diff --git a/specification/adhybridhealthservice/resource-manager/Microsoft.ADHybridHealthService/stable/2014-01-01/ADHybridHealthService.json b/specification/adhybridhealthservice/resource-manager/Microsoft.ADHybridHealthService/stable/2014-01-01/ADHybridHealthService.json
index 56af5a164574..41527760bf48 100644
--- a/specification/adhybridhealthservice/resource-manager/Microsoft.ADHybridHealthService/stable/2014-01-01/ADHybridHealthService.json
+++ b/specification/adhybridhealthservice/resource-manager/Microsoft.ADHybridHealthService/stable/2014-01-01/ADHybridHealthService.json
@@ -3258,6 +3258,76 @@
           }
         }
       }
+    },
+    "/providers/Microsoft.ADHybridHealthService/services/{serviceName}/reports/riskyIp/blobUris": {
+      "get": {
+        "tags": [ "Reports" ],
+        "description": "Gets all Risky IP report URIs for the last 7 days.",
+        "x-ms-examples": {
+          "services_listAllRiskyIpDownloadReport": {
+            "$ref": "./examples/RiskyIpDownload.json"
+          }
+        },
+        "operationId": "services_listAllRiskyIpDownloadReport",
+        "parameters": [
+          {
+            "name": "serviceName",
+            "in": "path",
+            "description": "The name of the service.",
+            "required": true,
+            "type": "string"
+          },          
+          {
+            "$ref": "#/parameters/apiVersionParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Risky IP report URIs for the last 7 days.",
+            "schema": {
+              "$ref": "#/definitions/RiskyIPBlobUris"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": null
+        }
+      }
+    },
+    "/providers/Microsoft.ADHybridHealthService/services/{serviceName}/reports/riskyIp/generateBlobUri": {
+      "post": {
+        "tags": [ "Reports" ],
+        "description": "Initiate the generation of a new Risky IP report. Returns the URI for the new one.",
+        "x-ms-examples": {
+          "services_listCurrentRiskyIpDownloadReport": {
+            "$ref": "./examples/RiskyIpDownload.json"
+          }
+        },
+        "operationId": "services_listCurrentRiskyIpDownloadReport",
+        "parameters": [
+          {
+            "name": "serviceName",
+            "in": "path",
+            "description": "The name of the service.",
+            "required": true,
+            "type": "string"
+          },          
+          {
+            "$ref": "#/parameters/apiVersionParameter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The URI of the Risky IP report that was requested.",
+            "schema": {
+              "$ref": "#/definitions/RiskyIPBlobUris"
+            }
+          }
+        },
+        "x-ms-pageable": {
+          "nextLinkName": null
+        }
+      }
     }
   },
   "definitions": {
@@ -5721,6 +5791,51 @@
         }
       }
     },
+    "RiskyIPBlobUri": {
+      "description": "The blob uri pointing to Risky IP Report.",
+      "type": "object",
+      "properties": {
+        "tenantId": {
+          "description": "The tenant id for whom the report belongs to.",
+          "type": "string"
+        },
+        "serviceId": {
+          "description": "The service id for whom the report belongs to.",
+          "type": "string"
+        },
+        "resultSasUri": {
+          "description": "The blob uri for the report.",
+          "type": "string"
+        },
+        "blobCreateDateTime": {
+          "description": "Time at which the the new Risky IP report was requested.",
+          "type": "string",
+          "format": "date-time"
+        },
+        "jobCompletionTime": {
+          "description": "Time at which the blob creation job for the new Risky IP report was completed.",
+          "type": "string",
+          "format": "date-time"
+        },
+        "status": {
+          "description": "Status of the Risky IP report generation.",
+          "type": "string"
+        }
+      }
+    },
+    "RiskyIPBlobUris": {
+      "description": "The list containing blob uris.",
+      "type": "object",
+      "properties": {
+        "value": {
+          "description": "The list of blob uris.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/RiskyIPBlobUri"
+          }
+        }
+      }
+    },
     "RuleErrorInfo": {
       "description": "The error details in legacy rule processing.",
       "type": "object",
diff --git a/specification/adhybridhealthservice/resource-manager/Microsoft.ADHybridHealthService/stable/2014-01-01/examples/RiskyIpDownload.json b/specification/adhybridhealthservice/resource-manager/Microsoft.ADHybridHealthService/stable/2014-01-01/examples/RiskyIpDownload.json
new file mode 100644
index 000000000000..9f4a11b12d58
--- /dev/null
+++ b/specification/adhybridhealthservice/resource-manager/Microsoft.ADHybridHealthService/stable/2014-01-01/examples/RiskyIpDownload.json
@@ -0,0 +1,22 @@
+{
+  "parameters": {
+    "serviceName": "sampleServiceName",
+    "api-version": "2014-01-01"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "value": [
+          {            
+            "tenantId": "TenantId of the tenant.",
+            "serviceId": "ServiceId of the tenant.",
+            "resultSasUri": "SAS Uri of the blob.", 
+            "blobCreateDateTime": "2019-01-07T20:32:02+00:00",
+            "jobCompletionTime": "2019-01-07T20:32:05+00:00",
+            "status": "status of the task."
+          }
+        ]
+      }
+    }
+  }
+}
\ No newline at end of file