Risky Users report shows which users are at risk, have had risk remediated, or have had risk dismissed over the chosen time period. You can filter the view of this report by user risk level* (low, medium, high), risk state (remediated, at risk, dismissed). You can also check the risk details and risk last updated date time.

You can specify the period for which you would like to consult the License Pool snapshots. It can be last day, last 7, 14, 30, 60, 90, 180 or choose a custom range.

Other functions available:

  • Export the report in Excel, CSV or PDF.
  • Save
  • Schedule
  • Create Pivot table

*Note: Risk levels in Identity Protection are based on the precision of the detection and powered by Microsoft supervised machine learning.  So, while Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user.