Home

risky users at unknown state

%3CLINGO-SUB%20id%3D%22lingo-sub-655263%22%20slang%3D%22en-US%22%3Erisky%20users%20at%20unknown%20state%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-655263%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ei'm%20wondering%20why%20some%20of%20my%20users%20don't%20disappear%20from%20the%20risky%20users%20page.%3C%2FP%3E%3CP%3EThey%20all%20have%20the%20status%20%22Unknown%22.%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20the%20details%20blade%20of%20the%20users%20there%20are%20no%20risk%20events%2C%20just%20the%20advise%20that%20all%20risk%20events%20are%20older%20than%2090%20days.%20Even%20if%20i%20click%20%22Dismiss%20all%20events%22%20they%20won't%20disappear.%3C%2FP%3E%3CP%3EUnfortunately%2C%20this%20distorts%20my%20overview%20or%20weekly%20digest.%3C%2FP%3E%3CP%3EBy%20the%20way%3A%20all%20of%20these%20users%20are%20already%20deleted%20in%20azure%20ad.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20any%20solution%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-655263%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIdentity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIdentity%20Protection%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ERisky%20Users%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-661230%22%20slang%3D%22en-US%22%3ERe%3A%20risky%20users%20at%20unknown%20state%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-661230%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20this%20after%2024%20hours%20from%20the%20point%20of%20dismissing%20the%20alerts%20for%20the%20users%3F%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275685%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-664169%22%20slang%3D%22en-US%22%3ERe%3A%20risky%20users%20at%20unknown%20state%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-664169%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F183000%22%20target%3D%22_blank%22%3E%40Bryan%20Haslip%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYes%2C%20i%20dismissed%20them%20many%20days%20ago.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-675994%22%20slang%3D%22en-US%22%3ERe%3A%20risky%20users%20at%20unknown%20state%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-675994%22%20slang%3D%22en-US%22%3E%3CP%3EI%20can%20actually%20confirm%20the%20same%20behavior%20for%20our%20Azure%20AD%20Tenant.%20I%20have%20some%20users%20with%20no%20alerts%20for%20over%20a%20year%20and%20they%20are%20still%20populated%20within%20the%20list.%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F275685%22%20target%3D%22_blank%22%3E%40PatrickF11%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-677612%22%20slang%3D%22en-US%22%3ERe%3A%20risky%20users%20at%20unknown%20state%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-677612%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F183000%22%20target%3D%22_blank%22%3E%40Bryan%20Haslip%3C%2FA%3E%26nbsp%3Bstrange...%20now%20they're%20gone...%3C%2FP%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Hi,

 

i'm wondering why some of my users don't disappear from the risky users page.

They all have the status "Unknown". 

In the details blade of the users there are no risk events, just the advise that all risk events are older than 90 days. Even if i click "Dismiss all events" they won't disappear.

Unfortunately, this distorts my overview or weekly digest.

By the way: all of these users are already deleted in azure ad.

 

Is there any solution?

 

4 Replies

Is this after 24 hours from the point of dismissing the alerts for the users? @PatrickF11 

Hi @Bryan Haslip 

 

Yes, i dismissed them many days ago.

I can actually confirm the same behavior for our Azure AD Tenant. I have some users with no alerts for over a year and they are still populated within the list. @PatrickF11 

@Bryan Haslip strange... now they're gone...