The ARMRole entity represents an Azure Resource Manager (ARM) role definition used for role-based access control (RBAC).
| Field | Type | Possible Operators | Description |
|---|---|---|---|
| Guid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique identifier for the entity in Forestall |
| ObjectID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Azure Object ID of the ARM role |
| FSName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name used in Forestall |
| Description | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Description of the ARM role |
| IsAZPrivileged | BOOLEAN | N/A (toggle) | Whether the role grants privileged access in Azure |
| IsBuiltIn | BOOLEAN | N/A (toggle) | Whether the role is a built-in Azure ARM role |
| AZTier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Azure tier classification assigned by Forestall |
| RoleName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Name of the ARM role definition as shown in the Azure portal. |
| risk | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Risk score calculated by Forestall. |
| ExposurePoint | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Exposure point score calculated by Forestall. |
| TenantID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | ID of the Entra ID tenant the role belongs to. |
| Type | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Role type: BuiltInRole or CustomRole. |
| IsARMPrivileged | BOOLEAN | N/A (toggle) | Whether Forestall considers the role privileged, from built-in role metadata or, for custom roles, from its effective permissions and assignable scopes. |
| MemberCount | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Number of principals assigned the role. |