Missing "identityProtection/settings/notifications" endpoint

[cnotin]

Describe the bug

Hello,

The beta Graph SDK has this useful endpoint: identityProtection/settings/notifications. It can be useful for security tools, including the US CISA's ScubaGear tool cisagov/ScubaGear#91

We observed it used by the Entra admin center in https://entra.microsoft.com/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/UsersAtRiskAlerts

However, it cannot be fetched using the Graph SDK. I believe the reason is, like for some of my previous issues, its lack in the Graph API metadata:

<EntityType Name="identityProtectionRoot">
<NavigationProperty Name="riskDetections" Type="Collection(graph.riskDetection)" ContainsTarget="true"/>
<NavigationProperty Name="riskyServicePrincipals" Type="Collection(graph.riskyServicePrincipal)" ContainsTarget="true"/>
<NavigationProperty Name="riskyUsers" Type="Collection(graph.riskyUser)" ContainsTarget="true"/>
<NavigationProperty Name="servicePrincipalRiskDetections" Type="Collection(graph.servicePrincipalRiskDetection)" ContainsTarget="true"/>
</EntityType>

It's also not documented yet, perhaps for the same reason?

Can you please open an internal ICM for the Graph team, then ensure it's available in the SDK?

Expected behavior

The endpoint is exposed and usable

How to reproduce

Try to call it: the code isn't available

SDK Version

No response

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

```

</details>


### Configuration

_No response_

### Other information

_No response_

[baywet]

Hi @cnotin
Thank you for using the SDK and for reaching out.

These APIs are hidden. This effectively means that only 1st party (Microsoft teams) are supposed to use them, they can change without notice, and 3rd party (customers, ISVs...) should not take a dependency on those as they might change/be removed at any moment without notice.

Please head over to the ideas website to propose a new idea/upvote an existing one.

Let us know if you have any additional comments or questions.

[cnotin]

Thank you Vincent. Me and my colleagues are really sad to hear that, because this API would have been useful for us. I'll suggest on the ideas website even though I don't have much hope :(
Requests:

• https://techcommunity.microsoft.com/idea/microsoft365developerplatform/graph-api-make-the-identityprotectionsettingsnotifications-endpoint-public/4394634
• https://feedbackportal.microsoft.com/feedback/idea/4289fd67-2e04-f011-a4dd-7c1e52ead3c1

How can we identify these hidden APIs? By the fact they aren't documented nor available in the Graph metadata? But what about real misses that we had reported in the past? Better to report all cases we find?

Thanks for your replies, we appreciate!

[baywet]

You really can't identity those. I know that because I have access to the internal version of the metadata (that get's deployed to the service) and this literally has a flag "is hidden".

If both the metadata (in the public version) and the documentation are absent, it's usually a good indicator. But it can also be an indicator that the workload didn't "complete" the work. (like you're experienced in your previous issues)

So yes, you'll have to reach out on one of the repositories, or to support, to "get the bad news".

As for the ideas not getting super far along, based on how deeply you're integrated with the API surface, I think it'd make sense for your team to join the Customer Experience Program. So you can get in touch with workload program manager and tell them "hey, we need that API, it impacts these many licenses,...".

Email me at my firstname.lastname@microsoft.com with company details, solutions you're providing to customers, how you enable more Office 365 consumption, and how many licenses you impact today if you're interested. But before you do so, please make sure that it's ok with your financial and legal departments to share that information first, and to sign non-disclosure agreements. Not everyone is eligible to to join the program too.

[cnotin]

Awesome, merci Vincent. I'll do that after discussing internally as suggested. My company already collaborate closely with Microsoft so I'm confident :)

[baywet]

Pas de problèmes! Closing this as there's no follow up for the SDKs.