{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-risky-user-schema.json",
  "title": "microsoft.graph.riskyUser",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-identityprotection-riskyuser-api-openapi.yml#/components/schemas/microsoft.graph.riskyUser",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "riskyUser",
      "type": "object",
      "properties": {
        "isDeleted": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether the user is deleted. The possible values are: true, false."
        },
        "isProcessing": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether the backend is processing a user's risky state."
        },
        "riskDetail": {
          "$ref": "#/$defs/microsoft.graph.riskDetail"
        },
        "riskLastUpdatedDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.",
          "format": "date-time"
        },
        "riskLevel": {
          "$ref": "#/$defs/microsoft.graph.riskLevel"
        },
        "riskState": {
          "$ref": "#/$defs/microsoft.graph.riskState"
        },
        "userDisplayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Risky user display name."
        },
        "userPrincipalName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Risky user principal name."
        },
        "history": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.riskyUserHistoryItem"
          },
          "description": "The activity related to user risk level change",
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.riskDetail": {
      "title": "riskDetail",
      "enum": [
        "none",
        "adminGeneratedTemporaryPassword",
        "userPerformedSecuredPasswordChange",
        "userPerformedSecuredPasswordReset",
        "adminConfirmedSigninSafe",
        "aiConfirmedSigninSafe",
        "userPassedMFADrivenByRiskBasedPolicy",
        "adminDismissedAllRiskForUser",
        "adminConfirmedSigninCompromised",
        "hidden",
        "adminConfirmedUserCompromised",
        "unknownFutureValue",
        "m365DAdminDismissedDetection",
        "adminConfirmedServicePrincipalCompromised",
        "adminDismissedAllRiskForServicePrincipal",
        "userChangedPasswordOnPremises",
        "adminDismissedRiskForSignIn",
        "adminConfirmedAccountSafe",
        "microsoftRevokedSessions"
      ],
      "type": "string"
    },
    "microsoft.graph.riskLevel": {
      "title": "riskLevel",
      "enum": [
        "low",
        "medium",
        "high",
        "hidden",
        "none",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskState": {
      "title": "riskState",
      "enum": [
        "none",
        "confirmedSafe",
        "remediated",
        "dismissed",
        "atRisk",
        "confirmedCompromised",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskUserActivity": {
      "title": "riskUserActivity",
      "type": "object",
      "properties": {
        "detail": {
          "$ref": "#/$defs/microsoft.graph.riskDetail"
        },
        "riskEventTypes": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "The type of risk event detected."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.riskyUser": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "riskyUser",
          "type": "object",
          "properties": {
            "isDeleted": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether the user is deleted. The possible values are: true, false."
            },
            "isProcessing": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether the backend is processing a user's risky state."
            },
            "riskDetail": {
              "$ref": "#/$defs/microsoft.graph.riskDetail"
            },
            "riskLastUpdatedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.",
              "format": "date-time"
            },
            "riskLevel": {
              "$ref": "#/$defs/microsoft.graph.riskLevel"
            },
            "riskState": {
              "$ref": "#/$defs/microsoft.graph.riskState"
            },
            "userDisplayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Risky user display name."
            },
            "userPrincipalName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Risky user principal name."
            },
            "history": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.riskyUserHistoryItem"
              },
              "description": "The activity related to user risk level change",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.riskyUserHistoryItem": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.riskyUser"
        },
        {
          "title": "riskyUserHistoryItem",
          "type": "object",
          "properties": {
            "activity": {
              "$ref": "#/$defs/microsoft.graph.riskUserActivity"
            },
            "initiatedBy": {
              "type": [
                "string",
                "null"
              ],
              "description": "The ID of actor that does the operation."
            },
            "userId": {
              "type": [
                "string",
                "null"
              ],
              "description": "The ID of the user."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    }
  }
}