null

Table Specific Information

Select

SELECT * FROM RiskDetections

Note: Querying this view requires additional scopes than the default. In order to access this table, you must have the IdentityRiskEvent.Read.All permission and the signed-in user must be assigned a supported Microsoft Entra role or a custom role with a supported role permission of Global Reader, Security Operator, Security Reader, or Security Administrator.

Columns

Name	Type	Description
id [KEY]	String
activity	String
activityDateTime	Datetime
additionalInfo	String
correlationId	String
detectedDateTime	Datetime
detectionTimingType	String
ipAddress	String
lastUpdatedDateTime	Datetime
location_city	String
location_countryOrRegion	String
location_geoCoordinates_altitude	Double
location_geoCoordinates_latitude	Double
location_geoCoordinates_longitude	Double
location_state	String
requestId	String
riskDetail	String
riskEventType	String
riskLevel	String
riskState	String
source	String
tokenIssuerType	String
userDisplayName	String
userId	String
userPrincipalName	String