Kaffeeundcode
n8n Flow-Bibliothek
n8n Workflow 01.06.2026

Flow Arbeitsbereich

Risky Users Alert

Flow prüfen, Nodes verstehen, JSON importieren und Credentials sauber anpassen.

Intune Workflows

Workflow Diagramm

auto-generiert 
graph LR
    N0(["⚡ 4 Hour Check"])
    N1["🔧 Get Risky Users"]
    N2{"🔀 If High Risk Found"}
    N3["🔧 Urgent Alert"]
    N0 --> N1
    N1 --> N2
    N2 --> N3

    classDef trigger fill:#f59e0b,stroke:#b45309,color:#000
    classDef action fill:#292524,stroke:#44403c,color:#e7e5e4
    classDef logic fill:#1e1b4b,stroke:#4338ca,color:#c7d2fe
    class N0 trigger
    class N1 action
    class N2 logic
    class N3 action

15_Risky_Users_Alert.json

{
    "name": "15_Risky_Users_Alert",
    "nodes": [
        {
            "parameters": {
                "rule": {
                    "interval": [
                        {
                            "field": "hours",
                            "hoursInterval": 4
                        }
                    ]
                }
            },
            "name": "4 Hour Check",
            "type": "n8n-nodes-base.schedule",
            "typeVersion": 1,
            "position": [
                250,
                300
            ]
        },
        {
            "parameters": {
                "authentication": "predefinedCredentialType",
                "nodeCredentialType": "microsoftGraphOAuth2Api",
                "requestMethod": "GET",
                "url": "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers?$filter=riskLevel eq 'high'",
                "options": {}
            },
            "name": "Get Risky Users",
            "type": "n8n-nodes-base.httpRequest",
            "typeVersion": 3,
            "position": [
                450,
                300
            ],
            "credentials": {
                "microsoftGraphOAuth2Api": {
                    "id": "YOUR_CREDENTIAL_ID",
                    "name": "Microsoft Graph Account"
                }
            }
        },
        {
            "parameters": {
                "conditions": {
                    "number": [
                        {
                            "value1": "={{ $json.value.length }}",
                            "operation": "larger",
                            "value2": 0
                        }
                    ]
                }
            },
            "name": "If High Risk Found",
            "type": "n8n-nodes-base.if",
            "typeVersion": 1,
            "position": [
                650,
                300
            ]
        },
        {
            "parameters": {
                "resource": "chat",
                "message": "=🚨 **HIGH RISK USERS DETECTED** 🚨nThe following users are flagged as High Risk:nn{{ $json.value.map(u => u.userPrincipalName).join(', ') }}nnPlease investigate immediately."
            },
            "name": "Urgent Alert",
            "type": "n8n-nodes-base.microsoftTeams",
            "typeVersion": 1,
            "position": [
                850,
                200
            ]
        }
    ],
    "connections": {
        "4 Hour Check": {
            "main": [
                [
                    {
                        "node": "Get Risky Users",
                        "type": "main",
                        "index": 0
                    }
                ]
            ]
        },
        "Get Risky Users": {
            "main": [
                [
                    {
                        "node": "If High Risk Found",
                        "type": "main",
                        "index": 0
                    }
                ]
            ]
        },
        "If High Risk Found": {
            "main": [
                [
                    {
                        "node": "Urgent Alert",
                        "type": "main",
                        "index": 0
                    }
                ]
            ]
        }
    }
}