What it works with
Module: Microsoft.Graph.Authentication
Context: PowerShell 7 · Microsoft Graph · Microsoft Entra ID Protection
Compatibility: PowerShell 7 is the supported target for this Microsoft Graph Entra template.
POWERSHELL / MICROSOFT.GRAPH.AUTHENTICATION
ProAdvancedRead-onlylow
Export Entra risky users
Exports Microsoft Entra Identity Protection risky-user state, risk level, risk detail and the latest risk update from Microsoft Graph v1.0.
Pro generation after license validation · Review before running · No tenant access
What this PowerShell script does
Exports Microsoft Entra Identity Protection risky-user state, risk level, risk detail and the latest risk update from Microsoft Graph v1.0.
Requirements
- CSV output path - Example: C:\Temp\entra-report.csv
Environment
- Module: Microsoft.Graph.Authentication
- Permissions: IdentityRiskyUser.Read.All
- Output: CSV report
- Context: PowerShell 7 · Microsoft Graph
- Risk: Low
Review before you run Review the generated PowerShell and scope before running it.
OPS / WORKSPACE
Ready to generate
Configure Export Entra risky users in the Builder, review the generated PowerShell and run it in your own environment.
Why use this template?
Use this report for security review and investigation triage. It records the risky-user state exposed by Microsoft Entra Identity Protection without dismissing risk or confirming compromise; a risk signal should be investigated before remediation.
The template uses Microsoft.Graph.Authentication and requires IdentityRiskyUser.Read.All. Output: CSV report. Level: Advanced. Action: Read-only. Risk: Low.
Review before running
This API requires Microsoft Entra ID P2 and a supported reader role. Review the generated script, protect the security report appropriately and remember that a risky-user signal is not proof of compromise.
Generate the script
- Open the template in the PowerShell Builder.
- Enter the requested values and review the module, permissions, output and risk.
- Generate the script, read it carefully, and test it outside production before use.
For Pro templates, only the configuration values needed by this template are sent to Opselith after license validation. The script source remains server-side until generation.
Generate Export Entra risky users →OPS / SCRIPT DETAILS
Script details
Exports Microsoft Entra Identity Protection risky-user state, risk level/detail and last risk update from the stable Microsoft Graph v1.0 riskyUsers API. Review these details before generating or running the script.
Permissions and impact
Permissions: IdentityRiskyUser.Read.All
Risk: Low
Execution impact: Read-only. The script reads Microsoft Entra Identity Protection risky-user state through Microsoft Graph and does not dismiss risk, confirm compromise, reset passwords or change user accounts.
Parameters
- CSV output path - Use a new absolute Windows CSV path, for example C:\\Temp\\entra-report.csv.
Output
Output: CSV with UserId, UserDisplayName, UserPrincipalName, RiskLevel, RiskState, RiskDetail, RiskLastUpdatedDateTime, IsDeleted and IsProcessing.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Exports Microsoft Entra Identity Protection risky-user state, risk level/detail and last risk update from the stable Microsoft Graph v1.0 riskyUsers API.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7 with Microsoft.Graph.Authentication. Confirm Microsoft Entra ID P2 licensing and a supported Security/Global Reader role, sign in with IdentityRiskyUser.Read.All, choose a new CSV path and protect the resulting security report appropriately.
ValidationRecorded evidenceQA reviewed
Static QAPassed
PSScriptAnalyzerPassed
Runtime testedNot yet recorded
Last validatedNot yet recorded
Runtime and community evidence change only after an external tester result is reviewed and accepted for release evidence.
Tester: report a result →Was this useful?One click. No email.