> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/azure-entities/entra-id/serviceprincipal.md).

# ServicePrincipal

The **ServicePrincipal** entity represents a service principal (enterprise application) in Azure Active Directory (Entra ID).

| Field                  | Type    | Possible Operators                                             | Description                                                              |
| ---------------------- | ------- | -------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Guid                   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Unique identifier for the entity in Forestall                            |
| ObjectID               | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Azure AD Object ID of the service principal                              |
| FSName                 | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Display name used in Forestall                                           |
| Enabled                | BOOLEAN | N/A (toggle)                                                   | Whether the service principal is enabled                                 |
| IsAZPrivileged         | BOOLEAN | N/A (toggle)                                                   | Whether the service principal has privileged access in Azure             |
| IsShadow               | BOOLEAN | N/A (toggle)                                                   | Whether the service principal is a Shadow Admin                          |
| IsInactive             | BOOLEAN | N/A (toggle)                                                   | Whether the service principal is inactive                                |
| IsAdmin                | BOOLEAN | N/A (toggle)                                                   | Whether the service principal has admin privileges                       |
| DisplayName            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Display name of the service principal in Azure AD                        |
| Description            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Description of the service principal                                     |
| AppOwnerOrganizationID | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Organization ID of the application owner                                 |
| AppDescription         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Description of the associated application                                |
| AppDisplayName         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Display name of the associated application                               |
| LoginURL               | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Login URL configured for the service principal                           |
| ServicePrincipalType   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Type of service principal (e.g., Application, ManagedIdentity)           |
| TenantID               | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Azure AD Tenant ID the service principal belongs to                      |
| AZTier                 | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Azure tier classification assigned by Forestall                          |
| IsARMPrivileged        | BOOLEAN | N/A (toggle)                                                   | Whether the object holds a privileged Azure Resource Manager (ARM) role. |