Priority Accounts & Most-targeted Users

The question it answers: Which users receive the most phishing and malware, and are they tagged and protected as priority accounts?

Attackers pick their targets: finance, executives, assistants. This report ranks the people who received the most phishing and malware, and checks the three things that protect them - tagged as a priority account, covered by user impersonation protection, and signing in with phishing-resistant MFA.

At a glance

Where in the app	Exchange Online › Mail Security & Hygiene › Priority Accounts & Most-targeted
Workload	Exchange Online
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online Protection; impersonation protection needs Defender for Office 365 Plan 1.
Report id (API and MCP)	exchange.hygiene.priority-accounts

Columns

Column	Key	Type
Severity	Severity	Status
Account	Category	Text
User	Subject	Link
Check	Setting	Text
Phish / malware / other	Value	Text
Finding	Finding	Text
Detail	Detail	Text
Date	When	Date
Phish + malware	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: Exchange Online Protection; impersonation protection needs Defender for Office 365 Plan 1.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	+ Security Reader in Exchange
AuditLog.Read.All	Microsoft Graph	Read all audit log data	MFA methods
User.Read.All	Microsoft Graph	Read all users’ full profiles	address to UPN
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information	with
User.Read.All	Microsoft Graph	Read all users’ full profiles	with

Data sources it reads

• Get-MailDetailATPReport (10 days)
• Get-User -IsVIP
• Get-AntiPhishPolicy (TargetedUsersToProtect)
• GET /v1.0/reports/authenticationMethods/userRegistrationDetails

Through the API and MCP

GET /ir-api/v1/reports/exchange.hygiene.priority-accounts?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.priority-accounts. The client needs the Read grant for Exchange Online. See Using the API.