Skip to content

Commit 113676b

Browse files
authored
Merge pull request #211074 from MicrosoftGuyJFlo/IdenityProtectionFixesAPIDoc
[Azure AD] Identity Protection - API Doc fixes
2 parents b40d6d2 + c37b870 commit 113676b

File tree

1 file changed

+21
-5
lines changed

1 file changed

+21
-5
lines changed

articles/active-directory/identity-protection/howto-identity-protection-graph-api.md

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ services: active-directory
66
ms.service: active-directory
77
ms.subservice: identity-protection
88
ms.topic: how-to
9-
ms.date: 08/23/2022
9+
ms.date: 09/13/2022
1010

1111
ms.author: joflore
1212
author: MicrosoftGuyJFlo
@@ -21,24 +21,30 @@ Microsoft Graph is the Microsoft unified API endpoint and the home of [Azure Act
2121

2222
To successfully complete this tutorial, make sure you have the required prerequisites:
2323

24-
- Microsoft Graph PowerShell SDK is installed. Follow the [installation guide](/powershell/microsoftgraph/installation?view=graph-powershell-1.0) for more info on how to do this.
24+
- Microsoft Graph PowerShell SDK is installed. For more information, see the article [Install the Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/installation?view=graph-powershell-1.0&preserve-view=true).
2525
- Identity Protection is available in the beta version of Microsoft Graph PowerShell. Run the following command to set your profile to beta.
26+
2627
```powershell
2728
# Connect to Graph beta Endpoint
2829
Select-MgProfile -Name 'beta'
2930
```
31+
3032
- Microsoft Graph PowerShell using a global administrator role and the appropriate permissions. The IdentityRiskEvent.Read.All, IdentityRiskyUser.ReadWrite.All Or IdentityRiskyUser.ReadWrite.All delegated permissions are required. To set the permissions to IdentityRiskEvent.Read.All and IdentityRiskyUser.ReadWrite.All, run:
33+
3134
```powershell
3235
Connect-MgGraph -Scopes "IdentityRiskEvent.Read.All","IdentityRiskyUser.ReadWrite.All"
3336
```
3437

35-
Or, if you use app-only authentication, you may follow this [guide](/powershell/microsoftgraph/app-only?view=graph-powershell-1.0&tabs=azure-portal). To register an application with the required application permissions, prepare a certificate and run:
38+
If you use app-only authentication, see the article [Use app-only authentication with the Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/app-only?view=graph-powershell-1.0&tabs=azure-portal&preserve-view=true). To register an application with the required application permissions, prepare a certificate and run:
39+
3640
```powershell
3741
Connect-MgGraph -ClientID YOUR_APP_ID -TenantId YOUR_TENANT_ID -CertificateName YOUR_CERT_SUBJECT ## Or -CertificateThumbprint instead of -CertificateName
3842
```
3943

4044
## List risky detections using PowerShell
45+
4146
You can retrieve the risk detections by the properties of a risk detection in Identity Protection.
47+
4248
```powershell
4349
# List all anonymizedIPAddress risk detections
4450
Get-MgRiskDetection -Filter "RiskType eq 'anonymizedIPAddress'" | Format-Table UserDisplayName, RiskType, RiskLevel, DetectedDateTime
@@ -47,8 +53,11 @@ Get-MgRiskDetection -Filter "RiskType eq 'anonymizedIPAddress'" | Format-Table U
4753
Get-MgRiskDetection -Filter "UserDisplayName eq 'User01' and Risklevel eq 'high'" | Format-Table UserDisplayName, RiskType, RiskLevel, DetectedDateTime
4854
4955
```
56+
5057
## List risky users using PowerShell
58+
5159
You can retrieve the risky users and their risky histories in Identity Protection.
60+
5261
```powershell
5362
# List all high risk users
5463
Get-MgRiskyUser -Filter "RiskLevel eq 'high'" | Format-Table UserDisplayName, RiskDetail, RiskLevel, RiskLastUpdatedDateTime
@@ -57,20 +66,27 @@ Get-MgRiskyUser -Filter "RiskLevel eq 'high'" | Format-Table UserDisplayName, Ri
5766
Get-MgRiskyUserHistory -RiskyUserId 375844b0-2026-4265-b9f1-ee1708491e05| Format-Table RiskDetail, RiskLastUpdatedDateTime, @{N="RiskDetection";E={($_). Activity.RiskEventTypes}}, RiskState, UserDisplayName
5867
5968
```
60-
## Confirm users compromised using Powershell
69+
70+
## Confirm users compromised using PowerShell
71+
6172
You can confirm users compromised and flag them as high risky users in Identity Protection.
73+
6274
```powershell
6375
# Confirm Compromised on two users
6476
Confirm-MgRiskyUserCompromised -UserIds "577e09c1-5f26-4870-81ab-6d18194cbb51","bf8ba085-af24-418a-b5b2-3fc71f969bf3"
6577
```
66-
## Dimiss risky users using Powershell
78+
79+
## Dismiss risky users using PowerShell
80+
6781
You can bulk dismiss risky users in Identity Protection.
82+
6883
```powershell
6984
# Get a list of high risky users which are more than 90 days old
7085
$riskyUsers= Get-MgRiskyUser -Filter "RiskLevel eq 'high'" | where RiskLastUpdatedDateTime -LT (Get-Date).AddDays(-90)
7186
# bulk dimmiss the risky users
7287
Invoke-MgDismissRiskyUser -UserIds $riskyUsers.Id
7388
```
89+
7490
## Next steps
7591

7692
- [Get started with the Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/get-started)

0 commit comments

Comments
 (0)