{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-risky-user-history-item-schema.json",
  "title": "microsoft.graph.riskyUserHistoryItem",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-identityprotection-riskyuser-api-openapi.yml#/components/schemas/microsoft.graph.riskyUserHistoryItem",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.riskyUser"
    },
    {
      "title": "riskyUserHistoryItem",
      "type": "object",
      "properties": {
        "activity": {
          "$ref": "#/$defs/microsoft.graph.riskUserActivity"
        },
        "initiatedBy": {
          "type": [
            "string",
            "null"
          ],
          "description": "The ID of actor that does the operation."
        },
        "userId": {
          "type": [
            "string",
            "null"
          ],
          "description": "The ID of the user."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.riskDetail": {
      "title": "riskDetail",
      "enum": [
        "none",
        "adminGeneratedTemporaryPassword",
        "userPerformedSecuredPasswordChange",
        "userPerformedSecuredPasswordReset",
        "adminConfirmedSigninSafe",
        "aiConfirmedSigninSafe",
        "userPassedMFADrivenByRiskBasedPolicy",
        "adminDismissedAllRiskForUser",
        "adminConfirmedSigninCompromised",
        "hidden",
        "adminConfirmedUserCompromised",
        "unknownFutureValue",
        "m365DAdminDismissedDetection",
        "adminConfirmedServicePrincipalCompromised",
        "adminDismissedAllRiskForServicePrincipal",
        "userChangedPasswordOnPremises",
        "adminDismissedRiskForSignIn",
        "adminConfirmedAccountSafe",
        "microsoftRevokedSessions"
      ],
      "type": "string"
    },
    "microsoft.graph.riskLevel": {
      "title": "riskLevel",
      "enum": [
        "low",
        "medium",
        "high",
        "hidden",
        "none",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskState": {
      "title": "riskState",
      "enum": [
        "none",
        "confirmedSafe",
        "remediated",
        "dismissed",
        "atRisk",
        "confirmedCompromised",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskUserActivity": {
      "title": "riskUserActivity",
      "type": "object",
      "properties": {
        "detail": {
          "$ref": "#/$defs/microsoft.graph.riskDetail"
        },
        "riskEventTypes": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "The type of risk event detected."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.riskyUser": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "riskyUser",
          "type": "object",
          "properties": {
            "isDeleted": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether the user is deleted. The possible values are: true, false."
            },
            "isProcessing": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether the backend is processing a user's risky state."
            },
            "riskDetail": {
              "$ref": "#/$defs/microsoft.graph.riskDetail"
            },
            "riskLastUpdatedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.",
              "format": "date-time"
            },
            "riskLevel": {
              "$ref": "#/$defs/microsoft.graph.riskLevel"
            },
            "riskState": {
              "$ref": "#/$defs/microsoft.graph.riskState"
            },
            "userDisplayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Risky user display name."
            },
            "userPrincipalName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Risky user principal name."
            },
            "history": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.riskyUserHistoryItem"
              },
              "description": "The activity related to user risk level change",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.riskyUserHistoryItem": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.riskyUser"
        },
        {
          "title": "riskyUserHistoryItem",
          "type": "object",
          "properties": {
            "activity": {
              "$ref": "#/$defs/microsoft.graph.riskUserActivity"
            },
            "initiatedBy": {
              "type": [
                "string",
                "null"
              ],
              "description": "The ID of actor that does the operation."
            },
            "userId": {
              "type": [
                "string",
                "null"
              ],
              "description": "The ID of the user."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    }
  }
}