App role

Last updated Oct 17, 2026 Inventory

AI summary

App roles in Entra ID represent permissions assignable to users, groups, or other applications. Rencore Governance tracks all app role properties including identifiers, descriptions, enablement status, and risk scores, so you can understand and manage permissions in your Entra ID inventory.

All app roles in Entra ID

Part of the Entra ID inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Default	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	Yes

Properties

Property	Type	Description	Automation placeholder
Allowed Member Type	String	Specifies whether this app role can be assigned to users and groups (by setting to ["User"]), to other application's (by setting to ["Application"], or both (by setting to ["User", "Application"]). App roles supporting assignment to other applications' service principals are also known as application permissions. The "Application" value is only supported for app roles defined on application entities. Allowed values: Applications, UsersGroups, UsersGroupsAndApplications.	`{{AppRole.AllowedMemberType}}`
App	String		`{{AppRole.App}}`
Id	String	Unique role identifier inside the appRoles collection. When creating a new app role, a new GUID identifier must be provided.	`{{AppRole.AppRoleId}}`
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	`{{AppRole.CreatedTime}}`
Description	String	The description for the app role. This is displayed when the app role is being assigned and, if the app role functions as an application permission, during consent experiences.	`{{AppRole.Description}}`
Display Name	String		`{{AppRole.DisplayName}}`
IsEnabled	Boolean	When creating or updating an app role, this must be set to true (which is the default). To delete a role, this must first be set to false. At that point, in a subsequent call, this role may be removed.	`{{AppRole.IsEnabled}}`
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	`{{AppRole.LastModifiedTime}}`
Origin	String	Specifies if the app role is defined on the application object or on the servicePrincipal entity.	`{{AppRole.Origin}}`
Risk Score	Int32	Stores risk score	`{{AppRole.RiskScore}}`
Risk Score Update	DateTime	Stores risk score update	`{{AppRole.RiskScoreLastUpdate}}`
Risk Score Value	String	Stores risk score value like Low_Low	`{{AppRole.RiskScoreValue}}`
Value	String	Specifies the value to include in the roles claim in ID tokens and access tokens authenticating an assigned user or service principal.	`{{AppRole.Value}}`

Relations

Relation	Connector	Description
App role assignment	Entra ID	All app role assignments in Entra ID
Enterprise application	Entra ID

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Frequently asked questions

What is the app role object in Rencore Governance?

All app roles in Entra ID. App role is an object type in the Entra ID inventory of Rencore Governance.

Which properties does Rencore Governance collect for app role?

Rencore Governance collects 13 properties for App role, such as Allowed Member Type, App, Id and 10 more.

How often is app role scanned?

You can change the scan interval of App role objects under Configure objects (daily, weekly, bi-weekly, monthly, never or initial (collected once)). The interval is a target, not a guarantee: a scan can run later than planned.

Which module includes the Entra ID connector?

The Entra ID connector is part of the Digital Workplace module of Rencore Governance, which every Plan includes. The connector is generally available.

Was this page helpful?