Hello Developers!

Three years ago, we exposed the identityRiskEvents API under https://graph.microsoft.com/beta. During the time it has been in public preview, we heard feedback from developers that they needed an API to provide additional information about risk detections made by Identity Protection and for the information to be presented in a flattened structure. In July 2019, we released the riskDetection API in public preview to meet these requests. With the introduction of this new API that can be used to query risk detections for both P1 and P2 customers (with more advanced details than the identityRiskEvents API), we will be deprecating the identityRiskEvents API.

Beginning January 10, 2020, the identityRiskEvents API will stop returning data.

Next Steps

If you have been using the identityRiskEvents API, you should transition to the riskDetection API. For more information and details on this new API, please refer to the following documentation:

Getting started with Identity Protection APIs

riskDetection reference information

Both P1 and P2 customers will be able to query the riskDetection API, but only P2 customers will receive full details. Consistent with the Identity Protection UI, the premium properties riskLevel and riskDetail will return “hidden” for P1 customers.

Thank you in advance for transitioning to our new API that provides more robust contextual information on risk detected in your organization. We are excited about these improvements to our APIs and extending the ability to developers to leverage the value of Identity Protection detections.

The January 10th deprecation applies to the public cloud endpoint, and does not impact availability for US Government cloud.

If you aren’t yet using Identity Protection, check it out here– it’s a powerful tool for protecting your identities!

Sarah Handler, on behalf of the Identity Protection team