category: Authentication & Identity Management provider: Microsoft commonfields: id: Azure Active Directory Identity Protection version: -1 deprecated: true configuration: - display: Application ID (Client ID for Client credentials mode) name: app_id required: true defaultvalue: 4ffef4a4-601f-4393-a789-432f3f3b8470 type: 0 - display: Subscription ID additionalinfo: Azure Active Directory subscription ID. name: subscription_id required: true type: 0 - additionalinfo: Azure Active Directory endpoint associated with a national cloud. defaultvalue: https://login.microsoftonline.com display: Azure Active Directory endpoint name: azure_ad_endpoint options: - https://login.microsoftonline.com - https://login.microsoftonline.us - https://login.microsoftonline.de - https://login.chinacloudapi.cn required: true type: 15 - additionalinfo: Use a self-deployed Azure application and authenticate using the Client Credentials flow. display: Use Client Credentials Authorization Flow name: client_credentials type: 8 required: false - display: Tenant ID (required for Client Credentials mode) name: tenant_id type: 0 required: false - displaypassword: Client Secret (required for Client Credentials mode) name: credentials type: 9 additionalinfo: "Client Secret. Required for Client Credentials mode)" hiddenusername: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - name: isFetch display: Fetch incidents type: 8 required: false - display: Incident type name: incidentType type: 13 required: false - name: first_fetch display: First Fetch Time Interval defaultvalue: 1 days type: 0 additionalinfo: The time range to consider for the initial data fetch in the format . For example, 1 hour, 2 hours, 6 hours, 12 hours, 24 hours, 48 hours, etc. required: false - defaultvalue: '50' display: Max fetch interval additionalinfo: The maximum number of incidents per request from the Azure Active Directory. Default is 50. name: max_fetch type: 0 required: false - display: Fetch filter expression name: fetch_filter_expression type: 0 required: false - display: Fetch User ID additionalinfo: Comma separated User IDs name: fetch_user_id type: 0 required: false - display: Fetch User Principal Name name: fetch_user_principal_name type: 0 required: false description: Deprecated. Use Microsoft Graph Identity and Access instead. display: Azure Active Directory Identity Protection (Deprecated) name: Azure Active Directory Identity Protection script: commands: - description: Tests the connectivity to Azure. name: azure-ad-auth-test - description: Run this command to start the authorization process. Follow the instructions shown. execution: true name: azure-ad-auth-start - description: Run this command to complete the authorization process. This should be used after running the azure-ad-auth-start command. name: azure-ad-auth-complete - description: Run this command to rerun the authentication process. name: azure-ad-auth-reset - arguments: - description: The unique ID of the risk detection. name: id - description: The unique ID of the user. name: user_id - description: The user principal name (UPN) of the user. name: user_principal_name - description: The country or region of the activity. For example, `US` or `UK`. For more information, see https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-beta. name: country - description: A custom query in OData syntax. Using this overrides all arguments, except for next_link. For more information, see https://docs.microsoft.com/en-us/graph/query-parameters. name: filter_expression - defaultValue: '50' description: The maximum number of results to return. name: limit - description: A link that specifies a starting point for subsequent calls. Using this argument overrides all other arguments. name: next_link description: Retrieves the properties of a collection of riskDetection objects. name: azure-ad-identity-protection-risks-list outputs: - contextPath: AADIdentityProtection.Risks.id description: The unique ID of the risk detection. type: string - contextPath: AADIdentityProtection.Risks.requestId description: Requests the ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in. type: string - contextPath: AADIdentityProtection.Risks.correlationId description: Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in. type: string - contextPath: AADIdentityProtection.Risks.riskEventType description: 'The type of risk event detected. Can be: "unlikelyTravel", "anonymizedIPAddress", "maliciousIPAddress", "unfamiliarFeatures", "malwareInfectedIPAddress", "suspiciousIPAddress", "leakedCredentials", "investigationsThreatIntelligence", "generic","adminConfirmedUserCompromised", "mcasImpossibleTravel", "mcasSuspiciousInboxManipulationRules", "investigationsThreatIntelligenceSigninLinked", "maliciousIPAddressValidCredentialsBlockedIP", and "unknownFutureValue".' type: string - contextPath: AADIdentityProtection.Risks.riskType description: Deprecated. Use riskEventType instead. List of risk event types. type: string - contextPath: AADIdentityProtection.Risks.riskLevel description: 'The risk level of the detected risky user. Can be: "low", "medium", "high", "hidden", "none", and "unknownFutureValue".' type: string - contextPath: AADIdentityProtection.Risks.riskState description: 'State of the users risk. Can be: "none", "confirmedSafe", "remediated", "dismissed", "atRisk", "confirmedCompromised", and "unknownFutureValue".' type: string - contextPath: AADIdentityProtection.Risks.riskDetail description: 'Reason why the user is considered a risky user. Can be: "none", "adminGeneratedTemporaryPassword", "userPerformedSecuredPasswordChange", "userPerformedSecuredPasswordReset", "adminConfirmedSigninSafe", "aiConfirmedSigninSafe", "userPassedMFADrivenByRiskBasedPolicy", "adminDismissedAllRiskForUser", "adminConfirmedSigninCompromised", "hidden", "adminConfirmedUserCompromised", and "unknownFutureValue".' type: string - contextPath: AADIdentityProtection.Risks.source description: Source of the risk detection. For example, `activeDirectory`. type: string - contextPath: AADIdentityProtection.Risks.detectionTimingType description: 'Timing of the detected risk (real-time/offline). Can be: "notDefined", "realtime", "nearRealtime", "offline", and "unknownFutureValue".' type: string - contextPath: AADIdentityProtection.Risks.activity description: 'Indicates the activity type that the detected risk is linked. Can be: "signin", "user", and "unknownFutureValue".' type: string - contextPath: AADIdentityProtection.Risks.tokenIssuerType description: 'Indicates the type of token issuer for the detected sign-in risk. Can be: "AzureAD", "ADFederationServices", and "unknownFutureValue".' type: string - contextPath: AADIdentityProtection.Risks.ipAddress description: Provides the IP address of the client from where the risk occurred. type: string - contextPath: AADIdentityProtection.Risks.location.city description: The city of the sign-in. type: string - contextPath: AADIdentityProtection.Risks.location.countryOrRegion description: The country or region of the sign-in. type: string - contextPath: AADIdentityProtection.Risks.location.geoCoordinates.latitude description: The latitude of the sign-in. type: string - contextPath: AADIdentityProtection.Risks.location.geoCoordinates.longitude description: The longitude of the sign-in. type: string - contextPath: AADIdentityProtection.Risks.location.state description: The state of the sign-in. type: string - contextPath: AADIdentityProtection.Risks.activityDateTime description: The date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using the ISO 8601 format in UTC time. type: string - contextPath: AADIdentityProtection.Risks.detectedDateTime description: The date and time that the risk was detected. The DateTimeOffset type represents date and time information using the ISO 8601 format in UTC time. type: string - contextPath: AADIdentityProtection.Risks.lastUpdatedDateTime description: The date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using the ISO 8601 format in UTC time. type: string - contextPath: AADIdentityProtection.Risks.userId description: The unique ID of the user. type: string - contextPath: AADIdentityProtection.Risks.userDisplayName description: The risky user display name. type: string - contextPath: AADIdentityProtection.Risks.userPrincipalName description: The risky user principal name. type: string - contextPath: AADIdentityProtection.Risks.additionalInfo description: Additional information associated with the risk detection in JSON format. type: string - arguments: - description: The date and time that the risky user was last updated, formatted as `