> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/azure-entities/azure-resource-management/armrole.md).

# ARMRole

The **ARMRole** entity represents an Azure Resource Manager (ARM) role definition used for role-based access control (RBAC).

| Field           | Type    | Possible Operators                                             | Description                                                                                                                                              |
| --------------- | ------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Guid            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Unique identifier for the entity in Forestall                                                                                                            |
| ObjectID        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Azure Object ID of the ARM role                                                                                                                          |
| FSName          | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Display name used in Forestall                                                                                                                           |
| Description     | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Description of the ARM role                                                                                                                              |
| IsAZPrivileged  | BOOLEAN | N/A (toggle)                                                   | Whether the role grants privileged access in Azure                                                                                                       |
| IsBuiltIn       | BOOLEAN | N/A (toggle)                                                   | Whether the role is a built-in Azure ARM role                                                                                                            |
| AZTier          | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Azure tier classification assigned by Forestall                                                                                                          |
| RoleName        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Name of the ARM role definition as shown in the Azure portal.                                                                                            |
| risk            | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Risk score calculated by Forestall.                                                                                                                      |
| ExposurePoint   | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Exposure point score calculated by Forestall.                                                                                                            |
| TenantID        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | ID of the Entra ID tenant the role belongs to.                                                                                                           |
| Type            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Role type: `BuiltInRole` or `CustomRole`.                                                                                                                |
| IsARMPrivileged | BOOLEAN | N/A (toggle)                                                   | Whether Forestall considers the role privileged, from built-in role metadata or, for custom roles, from its effective permissions and assignable scopes. |
| MemberCount     | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Number of principals assigned the role.                                                                                                                  |