Created by Claude - please verify

Most-targeted users - 10 days of Get-MailDetailATPReport (30 with Defender for Office 365), top 100 recipients.

Required Microsoft Graph permissions

Exchange.ManageAsApp (+ Security Reader in Exchange) AuditLog.Read.All (MFA methods) — application permissions, granted to the app registration with admin consent.

Licence: Exchange Online Protection; impersonation protection needs Defender for Office 365 Plan 1.

Endpoints: Get-MailDetailATPReport (10 days) · Get-User -IsVIP · Get-AntiPhishPolicy (TargetedUsersToProtect) · GET /v1.0/reports/authenticationMethods/userRegistrationDetails

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Priority Accounts & Most-targeted Users

Attackers pick their targets: finance, executives, assistants. This report ranks the people who received the most phishing and malware, and checks the three things that protect them - tagged as a priority account, covered by user impersonation protection, and signing in with phishing-resistant MFA.