> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/azure-identities/entra-id/groups.md).

# Groups

Open **Unified Identities › Group**, filter **Providers** to **Entra ID › Group**, then select a row to open its details.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-025fe060521c0d46b75777127f729e35f871be2e%2Fgroup-1.png?alt=media" alt=""><figcaption><p>Groups</p></figcaption></figure>

## Group Details

Opening a group shows the `Risk` and `Exposure Point` in the header, and the page contains the `Information` and `Issues` panes.

{% hint style="info" %}
You can analyze the object in the [Graph](/forestall/visualize/visualize.md) by clicking the **Graph »** button next to the `Information` title. For a shadow admin the button reads **Admin Path »** and opens the shortest path to admin objects (see [Object Detail Pages](/forestall/unified-identities.md#object-detail-pages)).
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-b057fbfe30a08d8ce58ce66247a87e9b807c90a4%2Fazure-identities-groups-image-1.png?alt=media" alt=""><figcaption><p>Group Details</p></figcaption></figure>

## Information

`Information Pane` can contain different badges to highlight important attributes.

| Badge                   | Description                                                                                                                       |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Shadow**              | Indicates that the object can compromise admin objects with at least one attack path.                                             |
| **Privileged**          | Indicates that the object is Privileged.                                                                                          |
| **ARM Privileged**      | Indicates that the identity has at least one privileged Azure Resource Manager role assignment at resource group scope or higher. |
| **Tier 0** / **Tier 2** | Indicates the tier of the object.                                                                                                 |

`Information Pane` contains `Details`, `Parent Groups`, `Child Groups`, `Child Users`, `Child Devices`, `Child Service Principals`, `Child Administrative Units`, `Owner Users`, `Owner Service Principals`, `ARM Roles` and `Policies` tabs respectively. Each tab carries the number of rows it holds in its label.

## Details

Details tab contains attributes below about group object.

| Attribute                 | Description                                                                                                                                       |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Name**                  | The unique name or alias of the group, used for identification and referencing within Azure AD.                                                   |
| **Description**           | A user-defined text field describing the group's purpose or membership.                                                                           |
| **Display Name**          | The name shown in the directory, often used in address books and group listings.                                                                  |
| **Tenant**                | The Entra ID tenant to which the group belongs, linking to its [Tenant](/forestall/unified-identities/azure-identities/entra-id/tenants.md) page. |
| **Security Enabled**      | Indicates whether the group is a security group, which can be used to manage access to resources like SharePoint, Teams, or applications.         |
| **Group Type**            | Defines the type of group: **Security** for access control or **Microsoft 365** for collaboration (this group is a **Security group**).           |
| **When Created**          | The date and time when the group was created in the Azure Active Directory.                                                                       |
| **Is Assignable To Role** | Indicates whether this group can be assigned to Azure AD roles (role-assignable groups must be security-enabled and marked as assignable).        |
| **On Prem SID**           | The security identifier (SID) for the group from the on-premises Active Directory, used during synchronization.                                   |
| On Prem Sync Enabled      | Specifies whether the group was synchronized from an on-premises Active Directory via Azure AD Connect.                                           |
| Security Identifier       | A unique SID assigned by Azure AD for the group object, used in access control and permissions.                                                   |

## Parent Groups

Parent Groups tab contains a list of groups that the group is a member of. This list also contains `Enabled` and `On Prem Sync Enabled` columns to identify the status of these groups.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-62cfc65ea44dcdf00afbefa13992033d92b80d4d%2Fazure-identities-groups-image-2.png?alt=media" alt=""><figcaption><p>Parent Groups</p></figcaption></figure>

## Child Groups

Child Groups tab contains a list of groups that are members of the group. This list also contains `Enabled` and `On Prem Sync Enabled` columns to identify the status of these groups.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-a113147c9d2f3efecd940df78df7f50e84143391%2Fazure-identities-groups-image-3.png?alt=media" alt=""><figcaption><p>Child Groups</p></figcaption></figure>

## Child Users

The Child Users tab displays a list of user accounts associated with the group.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-f29f8947e74719a43942a24fd3a35b682fbe44ec%2Fazure-identities-groups-image-4.png?alt=media" alt=""><figcaption><p>Child Users</p></figcaption></figure>

## Child Devices

The Child Devices tab displays a list of devices objects associated with the group.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-f05c05aac6fd341ad8919bfaa1872a2e3bf5015a%2Fazure-identities-groups-image-5.png?alt=media" alt=""><figcaption><p>Child Devices</p></figcaption></figure>

## Child Service Principals

The Child Service Principals tab displays a list of Service Principals associated with the group.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-b17c240664e5b76b945abbad7c32dc70859a0ac5%2Fazure-identities-groups-image-6.png?alt=media" alt=""><figcaption><p>Child Service Principals</p></figcaption></figure>

**Name**: The name of the Service Principals.

**Enabled**: Indicates whether the Service Principals is active.

**App Display Name:** The display name of the Azure AD application that this service principal is associated with.

**Service Principal Type:** The type of the service principal, which defines its origin.

Common types include:

* `Application`: a service principal created for an Azure AD application.
* `ManagedIdentity`: for system- or user-assigned managed identities.
* `Legacy`: for older service principal objects.
* `Federated`: for service principals from external identity providers

## Child Administrative Units

The Child Administrative Units tab displays a list of Administrative Units associated with the group.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-aeab7f2febc4dc9cb5f81c203f185000685c934f%2Fazure-identities-groups-image-7.png?alt=media" alt=""><figcaption><p>Child Administrative Units</p></figcaption></figure>

**Display Name**: The display name of the Administrative Unit, used to identify it within Azure AD.

**Member Management Restricted**: Indicates whether non-global administrators are restricted from managing members of this Administrative Unit. When set to `true`, only scoped-role assignments can manage its members.

**Visibility**: Determines whether the Administrative Unit is visible to users in the directory. Values can be:

* `Public`: visible to all users.
* `HiddenMembership`: members are not visible to non-admin users.
* `Private`: not visible unless explicitly granted access.

## Owner Users

The Owner Users tab displays a list of Owner Users associated with the group.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-c5f5b18fc4ba36c032de9f0826dc7f7b9a4f6fc1%2Fazure-identities-groups-image-8.png?alt=media" alt=""><figcaption><p>Owner Users</p></figcaption></figure>

## Owner Service Principals

Owner Service Principals tab contains a list of service principals that own the group.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-4711761c45efe05e5a613ca768e67bdbc3e0c9e3%2Fazure-identities-groups-image-9.png?alt=media" alt=""><figcaption><p>Owner Service Principals</p></figcaption></figure>

## ARM Roles

ARM Roles tab contains a list of the Azure Resource Manager role assignments held by the group, with `Type`, `Built In` and `Assigned` columns. Every member of the group inherits these, so a group with resource-plane roles widens the blast radius of each membership.

## Policies

Policies tab lists the Conditional Access policies that apply to the group.

**Name:** The policy the row is about, linking to its [Conditional Access Policy](/forestall/unified-identities/azure-identities/entra-id/conditional-access-policies.md) page.

**State:** Whether the policy is `Enabled`, `Disabled` or `Report-only`.

Because Conditional Access is usually assigned to groups rather than to individual users, this tab is the quickest way to see what a group actually grants or demands before changing its membership. [CAP Audit](/forestall/cap-audit.md) reports the same relationship from the policy side.

## Issues

Issues pane contains identified issues on the group object.

![Issues](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-72c88396232e83c9bc36e3696a0d514fce96fb4c%2Fgroup-issues.png?alt=media)