Community

Free Community editions, open on GitHub

PIM Manager and SecurityInsight both have a free Community edition on GitHub. Here is how many people use them, updated every day.

Install PIM Manager CommunityPIM Manager on GitHub →

Install in two lines

The most common: Community, browser sign-in, every other answer a default. In PowerShell 7:

Invoke-WebRequest https://github.com/KnudsenMorten/PIM4EntraPS/releases/latest/download/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1
.\Start-PimManagerInstall.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>'
4 more ways to install

See the plan first (checks, then every step; nothing changed):

Invoke-WebRequest https://github.com/KnudsenMorten/PIM4EntraPS/releases/latest/download/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1
.\Start-PimManagerInstall.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -WhatIf

Your own region, resource group, PIM Manager administrators and alert recipients:

Invoke-WebRequest https://github.com/KnudsenMorten/PIM4EntraPS/releases/latest/download/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1
.\Start-PimManagerInstall.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -Location westeurope -ResourceGroup rg-pim-manager -SuperAdmins 'admin1@contoso.com','admin2@contoso.com' -AlertRecipients 'pim-alerts@contoso.com'

Pro or a trial: download the Pro installer from Invardia instead (this line 1), then the same line 2 - no key: your licence is assigned to your tenant:

Invoke-WebRequest https://github.com/KnudsenMorten/PIM4EntraPS/releases/latest/download/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1
Invoke-WebRequest https://invardia.com/support/pim/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1

After a stop: the same command with -Resume (the downloaded release is reused, finished steps are skipped):

Invoke-WebRequest https://github.com/KnudsenMorten/PIM4EntraPS/releases/latest/download/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1
.\Start-PimManagerInstall.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -Resume

Needs PowerShell 7 and an account that is Owner of the subscription + Privileged Role Administrator in Entra ID; no secret, no certificate, no Azure CLI, no modules.

What Community includes

  • Free for a single tenant, on GitHub
  • The full portal: model, review, commit and see what changed
  • Entra ID roles, PIM for Groups, administrative units and Azure RBAC
  • Intune and Defender XDR role delegation, including Defender custom roles
  • Access map, Reports, Role Lookup and drift detection
  • Admin accounts with Temporary Access Passes and auto-disable
  • PIM Activator browser extension; updates with one command from the public release

Not in Community: single tenant (Pro Business / Enterprise)

  • Discovery and gaps: what is and is not delegated through PIM across every workload, and the scheduled jobs that find new roles, groups and resources
  • The other workload connectors: Power BI, enterprise-app roles, Azure DevOps, Dataverse, Business Central, Power Platform (Community has Entra roles, PIM for Groups, AUs, Azure RBAC, Intune, Defender XDR)
  • Revoking current delegations from the portal (the list itself is free)
  • Access reviews: campaigns with decisions recorded and enforced
  • Delegated administration: portal users limited to a tier, level, service or scope
  • The tier-impact report: everyone who can reach tier 0, including through nested groups
  • The access request API: a ticketing system (e.g. ServiceNow) switches a disabled admin on for a set time; PIM switches it off again
  • PIM for on-premises Active Directory: AD admin accounts, PIM groups mirrored to AD groups, just-in-time AD membership (hybrid worker)
  • the AI assistant (MCP), API applications for scripts and services, and the API and MCP reference
  • Support from Invardia with an agreed response time (Community: GitHub issues)

Not in Community: multi-tenant (Pro MSP)

  • Define once, target many: tenants by tag and rollout wave
  • Signed definition sets, verified on arrival
  • What reaches each tenant and what is held back; per-customer rules
  • Read-only preview of what a tenant would receive
  • Fleet conformance; rollout waves; release rings for the software
  • Central accounts whose lifecycle flows down; removals stay the tenant's call
  • The provider-hosted option (provider runs portal + database)
  • A managing or managed tenant requires Pro; without it, the publishing and downlink jobs refuse to run

Need more? Pro adds everything in Community plus the Pro features for your tenant - see every feature by edition, or try Pro free for 60 days.

In numbers

GitHub stars
–
Forks
–
Watchers
–
Releases
–
Release downloads
–
Clones
–
Repository views
–
Active Community installs
–
reporting in, last 30 days

Install SecurityInsight CommunitySecurityInsight on GitHub →

Install in two lines

Open Azure Cloud Shell (https://shell.azure.com) in PowerShell, signed in to the tenant you want to assess. No PowerShell modules, no Azure CLI, no client secret. The checks run first; nothing is created until they pass.

