impossibleTravelRiskEvent resource type

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

A risk event detected by Azure Active Directory Identity Protection where two account sign-ins occur from locations atypical for the user and it would be impossible to travel between the locations in the duration between the sign-ins. Complete information about risk events can be found in the Azure AD Identity Protection documentation.

Methods

Method Return Type Description
Get impossibleTravelRiskEvent impossibleTravelRiskEvent Read properties and relationships of impossibleTravelRiskEvent object.

Properties

Property Type Description
closedDateTime dateTimeOffset The date and time that the risk event was closed
createdDateTime dateTimeOffset The date and time that the risk event was created. This is always greater than or equal to the datetime of the risk event itself. This is the correct property to use as a filter when querying risk events.
deviceInformation string Information about the device
id string Read-only
ipAddress string The IP address of the second sign-in
isAtypicalLocation boolean If one of the locations is atypical for the user
location string The location attached to the IP address of the second sign-in
previousIPAddress string The IP address of the first sign-in
previousLocation string The location attached to the IP address of the first sign-in
previousSigninDateTime dateTimeOffset The date and time of the first sign-in
riskEventDateTime dateTimeOffset The date and time of the second sign-in
riskEventStatus string Possible values are: active, remediated, dismissedAsFixed, dismissedAsFalsePositive, dismissedAsIgnore, loginBlocked, closedMfaAuto, closedMultipleReasons.
riskLevel string Possible values are: low, medium, high.
riskEventType string The type of risk
userAgent string The browser's user agent string
userDisplayName string The name of the user at risk
userId string The id of the user at risk
userPrincipalName string The user principal name of the user at risk

Relationships

Relationship Type Description
impactedUser user Read-only. Nullable.

JSON representation

Here is a JSON representation of the resource.

{
  "closedDateTime": "String (timestamp)",
  "createdDateTime": "String (timestamp)",
  "deviceInformation": "string",
  "id": "string (identifier)",
  "ipAddress": "string",
  "isAtypicalLocation": true,
  "location": "string",
  "previousIPAddress": "string",
  "previousLocation": "string",
  "previousSigninDateTime": "String (timestamp)",
  "riskEventDateTime": "String (timestamp)",
  "riskEventStatus": "string",
  "riskLevel": "string",
  "riskType": "string",
  "userAgent": "string",
  "userDisplayName": "string",
  "userId": "string",
  "userPrincipalName": "string",
  "riskEventType": "string"
}