Skip to content

Commit 3ceeefd

Browse files
cuixi1222peombwa
andauthored
Add more samples for Identity Protection Module (#1399)
* Update Get-MgRiskyUser.md add samples for Get-MgRiskyUser * Update Get-MgRiskyUserHistory.md add samples for Get-MgRiskyUserHistory * Update Get-MgRiskyUserHistory.md * Update Confirm-MgRiskyUserCompromised.md add samples for confirm-MgRiskUserCompromised * Update src/Identity.SignIns/Identity.SignIns/examples/v1.0-beta/Confirm-MgRiskyUserCompromised.md Co-authored-by: Peter Ombwa <[email protected]> Co-authored-by: Peter Ombwa <[email protected]>
1 parent f85adbe commit 3ceeefd

File tree

3 files changed

+48
-30
lines changed

3 files changed

+48
-30
lines changed
Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,10 @@
1-
### Example 1: {{ Add title here }}
1+
### Example 1: Confirm User sign in compormised
22
```powershell
3-
PS C:\> {{ Add code here }}
3+
Connect-MgGraph -Scopes "IdentityRiskyUser.ReadWrite.All"
4+
Select-MgProfile beta
5+
Confirm-MgRiskyUserCompromised -UserIds "254562e7-a745-496d-b98a-f6770b23152a","8f2ef8bf-53be-45f3-822d-366f51067458"
46
5-
{{ Add output here }}
67
```
8+
The command confirms the two users as compormised users.
79

8-
{{ Add description here }}
9-
10-
### Example 2: {{ Add title here }}
11-
```powershell
12-
PS C:\> {{ Add code here }}
13-
14-
{{ Add output here }}
15-
```
16-
17-
{{ Add description here }}
1810

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,29 @@
1-
### Example 1: {{ Add title here }}
1+
### Example 1: List all risky users
22
```powershell
3-
PS C:\> {{ Add code here }}
3+
Connect-MgGraph -Scopes "IdentityRiskyUser.Read.All"
4+
Select-MgProfile beta
5+
Get-MgRiskyUser | Format-Table UserDisplayName, RiskDetail, RiskLevel, RiskLastUpdatedDateTime
46
5-
{{ Add output here }}
7+
UserDisplayName RiskDetail RiskLevel RiskLastUpdatedDateTime
8+
--------------- ---------- --------- -----------------------
9+
Alex Su adminConfirmedUserCompromised high 5/30/2022 12:54:16 AM
10+
tracys adminConfirmedUserCompromised high 5/30/2022 12:44:25 AM
11+
Jason Mayer userPerformedSecuredPasswordReset none 7/4/2022 4:36:44 AM
612
```
713

8-
{{ Add description here }}
14+
This command returns all risky users
915

10-
### Example 2: {{ Add title here }}
16+
### Example 2: List all risky users by RiskLevel
1117
```powershell
12-
PS C:\> {{ Add code here }}
18+
Connect-MgGraph -Scopes "IdentityRiskyUser.Read.All"
19+
Select-MgProfile beta
20+
Get-MgRiskyUser -Filter "RiskLevel ne 'none'" | Format-Table UserDisplayName, RiskDetail, RiskLevel, RiskLastUpdatedDateTime
1321
14-
{{ Add output here }}
22+
UserDisplayName RiskDetail RiskLevel RiskLastUpdatedDateTime
23+
--------------- ---------- --------- -----------------------
24+
Alex Su adminConfirmedUserCompromised high 5/30/2022 12:54:16 AM
25+
tracys adminConfirmedUserCompromised high 5/30/2022 12:44:25 AM
1526
```
1627

17-
{{ Add description here }}
28+
This command retruns all risky users whose risk level is not none
1829

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,33 @@
1-
### Example 1: {{ Add title here }}
1+
### Example 1: List history of a specific user
22
```powershell
3-
PS C:\> {{ Add code here }}
3+
Connect-MgGraph -Scopes "IdentityRiskyUser.Read.All"
4+
Select-MgProfile beta
5+
Get-MgRiskyUserHistory -RiskyUserId 375844b0-2026-4265-b9f1-ee1708491e05 | Format-Table RiskDetail, RiskLastUpdatedDateTime, RiskState, UserDisplayName
46
5-
{{ Add output here }}
7+
RiskDetail RiskLastUpdatedDateTime RiskState UserDisplayName
8+
---------- ----------------------- --------- ---------------
9+
userPerformedSecuredPasswordReset 5/4/2022 10:54:35 PM remediated Jason Mayer
10+
adminConfirmedUserCompromised 5/27/2022 11:26:40 PM confirmedCompromised Jason Mayer
11+
adminDismissedAllRiskForUser 5/27/2022 11:28:07 PM dismissed Jason Mayer
12+
none 4/20/2022 3:33:58 PM atRisk Jason Mayer
13+
none 4/21/2022 9:58:21 PM atRisk Jason Mayer
614
```
715

8-
{{ Add description here }}
16+
The command return all the user risk history
917

10-
### Example 2: {{ Add title here }}
18+
### Example 2: List history of a specific user with detailed risk detection
1119
```powershell
12-
PS C:\> {{ Add code here }}
20+
Connect-MgGraph -Scopes "IdentityRiskyUser.Read.All"
21+
Select-MgProfile beta
22+
Get-MgRiskyUserHistory -RiskyUserId 375844b0-2026-4265-b9f1-ee1708491e05| Format-Table RiskDetail, RiskLastUpdatedDateTime, @{N="RiskDetection";E={($_). Activity.RiskEventTypes}}, RiskState, UserDisplayName
1323
14-
{{ Add output here }}
24+
RiskDetail RiskLastUpdatedDateTime RiskDetection RiskState UserDisplayName
25+
---------- ----------------------- ------------- --------- ---------------
26+
userPerformedSecuredPasswordReset 5/4/2022 10:54:35 PM remediated Jason Mayer
27+
adminConfirmedUserCompromised 5/27/2022 11:26:40 PM confirmedCompromised Jason Mayer
28+
adminDismissedAllRiskForUser 5/27/2022 11:28:07 PM dismissed Jason Mayer
29+
none 4/20/2022 3:33:58 PM anomalousToken atRisk Jason Mayer
30+
none 4/21/2022 9:58:21 PM anonymizedIPAddress atRisk Jason Mayer
1531
```
1632

17-
{{ Add description here }}
18-
33+
The command return all the user risk history and expand the property of Activity

0 commit comments

Comments
 (0)