IdentityRiskyServicePrincipal.Read.All
— application permission, granted to the app registration with admin consent.
Licence: Microsoft Entra Workload ID Premium. Without it Graph refuses the call and this page shows the error.
Endpoints:
GET /v1.0/identityProtection/riskyServicePrincipals · GET /v1.0/identityProtection/servicePrincipalRiskDetections
Shows workload identities currently at risk, plus any whose risk changed in the last 30 days.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Risky Workload Identities
Identity Protection also scores apps, service principals and managed identities: leaked credentials in public repos, sign-ins from unusual locations, suspicious credential additions. A compromised app identity often holds more access than any single user.
No workload identity is at risk, and none changed risk state in the last 30 days.