ThreatAssessment.Read.All | Graph Permissions

Permission Details

Application Permission

Read threat assessment requests

Allows an app to read your organization's threat assessment requests, without a signed-in user.

Permission ID: f8f035bb-2cce-47fb-8bf5-7baf3ecbee48

Properties

Microsoft Graph v1.0 mapped-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property	Type	Description
`category`	`threatCategory`	The threat category. The possible values are: spam, phishing, malware.
`contentType`	`threatAssessmentContentType`	The content type of threat assessment. The possible values are: mail, url, file.
`createdBy`	`identitySet`	The threat assessment request creator.
`createdDateTime`	`DateTimeOffset`Nullable	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
`expectedAssessment`	`threatExpectedAssessment`	The expected assessment from submitter. The possible values are: block, unblock.
`id`	`String`	The threat assessment request ID is a globally unique identifier (GUID).
`requestSource`	`threatAssessmentRequestSource`	The source of the threat assessment request. The possible values are: administrator.
`status`	`threatAssessmentStatus`	The assessment process status. The possible values are: pending, completed.
`results`	`threatAssessmentResult collection`	A collection of threat assessment results. Read-only. By default, a GET /threatAssessmentRequests/{id} does not return this property unless you apply $expand on it.

JSON Representation

Microsoft Graph v1.0 mapped-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation

{
  "category": "String",
  "contentType": "String",
  "createdBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "createdDateTime": "String (timestamp)",
  "expectedAssessment": "String",
  "id": "String (identifier)",
  "requestSource": "String",
  "status": "String"
}

Relationships

Microsoft Graph v1.0 mapped-docs

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship	Type	Description
`results`	`threatAssessmentResult collection`	A collection of threat assessment results. Read-only. By default, a GET /threatAssessmentRequests/{id} does not return this property unless you apply $expand on it.
`category`	`threatCategory`	Related category data exposed by this resource.
`expectedAssessment`	`threatExpectedAssessment`	Related expectedAssessment data exposed by this resource.

Graph Methods

Delegated access App-only access

Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/informationProtection/threatAssessmentRequests`
GET `/informationProtection/threatAssessmentRequests/{id}`

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/informationProtection/threatAssessmentRequests`
GET `/informationProtection/threatAssessmentRequests/{id}`

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgInformationProtectionThreatAssessmentRequest` /informationProtection/threatAssessmentRequests List threatAssessmentRequests
`Get-MgInformationProtectionThreatAssessmentRequest` /informationProtection/threatAssessmentRequests/{id} Get threatAssessmentRequest

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgBetaInformationProtectionThreatAssessmentRequest` /informationProtection/threatAssessmentRequests List threatAssessmentRequests
`Get-MgBetaInformationProtectionThreatAssessmentRequest` /informationProtection/threatAssessmentRequests/{id} Get threatAssessmentRequest

Code Examples

C# / .NET SDK

Get threatAssessmentRequest

View official example on Microsoft Learn

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.InformationProtection.ThreatAssessmentRequests["{threatAssessmentRequest-id}"].GetAsync();

JavaScript

Get threatAssessmentRequest

View official example on Microsoft Learn

const options = {
	authProvider,
};

const client = Client.init(options);

let threatAssessmentRequest = await client.api('/informationProtection/threatAssessmentRequests/49c5ef5b-1f65-444a-e6b9-08d772ea2059')
	.get();

PowerShell

Get threatAssessmentRequest

View official example on Microsoft Learn

Import-Module Microsoft.Graph.Identity.SignIns

Get-MgInformationProtectionThreatAssessmentRequest -ThreatAssessmentRequestId $threatAssessmentRequestId

Python

Get threatAssessmentRequest

View official example on Microsoft Learn

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

result = await graph_client.information_protection.threat_assessment_requests.by_threat_assessment_request_id('threatAssessmentRequest-id').get()

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions and search for ThreatAssessment.Read.All

4

Grant Admin Consent

Application permissions always require admin consent.

Frequently asked questions

What is the ThreatAssessment.Read.All Microsoft Graph permission?

ThreatAssessment.Read.All is an application-only permission in the Microsoft Graph API, grouped under the ThreatAssessment category. Allows an app to read your organization's threat assessment requests, without a signed-in user. It grants read-only access to resources. Application permissions always require admin consent. It is mapped to the Microsoft Graph threatassessmentrequest resource type. 4 documented Microsoft Graph REST methods require it. 4 Microsoft Graph PowerShell commands are documented for it.

Is ThreatAssessment.Read.All an application or a delegated permission?

ThreatAssessment.Read.All is an application permission only. It grants app-only access without a signed-in user and always requires admin consent.

Does ThreatAssessment.Read.All require admin consent?

Application permissions always require admin consent.

What is the permission ID (GUID) for ThreatAssessment.Read.All?

For ThreatAssessment.Read.All, the application (app role) ID is f8f035bb-2cce-47fb-8bf5-7baf3ecbee48. These are the real Microsoft Graph identifiers and can be used directly in an app registration manifest.