Understanding Risky Users report

Modified on Wed, 09 Mar 2022 at 07:56 AM

Risky Users report shows which users are at risk, have had risk remediated, or have had risk dismissed over the chosen time period. You can filter the view of this report by user risk level* (low, medium, high), risk state (remediated, at risk, dismissed). You can also check the risk details and risk last updated date time.


You can specify the period for which you would like to consult the License Pool snapshots. It can be last day, last 7, 14, 30, 60, 90, 180 or choose a custom range.


Other functions available:

  • Export the report in Excel, CSV or PDF.
  • Save
  • Schedule
  • Create Pivot table


*Note: Risk levels in Identity Protection are based on the precision of the detection and powered by Microsoft supervised machine learning.  So, while Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user. 



Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us how can we improve this article!

Select atleast one of the reasons

Feedback sent

We apprciate your effort and will try to fix the article