risky_users_history

Creates, updates, deletes, gets or lists a risky_users_history resource.

Overview

Name	risky_users_history
Type	Resource
Id	entra_id.identity_protection.risky_users_history

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activity		The activity related to user risk level change.
history	array	The activity related to user risk level change
initiatedBy	string	The ID of actor that does the operation.
isDeleted	boolean	Indicates whether the user is deleted. The possible values are: true, false.
isProcessing	boolean	Indicates whether the backend is processing a user's risky state.
riskDetail		Details of the detected risk.
riskLastUpdatedDateTime	string (date-time)	The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
riskLevel		Level of the detected risky user. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState		State of the user's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName	string	Risky user display name.
userId	string	The ID of the user.
userPrincipalName	string	Risky user principal name.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activity		The activity related to user risk level change.
history	array	The activity related to user risk level change
initiatedBy	string	The ID of actor that does the operation.
isDeleted	boolean	Indicates whether the user is deleted. The possible values are: true, false.
isProcessing	boolean	Indicates whether the backend is processing a user's risky state.
riskDetail		Details of the detected risk.
riskLastUpdatedDateTime	string (date-time)	The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
riskLevel		Level of the detected risky user. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState		State of the user's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName	string	Risky user display name.
userId	string	The ID of the user.
userPrincipalName	string	Risky user principal name.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	risky_user_id, risky_user_history_item_id		The activity related to user risk level change
list	select	risky_user_id		Get the riskyUserHistoryItems from the history navigation property.
insert	insert	risky_user_id
update	update	risky_user_id, risky_user_history_item_id
delete	delete	risky_user_id, risky_user_history_item_id	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
risky_user_history_item_id	string	The unique identifier of riskyUserHistoryItem
risky_user_id	string	The unique identifier of riskyUser
If-Match	string	ETag

SELECT examples

get

The activity related to user risk level change

SELECT
id,
activity,
history,
initiatedBy,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userId,
userPrincipalName
FROM entra_id.identity_protection.risky_users_history
WHERE risky_user_id = '{{ risky_user_id }}' -- required
AND risky_user_history_item_id = '{{ risky_user_history_item_id }}' -- required
;

list

Get the riskyUserHistoryItems from the history navigation property.

SELECT
id,
activity,
history,
initiatedBy,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userId,
userPrincipalName
FROM entra_id.identity_protection.risky_users_history
WHERE risky_user_id = '{{ risky_user_id }}' -- required
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.identity_protection.risky_users_history (
id,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userPrincipalName,
history,
activity,
initiatedBy,
userId,
risky_user_id
)
SELECT 
'{{ id }}',
{{ isDeleted }},
{{ isProcessing }},
'{{ riskDetail }}',
'{{ riskLastUpdatedDateTime }}',
'{{ riskLevel }}',
'{{ riskState }}',
'{{ userDisplayName }}',
'{{ userPrincipalName }}',
'{{ history }}',
'{{ activity }}',
'{{ initiatedBy }}',
'{{ userId }}',
'{{ risky_user_id }}'
RETURNING
id,
activity,
history,
initiatedBy,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userId,
userPrincipalName
;

Manifest

# Description fields are for documentation purposes
- name: risky_users_history
props:
  - name: risky_user_id
    value: "{{ risky_user_id }}"
    description: Required parameter for the risky_users_history resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: isDeleted
    value: {{ isDeleted }}
    description: |
      Indicates whether the user is deleted. The possible values are: true, false.
  - name: isProcessing
    value: {{ isProcessing }}
    description: |
      Indicates whether the backend is processing a user's risky state.
  - name: riskDetail
    value: "{{ riskDetail }}"
    description: |
      Details of the detected risk.
  - name: riskLastUpdatedDateTime
    value: "{{ riskLastUpdatedDateTime }}"
    description: |
      The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
  - name: riskLevel
    value: "{{ riskLevel }}"
    description: |
      Level of the detected risky user. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
  - name: riskState
    value: "{{ riskState }}"
    description: |
      State of the user's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
  - name: userDisplayName
    value: "{{ userDisplayName }}"
    description: |
      Risky user display name.
  - name: userPrincipalName
    value: "{{ userPrincipalName }}"
    description: |
      Risky user principal name.
  - name: history
    description: |
      The activity related to user risk level change
    value:
      - id: "{{ id }}"
        isDeleted: {{ isDeleted }}
        isProcessing: {{ isProcessing }}
        riskDetail: "{{ riskDetail }}"
        riskLastUpdatedDateTime: "{{ riskLastUpdatedDateTime }}"
        riskLevel: "{{ riskLevel }}"
        riskState: "{{ riskState }}"
        userDisplayName: "{{ userDisplayName }}"
        userPrincipalName: "{{ userPrincipalName }}"
        history: "{{ history }}"
        activity: "{{ activity }}"
        initiatedBy: "{{ initiatedBy }}"
        userId: "{{ userId }}"
  - name: activity
    value: "{{ activity }}"
    description: |
      The activity related to user risk level change.
  - name: initiatedBy
    value: "{{ initiatedBy }}"
    description: |
      The ID of actor that does the operation.
  - name: userId
    value: "{{ userId }}"
    description: |
      The ID of the user.

UPDATE examples

update

No description available.

UPDATE entra_id.identity_protection.risky_users_history
SET 
id = '{{ id }}',
isDeleted = {{ isDeleted }},
isProcessing = {{ isProcessing }},
riskDetail = '{{ riskDetail }}',
riskLastUpdatedDateTime = '{{ riskLastUpdatedDateTime }}',
riskLevel = '{{ riskLevel }}',
riskState = '{{ riskState }}',
userDisplayName = '{{ userDisplayName }}',
userPrincipalName = '{{ userPrincipalName }}',
history = '{{ history }}',
activity = '{{ activity }}',
initiatedBy = '{{ initiatedBy }}',
userId = '{{ userId }}'
WHERE 
risky_user_id = '{{ risky_user_id }}' --required
AND risky_user_history_item_id = '{{ risky_user_history_item_id }}' --required
RETURNING
id,
activity,
history,
initiatedBy,
isDeleted,
isProcessing,
riskDetail,
riskLastUpdatedDateTime,
riskLevel,
riskState,
userDisplayName,
userId,
userPrincipalName;

DELETE examples

delete

No description available.

DELETE FROM entra_id.identity_protection.risky_users_history
WHERE risky_user_id = '{{ risky_user_id }}' --required
AND risky_user_history_item_id = '{{ risky_user_history_item_id }}' --required
AND If-Match = '{{ If-Match }}'
;