Skip to content

riskyagentuser.md

Latest commit

 

History

History
64 lines (54 loc) · 3.16 KB

riskyagentuser.md

File metadata and controls

64 lines (54 loc) · 3.16 KB
title riskyAgentUser resource type
description Identity Protection of agents - riskyAgentUser resource type
author jiayle27
ms.date 11/13/2025
ms.localizationpriority medium
ms.subservice entra-sign-in
doc_type resourcePageType

riskyAgentUser resource type

Namespace: microsoft.graph

[!INCLUDE beta-disclaimer]

Represents a Microsoft Entra agent user that is at risk. Microsoft Entra ID Protection continually evaluates agentic risk based various signals and machine learning.

Inherits from riskyAgent.

Methods

None.

Properties

Property Type Description
agentDisplayName String Name of the agent. Inherited from riskyAgent.

Supports $filter (eq, startsWith).
id String The object id of the agent user. Inherited from entity.

Supports $filter (eq, startsWith).
isDeleted Boolean Indicates whether the agent is deleted. Inherited from riskyAgent.
isEnabled Boolean Indicates whether the agent is enabled. Inherited from riskyAgent.
isProcessing Boolean Indicates whether an agent's risky state is processing in the backend. Inherited from riskyAgent.
riskDetail riskDetail Details of the detected risk of the agent. Inherited from riskyAgent. The possible values are: none, adminConfirmedAgentSafe, adminConfirmedAgentCompromised, adminDismissedRiskForAgent.

Supports $filter (eq).
riskLastModifiedDateTime DateTimeOffset The date and time that the risky agent was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from riskyAgent.

Supports $filter (eq, le, and ge).
riskLevel riskLevel Level of the detected risky agent. Inherited from riskyAgent. The possible values are: low, medium, high, hidden, none, unknownFutureValue.

Supports $filter (eq).
riskState riskState State of the agent's risk. Inherited from riskyAgent. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.

Supports $filter (eq).

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.riskyAgentUser",
  "id": "String (identifier)",
  "agentDisplayName": "String",
  "isDeleted": "Boolean",
  "isEnabled": "Boolean",
  "isProcessing": "Boolean",
  "riskLastModifiedDateTime": "String (timestamp)",
  "riskState": "String",
  "riskLevel": "String",
  "riskDetail": "String"
}