riskyUserHistoryItem resource type

Namespace: microsoft.graph

Represents the risk history of a Microsoft Entra user as determined by Microsoft Entra ID Protection.

Inherits from riskyUser.

Note

1. Using this API requires a Microsoft Entra ID P2 license.
2. The availability of risk history data is governed by the Microsoft Entra data retention policies.

Methods

Method	Return type	Description
List history	riskyUserHistoryItem collection	Get the riskyUserHistoryItems from the history navigation property.

Properties

Property	Type	Description
activity	riskUserActivity	The activity related to user risk level change.
id	String	The unique identifier for the riskyUserHistoryItem object. Inherited from entity.
initiatedBy	String	The ID of actor that does the operation.
isDeleted	Boolean	Indicates whether the user is deleted. Inherited from riskyUser.
isProcessing	Boolean	Indicates whether a user's risky state is being processed by the backend. Inherited from riskyUser.
riskDetail	riskDetail	Details of the detected risk. Inherited from riskyUser. Possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, unknownFutureValue.
riskLastUpdatedDateTime	DateTimeOffset	The date and time when the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from riskyUser.
riskLevel	riskLevel	Level of the detected risky user. Inherited from riskyUser. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
riskState	riskState	State of the user's risk. Inherited from riskyUser. Possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.
userDisplayName	String	Risky user display name. Inherited from riskyUser.
userId	String	The ID of the user.
userPrincipalName	String	Risky user principal name. Inherited from riskyUser.

Relationships

Relationship	Type	Description
history	riskyUserHistoryItem collection	The activity related to user risk level change. Inherited from riskyUser.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.riskyUserHistoryItem",
  "id": "String (identifier)",
  "isDeleted": "Boolean",
  "isProcessing": "Boolean",
  "riskLastUpdatedDateTime": "String (timestamp)",
  "riskLevel": "String",
  "riskState": "String",
  "riskDetail": "String",
  "userDisplayName": "String",
  "userPrincipalName": "String",
  "userId": "String",
  "initiatedBy": "String",
  "activity": {
    "@odata.type": "microsoft.graph.riskUserActivity"
  }
}