The Application entity represents an application registration in Azure Active Directory (Entra ID).
| Field | Type | Possible Operators | Description |
|---|---|---|---|
| Guid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique identifier for the entity in Forestall |
| ObjectID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Azure AD Object ID of the application |
| FSName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name used in Forestall |
| DisplayName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name of the application in Azure AD |
| Description | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Description of the application |
| LastSeen | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Last time the application was observed |
| WhenCreated | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Date the application was created |
| AppID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Application (client) ID |
| PublisherDomain | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Publisher domain of the application |
| SignInAudience | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Supported sign-in audience (e.g., AzureADMyOrg, AzureADMultipleOrgs) |
| HasKeyCredentials | BOOLEAN | N/A (toggle) | Whether the application has key (certificate) credentials |
| HasPasswordCredentials | BOOLEAN | N/A (toggle) | Whether the application has password (secret) credentials |
| HasDangerousPermissions | BOOLEAN | N/A (toggle) | Whether the application has dangerous API permissions |
| TenantID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Azure AD Tenant ID the application belongs to |
| AZTier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Azure tier classification assigned by Forestall |