The quickest install:

Invoke-WebRequest https://github.com/KnudsenMorten/SecurityInsight/releases/latest/download/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
./Install-SecurityInsight.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>'
5 more ways to install

Your own region, resource group and report recipients:

Invoke-WebRequest https://github.com/KnudsenMorten/SecurityInsight/releases/latest/download/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
./Install-SecurityInsight.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -Location northeurope -ResourceGroup rg-securityinsight -MailTo secops@contoso.com

Read every subscription in a management group:

Invoke-WebRequest https://github.com/KnudsenMorten/SecurityInsight/releases/latest/download/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
./Install-SecurityInsight.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -CollectionScope managementGroup -ManagementGroupId '<management group id>'

Or -CollectionScope tenantRoot for the whole tenant.

Private network only:

Invoke-WebRequest https://github.com/KnudsenMorten/SecurityInsight/releases/latest/download/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
./Install-SecurityInsight.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -PrivateNetwork -VnetAddressPrefix 10.212.24.0/24

Check first, changes nothing:

Invoke-WebRequest https://github.com/KnudsenMorten/SecurityInsight/releases/latest/download/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
./Install-SecurityInsight.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -PreflightOnly

Continue an install that stopped:

Invoke-WebRequest https://github.com/KnudsenMorten/SecurityInsight/releases/latest/download/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
./Install-SecurityInsight.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>' -Resume

Pro trial: start at https://invardia.com/trial/; your installation page there gives the two Pro install lines with the same choices.

What Community includes

  • Free on GitHub (PolyForm Shield 1.0.0 from version 3.0)
  • PowerShell scripts you run in your own Azure - on a Windows server or as Azure Container Apps jobs; no web app
  • Four profilers: endpoints, identities, Azure resources and public IPs
  • Risk Analysis (138 reports) as an Excel workbook, a mail and Log Analytics tables, with an optional AI summary
  • Risk trend, CMDB from a CSV file, AI tier classification, Shodan
  • Signed updates from GitHub when you run the update script

Not in Community

  • No web app, dashboard pages or chat: results are Excel, mail, files and Log Analytics tables
  • No Pro database: no collection history, findings workspace or management views beyond the Log Analytics tables
  • No cross-source correlation, CMDB connectors, ServiceNow or vulnerability close-loop
  • No governed exemptions, departments, roles or change history: exclusions are files you edit
  • No automatic updates and no template releases: you run or schedule the update script
  • No licence, no Invardia support agreement

Need more? Pro adds everything in Community plus the Pro features for your tenant - see every feature by edition, or try Pro free for 60 days.

In numbers

GitHub stars
–
Forks
–
Watchers
–
Releases
–
Release downloads
–
Clones
–
Repository views
–

Install Entra Policy Suite CommunityEntra Policy Suite on GitHub →

Install in two lines

The quickest install. In PowerShell 7:

Invoke-WebRequest https://github.com/KnudsenMorten/EntraPolicySuite/releases/latest/download/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id>
4 more ways to install

See the plan first (nothing is created):

Invoke-WebRequest https://github.com/KnudsenMorten/EntraPolicySuite/releases/latest/download/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -WhatIf

Another region than westeurope:

Invoke-WebRequest https://github.com/KnudsenMorten/EntraPolicySuite/releases/latest/download/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -Location <region>

A private network:

Invoke-WebRequest https://github.com/KnudsenMorten/EntraPolicySuite/releases/latest/download/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -PrivateNetwork

Continue an install that stopped:

Invoke-WebRequest https://github.com/KnudsenMorten/EntraPolicySuite/releases/latest/download/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -Resume

Two lines in PowerShell 7 or Azure Cloud Shell; no PowerShell modules. Every feature is off until you switch it on.

What Community includes

  • Free, runs in your own Azure subscription, one tenant
  • Conditional Access: adopt, deploy from 111 templates, edit, clone, move stage by stage, versions side by side
  • Get started: checks your tenant and creates what is missing
  • User and device tagging from rules, with test runs and a hybrid worker for AD-synced users
  • Identity report with 43 gap views, and the option to send it to Log Analytics
  • Backups, restore and undo for policies and tagging
  • Imports your Entra Policy Suite 1 rule files and settings

Need more? Pro adds everything in Community plus the Pro features for your tenant - see every feature by edition, or try Pro free for 60 days.

In numbers

GitHub stars
–
Forks
–
Watchers
–
Releases
–
Release downloads
–
Clones
–
Repository views
–
Active Community installs
–
reporting in, last 30 days

Clones and views are counted from the day we started keeping GitHub's numbers (GitHub itself shows only the last 14 days). Installs count Community installations that send the anonymous status report; the report can be switched off.