identityRiskEvent resource type (deprecated)

Namespace: microsoft.graph


APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.


The identityRiskEvents API is deprecated and will stop returning data on January 10, 2020. For details, see Deprecation of the IdentityRiskEvents API.

A risk event detected by Azure Active Directory Identity Protection. It is the base type for each specific risk event type:

Event type Description
anonymousipRiskEvent Sign-ins from anonymous IP addresses.
malwareRiskEvent Sign-ins from malware-infected devices.
impossibleTravelRiskEvent Impossible travel to atypical locations.
leakedCredentialsRiskEvent Users with leaked credentials.
suspiciousIpRiskEvent Sign-ins from suspicious IP addresses.
unfamiliarLocationRiskEvent Sign-ins from unfamiliar locations.

Complete information about risk events can be found in the Azure AD Identity Protection documentation.


Method Return Type Description
Get identityRiskEvent identityRiskEvent Read properties and relationships of identityRiskEvent object.


Property Type Description
closedDateTime dateTimeOffset The date and time that the risk event was closed
createdDateTime dateTimeOffset The date and time that the risk event was created. This is always greater than or equal to the datetime of the risk event itself. This is the correct property to use as a filter when querying risk events.
id string Read-only
riskEventDateTime dateTimeOffset The date and time when the risk event occurred
riskEventStatus string Possible values are: active, remediated, dismissedAsFixed, dismissedAsFalsePositive, dismissedAsIgnore, loginBlocked, closedMfaAuto, closedMultipleReasons.
riskLevel string Possible values are: low, medium, high.
riskEventType string The type of risk
userDisplayName string The name of the user at risk
userId string The id of the user at risk
userPrincipalName string The user principal name of the user at risk


Relationship Type Description
impactedUser user Read-only. Nullable.

JSON representation

Here is a JSON representation of the resource.

  "closedDateTime": "String (timestamp)",
  "createdDateTime": "String (timestamp)",
  "id": "string (identifier)",
  "riskEventDateTime": "String (timestamp)",
  "riskEventStatus": "string",
  "riskLevel": "string",
  "riskType": "string",
  "userDisplayName": "string",
  "userId": "string",
  "userPrincipalName": "string",
  "riskEventType": "string"