ESC
Type to search...

ThreatIntelligence.Read.All

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read All Resources

Allows the app to read threat intelligence information, such as indicators, observations, and and articles, without a signed in user.

Delegated Access App-Only Access

Permission Details

Application Permission

Read all Threat Intelligence Information

Allows the app to read threat intelligence information, such as indicators, observations, and and articles, without a signed in user.

Delegated Permission Admin consent required

Read all threat intelligence information

Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user.

Relationships

Relationship Type Description
articleIndicators articleIndicator collection Refers to indicators of threat or compromise highlighted in an microsoft.graph.security.article.
articles article collection A list of article objects.
hostComponents hostComponent collection Retrieve details about hostComponent objects.
hostCookies hostCookie collection Retrieve details about hostCookie objects.
hostPairs hostPair collection Retrieve details about hostPair objects.
hostPorts hostPort collection Retrieve details about hostPort objects.
hosts host collection Refers to host objects that Microsoft Threat Intelligence has observed.
hostSslCertificates hostSslCertificate collection Retrieve details about hostSslCertificate objects.
hostTrackers hostTracker collection Retrieve details about hostTracker objects.
intelligenceProfileIndicators intelligenceProfileIndicator collection Refers to indicators of threat or compromise highlighted in an microsoft.graph.security.intelligenceProfile.
intelProfiles intelligenceProfile collection A list of intelligenceProfile objects.
passiveDnsRecords passiveDnsRecord collection Retrieve details about passiveDnsRecord objects.
sslCertificates sslCertificate collection Retrieve details about sslCertificate objects.
subdomains subdomain collection Retrieve details about the subdomain.
vulnerabilities vulnerability collection Retrieve details about vulnerabilities.
whoisHistoryRecords whoisHistoryRecord collection Retrieve details about whoisHistoryRecord objects.
whoisRecords whoisRecord collection A list of whoisRecord objects.

Graph Methods

Delegated access App-only access
Methods
GET /security/threatIntelligence/articleIndicators/{articleIndicatorId}
GET /security/threatIntelligence/articles
GET /security/threatIntelligence/articles/{articleId}
GET /security/threatIntelligence/articles/{articleId}/indicators
GET /security/threatIntelligence/hostComponents/{hostComponentId}
GET /security/threatIntelligence/hostCookies/{hostCookieId}
GET /security/threatIntelligence/hostPairs/{hostPairId}
GET /security/threatIntelligence/hostPorts/{hostPortId}
GET /security/threatIntelligence/hosts/{hostId}
GET /security/threatIntelligence/hosts/{hostId}/childHostPairs
GET /security/threatIntelligence/hosts/{hostId}/components
GET /security/threatIntelligence/hosts/{hostId}/cookies
GET /security/threatIntelligence/hosts/{hostId}/hostPairs
GET /security/threatIntelligence/hosts/{hostId}/parentHostPairs
GET /security/threatIntelligence/hosts/{hostId}/passiveDns
GET /security/threatIntelligence/hosts/{hostId}/passiveDnsReverse
GET /security/threatIntelligence/hosts/{hostId}/ports
GET /security/threatIntelligence/hosts/{hostId}/reputation
GET /security/threatIntelligence/hosts/{hostId}/sslCertificates
GET /security/threatIntelligence/hosts/{hostId}/subdomains
GET /security/threatIntelligence/hosts/{hostId}/trackers
GET /security/threatIntelligence/hosts/{hostId}/whois
GET /security/threatIntelligence/hosts/{hostId}/whois/history
GET /security/threatIntelligence/hostSslCertificates/{hostSslCertificateId}
GET /security/threatIntelligence/hostTrackers/{hostTrackerId}
GET /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicatorId}
GET /security/threatIntelligence/intelProfiles
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}/indicators
GET /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecordId}
GET /security/threatIntelligence/sslCertificates?$search={property_name}:{property_value}
GET /security/threatIntelligence/sslCertificates/{sslCertificateId}
GET /security/threatIntelligence/subdomains/{subdomainId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components/{vulnerabilityComponentId}
GET /security/threatIntelligence/whoisHistoryRecord/{whoisHistoryRecordId}
GET /security/threatIntelligence/whoisRecords?$search={value}
GET /security/threatIntelligence/whoisRecords/{id}/history
GET https://graph.microsoft.com/v1.0/security/auditLog/queries/{auditLogQueryId}
GET security/threatIntelligence/sslCertificates/{sslCertificateId}/relatedHosts
Methods
GET /security/threatIntelligence/articleIndicators/{articleIndicatorId}
GET /security/threatIntelligence/articles
GET /security/threatIntelligence/articles/{articleId}
GET /security/threatIntelligence/articles/{articleId}/indicators
GET /security/threatIntelligence/hostComponents/{hostComponentId}
GET /security/threatIntelligence/hostCookies/{hostCookieId}
GET /security/threatIntelligence/hostPairs/{hostPairId}
GET /security/threatIntelligence/hostPorts/{hostPortId}
GET /security/threatIntelligence/hosts/{hostId}
GET /security/threatIntelligence/hosts/{hostId}/childHostPairs
GET /security/threatIntelligence/hosts/{hostId}/components
GET /security/threatIntelligence/hosts/{hostId}/cookies
GET /security/threatIntelligence/hosts/{hostId}/hostPairs
GET /security/threatIntelligence/hosts/{hostId}/parentHostPairs
GET /security/threatIntelligence/hosts/{hostId}/passiveDns
GET /security/threatIntelligence/hosts/{hostId}/passiveDnsReverse
GET /security/threatIntelligence/hosts/{hostId}/ports
GET /security/threatIntelligence/hosts/{hostId}/reputation
GET /security/threatIntelligence/hosts/{hostId}/sslCertificates
GET /security/threatIntelligence/hosts/{hostId}/subdomains
GET /security/threatIntelligence/hosts/{hostId}/trackers
GET /security/threatIntelligence/hosts/{hostId}/whois
GET /security/threatIntelligence/hosts/{hostId}/whois/history
GET /security/threatIntelligence/hostSslCertificates/{hostSslCertificateId}
GET /security/threatIntelligence/hostTrackers/{hostTrackerId}
GET /security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicatorId}
GET /security/threatIntelligence/intelProfiles
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}
GET /security/threatIntelligence/intelProfiles/{intelligenceProfileId}/indicators
GET /security/threatIntelligence/passiveDnsRecords/{passiveDnsRecordId}
GET /security/threatIntelligence/sslCertificates
GET /security/threatIntelligence/sslCertificates/{sslCertificateId}
GET /security/threatIntelligence/subdomains/{subdomainId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components
GET /security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components/{vulnerabilityComponentId}
GET /security/threatIntelligence/whoisHistoryRecord/{whoisHistoryRecordId}
GET /security/threatIntelligence/whoisRecords?$search={value}
GET /security/threatIntelligence/whoisRecords/{id}/history
GET security/threatIntelligence/sslCertificates/{sslCertificateId}/relatedHosts

