| Activity Date | DateTime | Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z. | {{RiskyEntraIDSignIn.ActivityDateTime}} |
| Additional Details | String | Provides additional details on the sign-in activity. | {{RiskyEntraIDSignIn.AdditionalDetails}} |
| Anonymized IP Address | String | Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN. | {{RiskyEntraIDSignIn.AnonymizedIPAddress}} |
| App Display Name | String | App name displayed in the Azure Portal. | {{RiskyEntraIDSignIn.AppDisplayName}} |
| App Id | String | Unique GUID representing the app ID in the Microsoft Entra ID. | {{RiskyEntraIDSignIn.AppId}} |
| Browser | String | Indicates the browser information of the used for signing in. | {{RiskyEntraIDSignIn.Browser}} |
| City | String | Provides the city where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity. | {{RiskyEntraIDSignIn.City}} |
| Client App Used | String | Identifies the client used for the sign-in activity. Modern authentication clients include Browser and modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients. | {{RiskyEntraIDSignIn.ClientAppUsed}} |
| Conditional Access Status | String | Reports status of an activated conditional access policy. Possible values are: success, failure, notApplied, and unknownFutureValue. Allowed values: Failure, NotApplied, Success, UnknownFutureValue. | {{RiskyEntraIDSignIn.ConditionalAccessStatus}} |
| Correlation Id | String | The request ID sent from the client when the sign-in is initiated; used to troubleshoot sign-in activity. | {{RiskyEntraIDSignIn.CorrelationId}} |
| Country Or Region | String | Provides the country code info (2 letter code) where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity. | {{RiskyEntraIDSignIn.CountryOrRegion}} |
| Initially Scanned | DateTime | Shows when this object was initially found in a scan. | {{RiskyEntraIDSignIn.CreatedTime}} |
| Device Id | String | Refers to the UniqueID of the device used for signing in. | {{RiskyEntraIDSignIn.DeviceId}} |
| Device is compliant | Boolean | Indicates whether the device is compliant. | {{RiskyEntraIDSignIn.DeviceIsCompliant}} |
| Device is managed | Boolean | Indicates whether the device is managed. | {{RiskyEntraIDSignIn.DeviceIsManaged}} |
| Display Name | String | | {{RiskyEntraIDSignIn.DisplayName}} |
| Display Name Device | String | Refers to the name of the device used for signing in. | {{RiskyEntraIDSignIn.DisplayNameDevide}} |
| Error Code | String | Provides the 5-6 digit error code that's generated during a sign-in failure. | {{RiskyEntraIDSignIn.ErrorCode}} |
| Failure Reason | String | Provides the error message or the reason for failure for the corresponding sign-in activity. | {{RiskyEntraIDSignIn.FailureReason}} |
| Generic | String | Indicates that the user was not enabled for Identity Protection. | {{RiskyEntraIDSignIn.Generic}} |
| Investigations Threat Intelligence | String | Indicates a sign-in activity that is unusual for the given user or is consistent with known attack patterns based on Microsoft's internal and external threat intelligence sources. | {{RiskyEntraIDSignIn.InvestigationsThreatIntelligence}} |
| Ip Address | String | IP address of the client used to sign in. | {{RiskyEntraIDSignIn.IpAddress}} |
| Is Interactive | String | Indicates if a sign-in is interactive or not. | {{RiskyEntraIDSignIn.IsInteractive}} |
| Last scan update | DateTime | Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. | {{RiskyEntraIDSignIn.LastModifiedTime}} |
| Latitude | Double | The latitude, in decimal, for the item. | {{RiskyEntraIDSignIn.Latitude}} |
| Leaked Credentials | String | Indicates that the user's valid credentials have been leaked. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. When the Microsoft leaked credentials service acquires user credentials from the dark web, paste sites, or other sources, they are checked against Entra ID users' current valid credentials to find valid matches. | {{RiskyEntraIDSignIn.LeakedCredentials}} |
| Longitude | Double | The longitude, in decimal, for the item. | {{RiskyEntraIDSignIn.Longitude}} |
| Malicious IP Address | String | Indicates sign-ins from a malicious IP address. An IP address is considered malicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. | {{RiskyEntraIDSignIn.MaliciousIPAddress}} |
| Malware Infected IP Address | String | Indicates sign-ins from IP addresses infected with malware. Deprecated and no longer generated for new detections. | {{RiskyEntraIDSignIn.MalwareInfectedIPAddress}} |
| Operating System | String | Indicates the operating system name and version used for signing in. | {{RiskyEntraIDSignIn.OperatingSystem}} |
| Risk Detail | String | Provides the 'reason' behind a specific state of a risky user, sign-in or a risk event. The possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, unknownFutureValue. The value none means that no action has been performed on the user or sign-in so far. Allowed values: AdminConfirmedSigninCompromised, AdminConfirmedSigninSafe, AdminDismissedAllRiskForUser, AdminGeneratedTemporaryPassword, AiConfirmedSigninSafe, None, UnknownFutureValue, UserPassedMFADrivenByRiskBasedPolicy, UserPerformedSecuredPasswordChange, UserPerformedSecuredPasswordReset. | {{RiskyEntraIDSignIn.RiskDetail}} |
| Risk Level Aggregated | String | Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in was not enabled for Entra ID Identity Protection. Allowed values: Hidden, High, Low, Medium, None, UnknownFutureValue. | {{RiskyEntraIDSignIn.RiskLevelAggregated}} |
| Risk Level During SignIn | String | Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in was not enabled for Entra ID Identity Protection. Allowed values: Hidden, High, Low, Medium, None, UnknownFutureValue. | {{RiskyEntraIDSignIn.RiskLevelDuringSignIn}} |
| Risk Score | Int32 | Stores risk score | {{RiskyEntraIDSignIn.RiskScore}} |
| Risk Score Update | DateTime | Stores risk score update | {{RiskyEntraIDSignIn.RiskScoreLastUpdate}} |
| Risk Score Value | String | Stores risk score value like Low_Low | {{RiskyEntraIDSignIn.RiskScoreValue}} |
| Risk State | String | Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue. Allowed values: atRisk, confirmedCompromised, confirmedSafe, dismissed, none, remediated, unknownFutureValue. | {{RiskyEntraIDSignIn.RiskState}} |
| Id | String | Unique ID representing the sign-in activity. | {{RiskyEntraIDSignIn.SignInActivityId}} |
| State | String | Provides the State where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity. | {{RiskyEntraIDSignIn.State}} |
| Suspicious IP Address | String | Identifies logins from IP addresses that are known to be malicious at the time of the sign in. | {{RiskyEntraIDSignIn.SuspiciousIPAddress}} |
| Unfamiliar Features | String | Indicates sign-ins with characteristics that deviate from past sign-in properties. | {{RiskyEntraIDSignIn.UnfamiliarFeatures}} |
| Unknown Future Value | String | Evolvable enumeration sentinel value. Do not use. | {{RiskyEntraIDSignIn.UnknownFutureValue}} |
| Unlikely Travel | String | Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. | {{RiskyEntraIDSignIn.UnlikelyTravel}} |
| User | User | Sign-Ins of the user | {{RiskyEntraIDSignIn.User}} |
| User Id | String | ID of the user that initiated the sign-in. | {{RiskyEntraIDSignIn.UserId}} |
| User Name | String | Sign-Ins of the user | {{RiskyEntraIDSignIn.UserName}} |
| UserPrincipalName | String | User principal name of the user that initiated the sign-in. | {{RiskyEntraIDSignIn.UserPrincipalName}} |