> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/azure-identities/azure-resource-management/arm-roles.md). # ARM Roles The `ARM Roles` page provides a list of enumerated ARM roles in entire Azure. The list contains the `Object ID`, `Description`, `Type`, `Privileged`, `Tier 0` and `Built In`.

### ARM Roles Details Details page contains the `Risk Score` of the role, `Exposure Point` and `Information` panes. > **Info** You can analyze objects in the `Graph module` by clicking the `Visualize` button on the upper left side of the `Information Pane`.

### Information `Information Pane` can contain different badges to highlight important attributes. | Badge | Description | | ---------- | ----------------------------------------------- | | Built-In | Indicates the role is a built-in Azure ARM role | | Tier 0 | Indicates the role is classified as Tier 0 | | Tier 2 | Indicates the role is classified as Tier 2 | | Privileged | Indicates the role has privileged permissions | `Information Pane` contains `Details`, `Actions`, `Not Actions`, `Data Actions`, `Not Data Actions`, `Groups`, `Service Principals`, `Users`. ### Details Details tab contains attributes below about the AZ ARM role. | Attribute | Description | | ----------------- | --------------------------------------------------- | | Name | The display name of the role with tenant suffix | | Type | The type of the role (e.g., BuiltInRole) | | Role Name | The original name of the role without tenant suffix | | Is Built In | Indicates whether the role is a built-in Azure role | | Description | A brief description of the role and its permissions | | Tenant | The tenant the role belongs to | | Assignable Scopes | The scopes at which the role can be assigned | | Object ID | The unique identifier (GUID) of the role | | Member Count | The number of members assigned to this role | | Created On | The date and time when the role was created | | Updated On | The date and time when the role was last updated | | | | ### Actions Actions tab contains a list of management actions that the role allows. This list identifies the operations that can be performed on Azure resources when the role is assigned.

### Not Actions Not Actions tab contains a list of management actions that are excluded from the role. These are operations that are explicitly denied even if allowed by `Actions`.

### Data Actions Data Actions tab contains a list of data operations that the role allows. These are operations performed on data within Azure resources (e.g., reading blob data).

### Not Data Actions Not Data Actions tab contains a list of data operations that are excluded from the role. These are data operations that are explicitly denied even if allowed by `Data Actions`.

### Groups Groups tab contains a list of groups that have been assigned this role. This list also contains `Enabled` and `On Prem Sync Enabled` columns to identify the status of these groups.

### Service Principals Service Principals tab contains a list of service principals that have been assigned this role. This list also contains `Enabled`, `App Display Name`, `Service Principal Type` columns to identify the status of these service principals.

### Users Users tab contains a list of users that have been assigned this role. This list also contains `Enabled` and `On Prem Sync Enabled` columns to identify the status of these users.