Edit

Share via


riskUserActivity resource type

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents the risk activity of a user as determined by Microsoft Entra ID Protection.

Properties

Property Type Description
detail riskDetail For more information, see riskDetail.
riskEventTypes String collection The type of risk event detected. The possible values are: anonymizedIPAddress, investigationsThreatIntelligence, investigationsThreatIntelligenceSigninLinked,leakedCredentials, maliciousIPAddress, maliciousIPAddressValidCredentialsBlockedIP, malwareInfectedIPAddress, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, suspiciousAPITraffic, suspiciousIPAddress, unfamiliarFeatures, unlikelyTravel.
For more information about each value, see Risk types and detection.
eventTypes (deprecated) riskEventType collection List of risk event types. Deprecated. Use riskEventType instead.

Relationships

None.

JSON representation

{
    "eventTypes": ["String"],
    "riskEventTypes": ["String"],
    "detail": "String"
}