api

Microsoft Graph Security API

The Microsoft Graph Security API is the unified Microsoft Graph surface for security alerts, incidents, actions, threat submissions, identity security data, and related security operations workflows across supported Microsoft security providers.

apisCurrent

Relationships

Example Request

http

GET https://graph.microsoft.com/v1.0/security/incidents
Authorization: Bearer <token>

API Access

Permission resource: Microsoft Graph
Portal search: Microsoft Graph
Lifecycle: current
Legacy names: Microsoft Graph Security tiIndicators API
Tracked application permissions: SecurityActions.ReadWrite.All, SecurityAlert.Create.All, SecurityAlert.Read.All, SecurityAlert.ReadWrite.All, SecurityAnalyzedMessage.Read.All, SecurityAnalyzedMessage.ReadWrite.All, SecurityEvents.Read.All, SecurityEvents.ReadWrite.All, SecurityIdentitiesAccount.Read.All, SecurityIdentitiesActions.ReadWrite.All, SecurityIdentitiesHealth.Read.All, SecurityIdentitiesHealth.ReadWrite.All, SecurityIdentitiesSensors.ReadWrite.All, SecurityIdentitiesUserActions.Read.All, SecurityIdentitiesUserActions.ReadWrite.All, SecurityIncident.Read.All, SecurityIncident.ReadWrite.All, ThreatHunting.Read.All, ThreatIndicators.Read.All, ThreatIndicators.ReadWrite.OwnedBy, ThreatIntelligence.Read.All, ThreatSubmission.Read.All, ThreatSubmission.ReadWrite.All, ThreatSubmissionPolicy.ReadWrite.All
Tracked delegated permissions: SecurityActions.ReadWrite.All, SecurityAlert.Create.All, SecurityAlert.Read.All, SecurityAlert.ReadWrite.All, SecurityAnalyzedMessage.Read.All, SecurityAnalyzedMessage.ReadWrite.All, SecurityEvents.Read.All, SecurityEvents.ReadWrite.All, SecurityIdentitiesAccount.Read.All, SecurityIdentitiesActions.ReadWrite.All, SecurityIdentitiesHealth.Read.All, SecurityIdentitiesHealth.ReadWrite.All, SecurityIdentitiesSensors.ReadWrite.All, SecurityIdentitiesUserActions.Read.All, SecurityIdentitiesUserActions.ReadWrite.All, SecurityIncident.Read.All, SecurityIncident.ReadWrite.All, ThreatHunting.Read.All, ThreatIndicators.Read.All, ThreatIndicators.ReadWrite.OwnedBy, ThreatIntelligence.Read.All, ThreatSubmission.Read, ThreatSubmission.Read.All, ThreatSubmission.ReadWrite, ThreatSubmission.ReadWrite.All, ThreatSubmissionPolicy.ReadWrite.All

Reference

Stable ID: microsoft-graph-security-api
Path: /entities/apis/microsoft-graph-security-api/
Last verified: 2026-08-11

Official Sources

Use the Microsoft Graph security APIOpen List incidentsOpen Threat intelligence in Microsoft SentinelOpen