Get-EntraRiskyUsersReport

<#
.SYNOPSIS
    Reports users currently flagged as risky by Entra ID Protection.

.DESCRIPTION
    Lists every user with an active risk state, the risk level, and last
    updated time, so risky accounts get triaged the same day rather than
    during a periodic review.

.EXAMPLE
    .\Get-EntraRiskyUsersReport.ps1

.NOTES
    Requires Microsoft.Graph.Identity.SignIns with an active
    Connect-MgGraph session and IdentityRiskyUser.Read.All scope
    (Entra ID P2 required for risk detection).

.AUTHOR
    Shehryar Hassan
#>

$riskyUsers = Get-MgRiskyUser -All | Where-Object { $_.RiskState -in @("atRisk", "confirmedCompromised") }

$report = $riskyUsers | Select-Object UserPrincipalName, RiskLevel, RiskState, RiskLastUpdatedDateTime

$report | Sort-Object RiskLevel -Descending | Format-Table -AutoSize
Write-Warning "$($report.Count) user(s) currently flagged as risky"