| title | riskServicePrincipalActivity resource type |
|---|---|
| description | Represents the risk activity of a Microsoft Entra service principal as determined by Microsoft Entra ID Protection. |
| author | ebasseri |
| ms.localizationpriority | medium |
| ms.subservice | entra-sign-in |
| doc_type | resourcePageType |
| ms.date | 11/27/2025 |
Namespace: microsoft.graph
[!INCLUDE beta-disclaimer]
Represents the risk activity of a Microsoft Entra service principal as determined by Microsoft Entra ID Protection.
| Property | Type | Description |
|---|---|---|
| riskEventTypes | String collection | The type of risk event detected. The possible values are: investigationsThreatIntelligence, generic, adminConfirmedServicePrincipalCompromised, suspiciousSignins, leakedCredentials, anomalousServicePrincipalActivity, maliciousApplication, suspiciousApplication. |
| detail | riskDetail | Details of the detected risk. Note: Details for this property are only available for Workload Identities Premium customers. Events in tenants without that license will be returned hidden. |
None.
{
"riskEventTypes": ["String"],
"detail": "String"
}