Queries for the AADRiskyUsers table

  • Article

High risk users

Gets list of the top 100 at high risk users for the last day.

AADRiskyUsers
| where RiskLastUpdatedDateTime > ago(1d)
| where RiskLevel == "high"
| where RiskState == "atRisk"
| take 100