Exchange.ManageAsApp (+ Security Reader in Exchange)
IdentityRiskyUser.Read.All (optional)
— application permissions, granted to the app registration with admin consent.
Licence: Exchange Online Protection; the risk column needs Entra ID P2.
Endpoints:
Get-BlockedSenderAddress · GET /v1.0/identityProtection/riskyUsers (optional)
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Users Restricted from Sending
When an account suddenly sends large volumes of spam or phishing, Exchange Online blocks it from sending. That almost always means the account is compromised - and it is still signed in, still reading mail and still able to create inbox rules. Every row here needs an incident response, not just a release.
Loading...