}',
'{{ riskState }}',
'{{ servicePrincipalType }}',
'{{ history }}',
'{{ activity }}',
'{{ initiatedBy }}',
'{{ risky_service_principal_id }}'
RETURNING
id,
activity,
appId,
displayName,
history,
initiatedBy,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType
;

# Description fields are for documentation purposes
- name: risky_service_principals_history
props:
  - name: risky_service_principal_id
    value: "{{ risky_service_principal_id }}"
    description: Required parameter for the risky_service_principals_history resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: appId
    value: "{{ appId }}"
    description: |
      The globally unique identifier for the associated application (its appId property), if any.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      The display name for the service principal.
  - name: isEnabled
    value: {{ isEnabled }}
    description: |
      true if the service principal account is enabled; otherwise, false.
  - name: isProcessing
    value: {{ isProcessing }}
    description: |
      Indicates whether Microsoft Entra ID is currently processing the service principal's risky state.
  - name: riskDetail
    value: "{{ riskDetail }}"
    description: |
      Details of the detected risk. Note: Details for this property are only available for Workload Identities Premium customers. Events in tenants without this license will be returned hidden.
  - name: riskLastUpdatedDateTime
    value: "{{ riskLastUpdatedDateTime }}"
    description: |
      The date and time that the risk state was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2021 is 2021-01-01T00:00:00Z. Supports $filter (eq).
  - name: riskLevel
    value: "{{ riskLevel }}"
    description: |
      Level of the detected risky workload identity. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Supports $filter (eq).
  - name: riskState
    value: "{{ riskState }}"
    description: |
      State of the service principal's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
  - name: servicePrincipalType
    value: "{{ servicePrincipalType }}"
    description: |
      Identifies whether the service principal represents an Application, a ManagedIdentity, or a legacy application (socialIdp). This is set by Microsoft Entra ID internally and is inherited from servicePrincipal.
  - name: history
    description: |
      Represents the risk history of Microsoft Entra service principals.
    value:
      - id: "{{ id }}"
        appId: "{{ appId }}"
        displayName: "{{ displayName }}"
        isEnabled: {{ isEnabled }}
        isProcessing: {{ isProcessing }}
        riskDetail: "{{ riskDetail }}"
        riskLastUpdatedDateTime: "{{ riskLastUpdatedDateTime }}"
        riskLevel: "{{ riskLevel }}"
        riskState: "{{ riskState }}"
        servicePrincipalType: "{{ servicePrincipalType }}"
        history: "{{ history }}"
        activity: "{{ activity }}"
        initiatedBy: "{{ initiatedBy }}"
  - name: activity
    value: "{{ activity }}"
    description: |
      The activity related to service principal risk level change.
  - name: initiatedBy
    value: "{{ initiatedBy }}"
    description: |
      The identifier of the actor of the operation.

`UPDATE` examples

update

No description available.

UPDATE entra_id.identity_protection.risky_service_principals_history
SET 
id = '{{ id }}',
appId = '{{ appId }}',
displayName = '{{ displayName }}',
isEnabled = {{ isEnabled }},
isProcessing = {{ isProcessing }},
riskDetail = '{{ riskDetail }}',
riskLastUpdatedDateTime = '{{ riskLastUpdatedDateTime }}',
riskLevel = '{{ riskLevel }}',
riskState = '{{ riskState }}',
servicePrincipalType = '{{ servicePrincipalType }}',
history = '{{ history }}',
activity = '{{ activity }}',
initiatedBy = '{{ initiatedBy }}'
WHERE 
risky_service_principal_id = '{{ risky_service_principal_id }}' --required
AND risky_service_principal_history_item_id = '{{ risky_service_principal_history_item_id }}' --required
RETURNING
id,
activity,
appId,
displayName,
history,
initiatedBy,
isEnabled,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
servicePrincipalType;

`DELETE` examples

delete

No description available.

DELETE FROM entra_id.identity_protection.risky_service_principals_history
WHERE risky_service_principal_id = '{{ risky_service_principal_id }}' --required
AND risky_service_principal_history_item_id = '{{ risky_service_principal_history_item_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​

Overview

Fields

Methods

Parameters

`SELECT` examples

`INSERT` examples

`UPDATE` examples

`DELETE` examples