Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Namespace: microsoft.graph
Important
APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Represents a Microsoft Entra agent user that is at risk. Microsoft Entra ID Protection continually evaluates agentic risk based various signals and machine learning.
Inherits from riskyAgent.
Methods
None.
Properties
| Property | Type | Description |
|---|---|---|
| agentDisplayName | String | Name of the agent. Inherited from riskyAgent. Supports $filter (eq, startsWith). |
| id | String | The object id of the agent user. Inherited from entity. Supports $filter (eq, startsWith). |
| isDeleted | Boolean | Indicates whether the agent is deleted. Inherited from riskyAgent. |
| isEnabled | Boolean | Indicates whether the agent is enabled. Inherited from riskyAgent. |
| isProcessing | Boolean | Indicates whether an agent's risky state is processing in the backend. Inherited from riskyAgent. |
| riskDetail | riskDetail | Details of the detected risk of the agent. Inherited from riskyAgent. The possible values are: none, adminConfirmedAgentSafe, adminConfirmedAgentCompromised, adminDismissedRiskForAgent. Supports $filter (eq). |
| riskLastModifiedDateTime | DateTimeOffset | The date and time that the risky agent was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from riskyAgent. Supports $filter (eq, le, and ge). |
| riskLevel | riskLevel | Level of the detected risky agent. Inherited from riskyAgent. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Supports $filter (eq). |
| riskState | riskState | State of the agent's risk. Inherited from riskyAgent. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue. Supports $filter (eq). |
Relationships
None.
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.riskyAgentUser",
"id": "String (identifier)",
"agentDisplayName": "String",
"isDeleted": "Boolean",
"isEnabled": "Boolean",
"isProcessing": "Boolean",
"riskLastModifiedDateTime": "String (timestamp)",
"riskState": "String",
"riskLevel": "String",
"riskDetail": "String"
}