For a complete technical description of JSON Pointer syntax, see JavaScript Object Notation (JSON) Pointer on ietf.org.

For a list of all possible values for each attribute, see Risky user in the Azure AD documentation.

Example JSON payload

{
   "@odata.type": "#microsoft.graph.riskyUser",
   "id": "41a31b00-3b3b-42d9-8f1c-6d4f14e74c69",
   "isDeleted": false,
   "isProcessing": false,
   "riskLastUpdatedDateTime": "2019-05-03T03:50:34.9565578Z",
   "riskLevel": "low",
   "riskState": "remediated",
   "riskDetail": "userPerformedSecuredPasswordReset",
   "userDisplayName": "Allan Deyoung",
   "userPrincipalName": "AllanD@contoso.OnMicrosoft.com"
}
Description JSON Pointer Example value
Risk level /riskLevel low
Risk state /riskState remediated
User name /userDisplayName Allan Deyoung

To populate an attribute with the entire JSON response, leave the Azure Response Mappings field blank.