Risky Workload Identities

The question it answers: Which apps, service principals and managed identities does Identity Protection consider at risk?

Identity Protection also scores apps, service principals and managed identities: leaked credentials in public repos, sign-ins from unusual locations, suspicious credential additions. A compromised app identity often holds more access than any single user.

Note

Shows workload identities currently at risk, plus any whose risk changed in the last 30 days.

At a glance

Where in the app	Entra ID › App & Workload Identities › Risky Workload Identities
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra Workload ID Premium. Without it Graph refuses the call and this page shows the error.
Report id (API and MCP)	entra.security.risky-workload-identities

Columns

Column	Key	Type
Identity	DisplayName	Text
Risk level	RiskLevel	Status
State	RiskState	Text
Detail	RiskDetail	Text
Latest detection	LatestDetection	Text
Detections (30d)	DetectionsLast30Days	Text
Type	ServicePrincipalType	Text
Risk updated	RiskLastUpdatedDateTime	Date
App ID	AppId	Text

What it needs

Licence: Microsoft Entra Workload ID Premium. Without it Graph refuses the call and this page shows the error.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
IdentityRiskyServicePrincipal.Read.All	Microsoft Graph	Read all identity risky service principal information

Data sources it reads

• GET /v1.0/identityProtection/riskyServicePrincipals
• GET /v1.0/identityProtection/servicePrincipalRiskDetections

Through the API and MCP

GET /ir-api/v1/reports/entra.security.risky-workload-identities?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.security.risky-workload-identities. The client needs the Read grant for Entra ID. See Using the API.