{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "#/components/schemas/microsoft.graph.riskServicePrincipalActivity",
  "title": "riskServicePrincipalActivity",
  "required": [
    "@odata.type"
  ],
  "type": "object",
  "properties": {
    "detail": {
      "anyOf": [
        {
          "$ref": "#/components/schemas/microsoft.graph.riskDetail"
        },
        {
          "type": "object",
          "nullable": true
        }
      ],
      "description": "Details of the detected risk. Note: Details for this property are only available for Workload Identities Premium customers. Events in tenants without this license will be returned hidden."
    },
    "riskEventTypes": {
      "type": "array",
      "items": {
        "type": "string",
        "nullable": true
      },
      "description": "The type of risk event detected. The possible values are: investigationsThreatIntelligence, generic, adminConfirmedServicePrincipalCompromised, suspiciousSignins, leakedCredentials, anomalousServicePrincipalActivity, maliciousApplication, suspiciousApplication."
    },
    "@odata.type": {
      "type": "string"
    }
  }
}