This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 6%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED%3C/text%3E%3C/svg%3E)
Hello, I have a user in my Identity Protection>Risky Users that has been there for several months. This user was deleted a long time ago, and therefore I do not understand why this user is in the Risky user section? When I try to dismiss the user, the error appears "Unable to initiate user risk dismissal. Failed to initiate the process of dismissing risk for the user Isabela Garcia. Please try again in a few minutes."
I have tried this many time over the past few months, but the user cannot be deleted, is there any way to remove this user?
An Azure service that is used to control and help secure email, documents, and sensitive data that are shared outside the company.
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
A cloud-based identity and access management service for securing user authentication and resource access
A tool for managing user identities, credentials, and access across on-premises and cloud environments
Additional Microsoft Entra services and features related to identity, access, and network security
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 92%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDS%3C/text%3E%3C/svg%3E)
Hi. I am having same issue. Two users that have been deleted and no longer on our 365 portal since 2018 are still showing in Defender alerts as Risky Users (credentials leaked) no matter what I try to do they can't be removed so we will continually get alerts for these two users.
You may want to open a ticket with Azure support. Sounds like an orphaned object.
Hi @DSC
It seems like you are having trouble dismissing a user from the Risky Users section in Azure AD Identity Protection. If the user has been deleted from the directory, it is not possible for administrators to dismiss risk for that user. In this case, you will need to open a Microsoft support case to remove the deleted user. Regarding the error message you received, "Unable to initiate user risk dismissal. Failed to initiate the process of dismissing risk for the user", it could be due to a temporary issue with the service. I recommend waiting a few minutes and trying again. If the issue persists, you can try clearing your browser cache or using a different browser. I hope this helps! Let me know if you have any other questions.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Hi @DSC ,
I agree with what @Andy David - MVP advised.
To add more context, the issue you described represents a known issue for which the solution is to raise a support ticket and incident.
The portal team is currently working on a fix to enable deletion of risk data for these users from the UI.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 75%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDM%3C/text%3E%3C/svg%3E)
I have a similar issue where the user is still active but the risk log is several years old and will not allow us to dismiss the risk.