Risky Users & Risk Detections

The question it answers: Which users does Identity Protection hold at risk or recently changed the risk of, and has anyone dealt with them yet?

Which identities Microsoft believes are compromised or under attack - leaked credentials, password spray, impossible travel, token theft - and whether anyone has dealt with them yet.

Note

Users: currently at risk, plus any whose risk changed in the last 30 days. Detection counts: last 30 days.

At a glance

Where in the app	Entra ID › Security › Risky Users
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P2. Without it Graph returns limited or no risk data, and this page shows the error.
Report id (API and MCP)	entra.security.risky-users
Tabs on its page	Risk Detections

Columns

Column	Key	Type
User	DisplayName	Link
UPN	UserPrincipalName	Text
Risk level	RiskLevel	Status
State	RiskState	Text
Detail	RiskDetail	Text
Admin	IsAdmin	YesNo
Detections (30d)	DetectionsLast30Days	Text
Risk updated	RiskLastUpdatedDateTime	DateTime

What it needs

Licence: Microsoft Entra ID P2. Without it Graph returns limited or no risk data, and this page shows the error.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
IdentityRiskyUser.Read.All	Microsoft Graph	Read all identity risky user information
IdentityRiskEvent.Read.All	Microsoft Graph	Read all identity risk event information
AuditLog.Read.All	Microsoft Graph	Read all audit log data

Data sources it reads

• GET /v1.0/identityProtection/riskyUsers
• GET /v1.0/identityProtection/riskDetections
• GET /v1.0/reports/authenticationMethods/userRegistrationDetails (admin flag)

Through the API and MCP

GET /ir-api/v1/reports/entra.security.risky-users?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.risky-users. The client needs the Read grant for Entra ID. See Using the API.