Group

The Group entity represents a group in Azure Active Directory (Entra ID).

Field	Type	Possible Operators	Description
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Unique identifier for the entity in Forestall
ObjectID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Azure AD Object ID of the group
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name used in Forestall
WhenCreated	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Date the group was created
Description	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Description of the group
DisplayName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name of the group in Azure AD
IsAssignableToRole	BOOLEAN	N/A (toggle)	Whether the group can be assigned to an Azure AD role
OnPremSID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	On-premises Security Identifier (SID)
OnPremSyncEnabled	BOOLEAN	N/A (toggle)	Whether the group is synced from on-premises AD
SecurityEnabled	BOOLEAN	N/A (toggle)	Whether the group is security-enabled
SecurityIdentifier	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Security Identifier of the group
TenantID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Azure AD Tenant ID the group belongs to
MailEnabled	BOOLEAN	N/A (toggle)	Whether the group is mail-enabled
IsAZPrivileged	BOOLEAN	N/A (toggle)	Whether the group has privileged access in Azure
IsShadow	BOOLEAN	N/A (toggle)	Whether the group is a Shadow Admin group
IsAdmin	BOOLEAN	N/A (toggle)	Whether the group has admin privileges
GroupType	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Type of group (e.g., Unified, Security)
MembershipType	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Membership type (e.g., Assigned, Dynamic)
MembershipRule	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Dynamic membership rule expression
MembershipRuleProcessingState	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Processing state of the dynamic membership rule
MemberCount	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Number of members in the group
AZTier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Azure tier classification assigned by Forestall
IsARMPrivileged	BOOLEAN	N/A (toggle)	Whether the object holds a privileged Azure Resource Manager (ARM) role.