From 828680bd2465430aa86cacc4314982200ae6c1c5 Mon Sep 17 00:00:00 2001
From: August Dailey <August.1441@live.com>
Date: Mon, 23 Feb 2026 13:37:41 -0600
Subject: [PATCH] Add lastPasswordChangeDateTime to risky users export

---
 .../export-IdentityProtectionAllRiskyUsers.ps1           | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Identity Protection/export-IdentityProtectionAllRiskyUsers.ps1 b/Identity Protection/export-IdentityProtectionAllRiskyUsers.ps1
index dfcfd131..03097469 100644
--- a/Identity Protection/export-IdentityProtectionAllRiskyUsers.ps1	
+++ b/Identity Protection/export-IdentityProtectionAllRiskyUsers.ps1	
@@ -43,6 +43,13 @@ $uri = "https://graph.microsoft.com/beta/riskyUsers?`$filter=riskState eq 'atRis
 }
 
 
-getAADRiskyUsers | export-csv .\azuread_riskyusers.csv -notypeinformation
+$riskyUsers = getAADRiskyUsers
+foreach($riskyUser in $riskyUsers) {
+    
+    $userData = Get-MgUser -UserId $riskyUser.id -Property "lastPasswordChangeDateTime" | Select-Object lastPasswordChangeDateTime
+    $riskyUser | Add-Member -MemberType NoteProperty -Name lastPasswordChangeDateTime -Value $userData.lastPasswordChangeDateTime -Force
+}
+
+$riskyUsers | export-csv .\azuread_riskyusers.csv -notypeinformation
 
 write-host "Results can be found here: $resultslocation"