isc.sans.edu 8/20/2026, 1:30:42 PM · external

How PowerShell and Microsoft Graph Spot Risky Logins

How PowerShell and Microsoft Graph Spot Risky Logins
CyberSIXT Evidence Panel Source marked as original reporting

THE article discusses using Microsoft Graph and PowerShell for detecting risky logins. Key points include defining risky logins based on unusual geography or device, the necessity of licensing for accessing certain commands, and the use of specific PowerShell commands like `Get-MgRiskyUser` and `Get-MgRiskDetection`. It emphasizes filtering and extracting data related to risk reasons and locations from JSON responses, providing PowerShell examples to guide users in creating reports on risky logins.

View full article

Article by CyberSIXT