Code Examples

C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;

// Delegated permissions - interactive user sign-in
var scopes = new[] { "ThreatIntelligence.Read.All" };
var options = new InteractiveBrowserCredentialOptions
{
    ClientId = "YOUR_CLIENT_ID",
    TenantId = "YOUR_TENANT_ID",
    RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);

// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");

// Application permissions - daemon/service app
var tenantId = "YOUR_TENANT_ID";
var clientId = "YOUR_CLIENT_ID";
var clientSecret = "YOUR_CLIENT_SECRET";

var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
var graphClient = new GraphServiceClient(credential);

// Example: GET /users/{user-id}
var users = await graphClient.Users.GetAsync();
foreach (var user in users?.Value ?? [])
{
    Console.WriteLine($"User: {user.DisplayName}");
}
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from 
    "@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";

const msalConfig = {
    auth: {
        clientId: "YOUR_CLIENT_ID",
        authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
    }
};

const pca = new PublicClientApplication(msalConfig);
await pca.initialize();

// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
    scopes: ["ThreatIntelligence.Read.All"]
});

const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
    account: loginResponse.account,
    scopes: ["ThreatIntelligence.Read.All"],
    interactionType: "popup"
});

const graphClient = Client.initWithMiddleware({ authProvider });

// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);

// Application: Use client credentials (Node.js backend only)
// npm install @azure/identity @microsoft/microsoft-graph-client
import { ClientSecretCredential } from "@azure/identity";
import { TokenCredentialAuthenticationProvider } from 
    "@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials";

const credential = new ClientSecretCredential(
    "YOUR_TENANT_ID",
    "YOUR_CLIENT_ID", 
    "YOUR_CLIENT_SECRET"
);

const authProvider = new TokenCredentialAuthenticationProvider(credential, {
    scopes: ["https://graph.microsoft.com/.default"]
});

const graphClient = Client.initWithMiddleware({ authProvider });
const result = await graphClient.api("/users").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser

# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "ThreatIntelligence.Read.All"

# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes

# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5

# Application access with certificate
$params = @{
    ClientId = "YOUR_CLIENT_ID"
    TenantId = "YOUR_TENANT_ID"
    CertificateThumbprint = "YOUR_CERT_THUMBPRINT"
}
Connect-MgGraph @params

# Or with client secret (not recommended for production)
# Connect-MgGraph -ClientSecretCredential $credential

# Example: GET /users
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users"
$result | ConvertTo-Json -Depth 5

# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio

# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
    client_id="YOUR_CLIENT_ID",
    tenant_id="YOUR_TENANT_ID"
)
scopes = ["ThreatIntelligence.Read.All"]
client = GraphServiceClient(credential, scopes)

async def get_data():
    # Example: GET /me
    result = await client.me.get()
    print(f"User: {result.display_name}")
    return result

asyncio.run(get_data())

# Application permissions - client credentials
credential = ClientSecretCredential(
    tenant_id="YOUR_TENANT_ID",
    client_id="YOUR_CLIENT_ID",
    client_secret="YOUR_CLIENT_SECRET"
)
scopes = ["https://graph.microsoft.com/.default"]
client = GraphServiceClient(credential, scopes)

async def get_users():
    # Example: GET /users
    result = await client.users.get()
    for user in result.value:
        print(f"User: {user.display_name}")
    return result

asyncio.run(get_users())

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or Delegated permissions and search for ThreatIntelligence.Read.All

4

Grant Admin Consent

Application permissions always require admin consent. Click "Grant admin consent" in the Azure portal.