ServicePrincipal

The ServicePrincipal entity represents a service principal (enterprise application) in Azure Active Directory (Entra ID).

Field	Type	Possible Operators	Description
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Unique identifier for the entity in Forestall
ObjectID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Azure AD Object ID of the service principal
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name used in Forestall
Enabled	BOOLEAN	N/A (toggle)	Whether the service principal is enabled
IsAZPrivileged	BOOLEAN	N/A (toggle)	Whether the service principal has privileged access in Azure
IsShadow	BOOLEAN	N/A (toggle)	Whether the service principal is a Shadow Admin
IsInactive	BOOLEAN	N/A (toggle)	Whether the service principal is inactive
IsAdmin	BOOLEAN	N/A (toggle)	Whether the service principal has admin privileges
DisplayName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name of the service principal in Azure AD
Description	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Description of the service principal
AppOwnerOrganizationID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Organization ID of the application owner
AppDescription	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Description of the associated application
AppDisplayName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name of the associated application
LoginURL	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Login URL configured for the service principal
ServicePrincipalType	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Type of service principal (e.g., Application, ManagedIdentity)
TenantID	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Azure AD Tenant ID the service principal belongs to
AZTier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Azure tier classification assigned by Forestall
IsARMPrivileged	BOOLEAN	N/A (toggle)	Whether the object holds a privileged Azure Resource Manager (ARM) role.