I want to edit the defender alert to incorporate username of risky user detected.

Pouli Taufui 0

I know that you can only have the organization name and URL link in defender identity protection alert. I want to know is there a way to add the username of the risky user as well. This would be helpful as there are multiple tenants that require cross referencing and detections do not always happen at real time, there can be clashes with detections occurring at close time proximity.

Fiona Matu 86 Reputation points Microsoft Employee

2024-01-22T10:31:55.0333333+00:00
Hi Pouli, I have tried searching for way to do achieve that, but I don't think that such a feature is currently available. I would suggest you explore using Microsoft Graph API to retrieve the risky users and their details via this API:

GET /identityProtection/riskyUsers

Get more information on the API via https://video2.skills-academy.com/en-us/graph/api/riskyuser-list?view=graph-rest-1.0&tabs=http . Additionally, you can look into retrieving information of a single risky user via this API:

GET /identityProtection/riskyUsers/{riskyUserId}

Get more info on the API via: https://video2.skills-academy.com/en-us/graph/api/riskyuser-get?view=graph-rest-1.0&tabs=http

Share via

I want to edit the defender alert to incorporate username of risky user detected.