rencore.com (opens in a new tab) Start a trial (opens in a new tab)
Reference

App role assignment

Last updated Inventory Entra ID

AI summary

App role assignments in Entra ID are tracked in Rencore Governance's inventory with configurable scanning intervals from daily to monthly. Properties tracked for these assignments include app role identifiers, principal types, creation dates, and risk scores, with relationships to enterprise applications, user groups, and other inventory objects.

All app role assignments in Entra ID

Part of the Entra ID inventory.

In Rencore Governance

The App Role Assignment inventory page in Rencore Governance: counts, trend, violated policies and the list of objects
The inventory page in a Rencore demo Environment, captured October 2026.

Scan settings

Default scanning interval Allowed scanning intervals Data removal during incremental scan
Monthly Daily, Weekly, Bi-Weekly, Monthly, Never, Initial Yes

Properties

Property Type Description Automation placeholder
App Role App role The identifier (id) for the app role which is assigned to the principal. {{AppRoleAssignment.AppRole}}
Id String A unique identifier for the appRoleAssignment key. {{AppRoleAssignment.AppRoleAssignmentId}}
App Role Id String The identifier (id) for the app role which is assigned to the principal. {{AppRoleAssignment.AppRoleId}}
App Role Name String Display name for the permission that appears in the app role assignment and consent experiences. {{AppRoleAssignment.AppRoleName}}
Creation Date DateTime The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. {{AppRoleAssignment.CreatedDateTime}}
Initially Scanned DateTime Shows when this object was initially found in a scan. {{AppRoleAssignment.CreatedTime}}
Display Name String {{AppRoleAssignment.DisplayName}}
Group Principal Group The unique identifier (id) for the group being granted the app role. {{AppRoleAssignment.GroupPrincipal}}
Group Principal Name String The display name of the group that was granted the app role assignment. {{AppRoleAssignment.GroupPrincipalName}}
Last scan update DateTime Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. {{AppRoleAssignment.LastModifiedTime}}
Principal Display Name String The display name of the user, group, or service principal that was granted the app role assignment. {{AppRoleAssignment.PrincipalDisplayName}}
Principal Type String The type of the assigned principal. This can either be User, Group, or ServicePrincipal. {{AppRoleAssignment.PrincipalType}}
Resource String The unique identifier (id) for the resource service principal for which the assignment is made. {{AppRoleAssignment.Resource}}
Resource Display Name String The display name of the resource app's service principal to which the assignment is made. {{AppRoleAssignment.ResourceDisplayName}}
Resource Name String The display name of the resource app's service principal to which the assignment is made. {{AppRoleAssignment.ResourceName}}
Risk Score Int32 Stores risk score {{AppRoleAssignment.RiskScore}}
Risk Score Update DateTime Stores risk score update {{AppRoleAssignment.RiskScoreLastUpdate}}
Risk Score Value String Stores risk score value like Low_Low {{AppRoleAssignment.RiskScoreValue}}
Service Principal String The unique identifier (id) for the service principal being granted the app role. {{AppRoleAssignment.ServicePrincipal}}
Service Principal Name String The display name of the service principal that was granted the app role assignment. {{AppRoleAssignment.ServicePrincipalName}}
User Principal String App role assignments of the user {{AppRoleAssignment.UserPrincipal}}
User Principal Name String The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. {{AppRoleAssignment.UserPrincipalName}}

Relations

Relation Connector Description
App role Entra ID All app roles in Entra ID
Enterprise application Entra ID
Enterprise application Entra ID
Group Microsoft 365 All Entra ID groups in your Tenant (Security groups, Microsoft 365 groups)
User Microsoft 365

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Frequently asked questions

What is the app role assignment object in Rencore Governance?

All app role assignments in Entra ID. App role assignment is an object type in the Entra ID inventory of Rencore Governance.

Which properties does Rencore Governance collect for app role assignment?

Rencore Governance collects 22 properties for App role assignment, such as App Role, Id, App Role Id and 19 more.

How often is app role assignment scanned?

By default monthly. You can change the scan interval of App role assignment objects under Configure objects (daily, weekly, bi-weekly, monthly, never or initial (collected once)). The interval is a target, not a guarantee: a scan can run later than planned.

Which module includes the Entra ID connector?

The Entra ID connector is part of the Digital Workplace module of Rencore Governance, which every Plan includes. The connector is generally available.

Related pages

Related pages