| title | riskUserActivity resource type |
|---|---|
| description | Represents the risk activity of a user as determined by Microsoft Entra ID Protection. |
| author | tracyshi |
| ms.localizationpriority | medium |
| ms.subservice | entra-sign-in |
| doc_type | resourcePageType |
| ms.date | 11/27/2025 |
Namespace: microsoft.graph
[!INCLUDE beta-disclaimer]
Represents the risk activity of a user as determined by Microsoft Entra ID Protection.
| Property | Type | Description |
|---|---|---|
| detail | riskDetail | For more information, see riskDetail. |
| riskEventTypes | String collection | The type of risk event detected. The possible values are: anonymizedIPAddress, investigationsThreatIntelligence, investigationsThreatIntelligenceSigninLinked,leakedCredentials, maliciousIPAddress, maliciousIPAddressValidCredentialsBlockedIP, malwareInfectedIPAddress, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, suspiciousAPITraffic, suspiciousIPAddress, unfamiliarFeatures, unlikelyTravel. For more information about each value, see Risk types and detection. |
| eventTypes (deprecated) | riskEventType collection | List of risk event types. Deprecated. Use riskEventType instead. |
None.
{
"eventTypes": ["String"],
"riskEventTypes": ["String"],
"detail": "String"
}