The ServicePrincipal entity represents a service principal (enterprise application) in Azure Active Directory (Entra ID).
| Field | Type | Possible Operators | Description |
|---|---|---|---|
| Guid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique identifier for the entity in Forestall |
| ObjectID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Azure AD Object ID of the service principal |
| FSName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name used in Forestall |
| Enabled | BOOLEAN | N/A (toggle) | Whether the service principal is enabled |
| IsAZPrivileged | BOOLEAN | N/A (toggle) | Whether the service principal has privileged access in Azure |
| IsShadow | BOOLEAN | N/A (toggle) | Whether the service principal is a Shadow Admin |
| IsInactive | BOOLEAN | N/A (toggle) | Whether the service principal is inactive |
| IsAdmin | BOOLEAN | N/A (toggle) | Whether the service principal has admin privileges |
| DisplayName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name of the service principal in Azure AD |
| Description | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Description of the service principal |
| AppOwnerOrganizationID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Organization ID of the application owner |
| AppDescription | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Description of the associated application |
| AppDisplayName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name of the associated application |
| LoginURL | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Login URL configured for the service principal |
| ServicePrincipalType | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Type of service principal (e.g., Application, ManagedIdentity) |
| TenantID | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Azure AD Tenant ID the service principal belongs to |
| AZTier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Azure tier classification assigned by Forestall |
| IsARMPrivileged | BOOLEAN | N/A (toggle) | Whether the object holds a privileged Azure Resource Manager (ARM) role. |