Risky user triage
Classifies recent Entra risky users by risk level, state, detail, and processing status with conservative next-step guidance.
On this page
Classifies recent Entra risky users by risk level, state, detail, and processing status with conservative next-step guidance.
Classification#
| Field | Value |
|---|---|
| Agent ID | risky-sign-in-triage |
| Version | 1.1.0 |
| Mode | read |
| Tier | agent |
| Category | policies |
| Required Entra tier | p2 |
| Preferred model | llama3.1:8b |
| Minimum app version | 0.1.0 |
| Author | OpenAdminOS · verified |
| Last changed | 2026-05-29 · 3a69fc6 |
Execution#
This agent runs through the host-side Agent Template interpreter.
Tenant Data Access#
| Step | Graph call | Scopes |
|---|---|---|
| Load risky users | GET /identityProtection/riskyUsers |
IdentityRiskyUser.Read.All |
Graph Scopes#
IdentityRiskyUser.Read.All
Write Behavior#
This is a read-only agent. It does not declare write operations.
LLM Use#
| Step | Settings |
|---|---|
| Classify this risky user | temperature 0.1 · max tokens 150 |
| Roll up triage results | temperature 0.2 · max tokens 420 |
Settings#
No user-configurable settings are declared.
Source#
Generated from repository metadata by generate-gitbook-docs.mjs.View as Markdown