Created by Claude - please verify

Risky users - Microsoft's risk scoring, read-only. Confirm compromise or dismiss risk in Entra ID Protection.

Required Microsoft Graph permissions

IdentityRiskyUser.Read.All IdentityRiskEvent.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P2. Without it Graph returns limited or no risk data, and this page shows the error.

Endpoints: GET /v1.0/identityProtection/riskyUsers · GET /v1.0/identityProtection/riskDetections

Detections: last 30 days. Users: currently at risk, plus any whose risk changed in the last 30 days.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Risky Users & Risk Detections

Which identities Microsoft believes are compromised or under attack - leaked credentials, password spray, impossible travel, token theft - and whether anyone has dealt with them yet.

No user is at risk and Identity Protection recorded no risk detections in the last 30 days.