KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

Users Microsoft Entra ID Protection flags as risky

Which users does Microsoft Entra ID Protection currently consider at risk or confirmed compromised, and at what risk level?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns
# Users flagged by Microsoft Entra ID Protection, at risk or confirmed compromised by default. Read-only.
param(
    [switch]$All
)

Connect-MgGraph -Scopes 'IdentityRiskyUser.Read.All' -NoWelcome

$open = 'atRisk', 'confirmedCompromised'

Get-MgRiskyUser -All |
    Where-Object { $All -or $open -contains "$($_.RiskState)" } |
    Sort-Object RiskLastUpdatedDateTime -Descending |
    Select-Object UserPrincipalName, UserDisplayName, RiskLevel, RiskState, RiskDetail, RiskLastUpdatedDateTime, IsDeleted

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • The riskyUsers API requires a Microsoft Entra ID P2 licence.
  • By default lists users whose riskState is atRisk or confirmedCompromised. Pass -All to include users whose risk was remediated, dismissed or confirmed safe.
  • riskLevel is low, medium, high, hidden or none. riskDetail says what last changed the risk, for example userPerformedSecuredPasswordReset or adminDismissedAllRiskForUser.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgRiskyUser (Microsoft.Graph.Identity.SignIns)List riskyUsers: permissions and supported rolesriskyUser resource type: riskLevel, riskState, riskDetail (P2 licence required)riskDetail enumeration valuesWhere-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts