risky_users

Creates, updates, deletes, gets or lists a risky_users resource.

Overview

Name	risky_users
Type	Resource
Id	entra_id.identity_protection.risky_users

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
history	array	The activity related to user risk level change
isDeleted	boolean	Indicates whether the user is deleted. The possible values are: true, false.
isProcessing	boolean	Indicates whether the backend is processing a user's risky state.
riskDetail		Details of the detected risk.
riskLastUpdatedDateTime	string (date-time)	The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
riskLevel		Level of the detected risky user. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState		State of the user's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName	string	Risky user display name.
userPrincipalName	string	Risky user principal name.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
history	array	The activity related to user risk level change
isDeleted	boolean	Indicates whether the user is deleted. The possible values are: true, false.
isProcessing	boolean	Indicates whether the backend is processing a user's risky state.
riskDetail		Details of the detected risk.
riskLastUpdatedDateTime	string (date-time)	The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
riskLevel		Level of the detected risky user. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState		State of the user's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName	string	Risky user display name.
userPrincipalName	string	Risky user principal name.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	risky_user_id		Read the properties and relationships of a riskyUser object.
list	select			Get a list of the riskyUser objects and their properties.
insert	insert
update	update	risky_user_id
delete	delete	risky_user_id	If-Match
confirm_compromised	exec			Confirm one or more riskyUser objects as compromised. This action sets the targeted user's risk level to high.
confirm_safe	exec			Confirm one or more riskyUser objects as safe. This action sets the targeted user's risk level to none.
dismiss	exec			Dismiss the risk of one or more riskyUser objects. This action sets the targeted user's risk level to none.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
risky_user_id	string	The unique identifier of riskyUser
If-Match	string	ETag

SELECT examples

get

Read the properties and relationships of a riskyUser object.

SELECT
id,
history,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userPrincipalName
FROM entra_id.identity_protection.risky_users
WHERE risky_user_id = '{{ risky_user_id }}' -- required
;

list

Get a list of the riskyUser objects and their properties.

SELECT
id,
history,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userPrincipalName
FROM entra_id.identity_protection.risky_users
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.identity_protection.risky_users (
id,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userPrincipalName,
history
)
SELECT 
'{{ id }}',
{{ isDeleted }},
{{ isProcessing }},
'{{ riskDetail }}',
'{{ riskLastUpdatedDateTime }}',
'{{ riskLevel }}',
'{{ riskState }}',
'{{ userDisplayName }}',
'{{ userPrincipalName }}',
'{{ history }}'
RETURNING
id,
history,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userPrincipalName
;

Manifest

# Description fields are for documentation purposes
- name: risky_users
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: isDeleted
    value: {{ isDeleted }}
    description: |
      Indicates whether the user is deleted. The possible values are: true, false.
  - name: isProcessing
    value: {{ isProcessing }}
    description: |
      Indicates whether the backend is processing a user's risky state.
  - name: riskDetail
    value: "{{ riskDetail }}"
    description: |
      Details of the detected risk.
  - name: riskLastUpdatedDateTime
    value: "{{ riskLastUpdatedDateTime }}"
    description: |
      The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
  - name: riskLevel
    value: "{{ riskLevel }}"
    description: |
      Level of the detected risky user. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
  - name: riskState
    value: "{{ riskState }}"
    description: |
      State of the user's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
  - name: userDisplayName
    value: "{{ userDisplayName }}"
    description: |
      Risky user display name.
  - name: userPrincipalName
    value: "{{ userPrincipalName }}"
    description: |
      Risky user principal name.
  - name: history
    description: |
      The activity related to user risk level change
    value:
      - id: "{{ id }}"
        isDeleted: {{ isDeleted }}
        isProcessing: {{ isProcessing }}
        riskDetail: "{{ riskDetail }}"
        riskLastUpdatedDateTime: "{{ riskLastUpdatedDateTime }}"
        riskLevel: "{{ riskLevel }}"
        riskState: "{{ riskState }}"
        userDisplayName: "{{ userDisplayName }}"
        userPrincipalName: "{{ userPrincipalName }}"
        history: "{{ history }}"
        activity: "{{ activity }}"
        initiatedBy: "{{ initiatedBy }}"
        userId: "{{ userId }}"

UPDATE examples

update

No description available.

UPDATE entra_id.identity_protection.risky_users
SET 
id = '{{ id }}',
isDeleted = {{ isDeleted }},
isProcessing = {{ isProcessing }},
riskDetail = '{{ riskDetail }}',
riskLastUpdatedDateTime = '{{ riskLastUpdatedDateTime }}',
riskLevel = '{{ riskLevel }}',
riskState = '{{ riskState }}',
userDisplayName = '{{ userDisplayName }}',
userPrincipalName = '{{ userPrincipalName }}',
history = '{{ history }}'
WHERE 
risky_user_id = '{{ risky_user_id }}' --required
RETURNING
id,
history,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userPrincipalName;

DELETE examples

delete

No description available.

DELETE FROM entra_id.identity_protection.risky_users
WHERE risky_user_id = '{{ risky_user_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Lifecycle Methods

confirm_compromised

Confirm one or more riskyUser objects as compromised. This action sets the targeted user's risk level to high.

EXEC entra_id.identity_protection.risky_users.confirm_compromised 
@@json=
'{
"userIds": "{{ userIds }}"
}'
;

confirm_safe

Confirm one or more riskyUser objects as safe. This action sets the targeted user's risk level to none.

EXEC entra_id.identity_protection.risky_users.confirm_safe 
@@json=
'{
"userIds": "{{ userIds }}"
}'
;

dismiss

Dismiss the risk of one or more riskyUser objects. This action sets the targeted user's risk level to none.

EXEC entra_id.identity_protection.risky_users.dismiss 
@@json=
'{
"userIds": "{{ userIds }}"
}'
;