Risky Users Report

Users flagged as at risk by Microsoft Entra ID Protection. Monitor user risk levels, investigate potential account compromise, and manage remediation workflows.

Overview

The Risky Users Report identifies user accounts that Entra ID Protection has flagged as potentially compromised. User risk is aggregated from individual risky sign-in detections and other risk signals to provide an overall risk assessment for each user.

Report Columns

Column	Description
User	Display name and user principal name
Risk Level	Low, Medium, or High
Risk State	At Risk, Confirmed Compromised, Dismissed, or Remediated
Risk Last Updated	When the risk level was last evaluated
Last Sign-in	Most recent sign-in date
Risk Detections	Number of risk detections for the user
MFA Registered	Whether the user has MFA configured
Admin Account	Whether the user holds an admin role
Tenant	Which managed tenant the user belongs to

Risk Levels

High — Multiple risk signals or strong compromise indicators; immediate action required
Medium — Moderate risk signals detected; investigation recommended
Low — Minor risk indicators; monitor the account

Warning: Admin accounts flagged as risky should be investigated immediately as they have elevated access to organizational resources.

Risk States

State	Description
At Risk	User has active risk detections
Confirmed Compromised	Admin has confirmed the account is compromised
Dismissed	Admin has reviewed and dismissed the risk as false positive
Remediated	User has completed remediation (password reset, MFA challenge)

Remediation Workflow

Review the user risk details and associated risk detections
Determine if the risk is legitimate or a false positive
If compromised, reset the user password and revoke active sessions
Require MFA re-registration if authentication methods may be compromised
Review recent activity for signs of data access or exfiltration
Update the risk state after remediation is complete

Filters

Risk Level — High, Medium, Low
Risk State — At Risk, Confirmed, Dismissed, Remediated
Account Type — All users, Admins only, Non-admins only
MFA Status — Registered, Not Registered
Tenant — Filter by managed tenant

Graph API Data Sources

GET /identityProtection/riskyUsers
GET /identityProtection/riskyUsers/{id}/history

API Reference

GET /api/reports/security/risky-users — Get risky users report
POST /api/reports/security/risky-users/{id}/dismiss — Dismiss user risk
POST /api/reports/security/risky-users/{id}/confirmCompromised — Confirm compromise
POST /api/reports/security/risky-users/export — Export report data