ARMRole

The ARMRole entity represents an Azure Resource Manager (ARM) role definition used for role-based access control (RBAC).

Field	Type	Possible Operators	Description
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Unique identifier for the entity in Forestall
ObjectID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Azure Object ID of the ARM role
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name used in Forestall
Description	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Description of the ARM role
IsAZPrivileged	BOOLEAN	N/A (toggle)	Whether the role grants privileged access in Azure
IsBuiltIn	BOOLEAN	N/A (toggle)	Whether the role is a built-in Azure ARM role
AZTier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Azure tier classification assigned by Forestall
RoleName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Name of the ARM role definition as shown in the Azure portal.
risk	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Risk score calculated by Forestall.
ExposurePoint	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Exposure point score calculated by Forestall.
TenantID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	ID of the Entra ID tenant the role belongs to.
Type	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Role type: BuiltInRole or CustomRole.
IsARMPrivileged	BOOLEAN	N/A (toggle)	Whether Forestall considers the role privileged, from built-in role metadata or, for custom roles, from its effective permissions and assignable scopes.
MemberCount	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Number of principals assigned the role.