Entra Policy Suite documentation · Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026
Install Entra Policy Suite
Entra Policy Suite runs in your own Azure subscription, in one resource group. Two lines in PowerShell 7 or Azure Cloud Shell install it. The install uses REST calls only - no PowerShell modules, no Azure CLI - and you sign in in your browser. Every feature that changes your directory is off when the install finishes, and tagging only previews until you switch it to Apply, so nothing in your directory changes until you say so. On from the start: a nightly backup of your Conditional Access policies, named locations and authentication strengths (the newest 30 are kept), a monthly read of the policy options from Microsoft Graph - both only read your tenant - and the nightly check for an approved update. The Invardia support link is on as well, but nothing is sent until Invardia has issued your install’s key.
Before you start
You need these rights for the install. The person who runs it signs in once in the browser.
| Right | Why |
|---|---|
| Owner on the subscription | Creates the resource group, the resources and the role assignments of Entra Policy Suite’s own identities |
| Global Administrator or Privileged Role Administrator | Gives the engine identity its Microsoft Graph and Exchange Online application permissions, and creates the app registration people sign in to the web app with (with admin consent) |
You also need:
- PowerShell 7.2 or later on Windows, macOS or Linux, or Azure Cloud Shell.
- Entra ID P1 in the tenant for the sign-in activity and audit log that the identity report and the tamper monitor read.
- For AD-synced users: a domain-joined Windows Server for the hybrid worker (an Azure VM or an Azure Arc-enabled server). See Hybrid worker.
Cost (estimate, list prices). An Azure SQL database (Standard S1, 250 GB), a container registry (Basic), Container Apps jobs and the web app (it scales to zero), a Log Analytics workspace, a storage account for the job queues and a Key Vault (Standard). The cost does not grow with the number of rules.
1. See the plan first
The install is two lines: line 1 downloads the launcher, line 2 runs it. The launcher downloads the latest Entra Policy Suite 2 release, checks the file against the SHA-256 digest published for it, and runs the installer.
Community (from GitHub):
Invoke-WebRequest https://github.com/KnudsenMorten/EntraPolicySuite/releases/latest/download/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id>
Pro (from invardia.com/support/eps):
Invoke-WebRequest https://invardia.com/support/eps/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id>
The Pro line is the same for Pro and the 60-day trial: the trial is a license, not another install. The Pro launcher asks you to sign in to the tenant you install into and takes the Pro package from Invardia, signed by Invardia and checked before anything runs. After the install the product asks Invardia for its license by itself and shows it on Administration > License; you never paste or upload a license. Pro and the 60-day trial are ordered at invardia.com.
To see the plan first, add -WhatIf at the end of line 2: it shows every step the installer would take. Nothing is created in Azure.
| Parameter | Default | What it is |
|---|---|---|
-TenantId |
(required) | Your Entra tenant id |
-SubscriptionId |
(required) | The subscription to install in |
-Location |
westeurope | The Azure region |
-ResourceGroup |
(the product’s default name) | The resource group to install into |
-Version |
the latest 2.x release | A specific release, for example 2.0.16 |
-StatePath |
~/invardia/eps-<subscription> (in Cloud Shell under ~/clouddrive) |
The install journal a stopped install resumes from, and the network hand-off |
-Resume |
off | Continue an interrupted install with the same values; finished steps are skipped |
-SqlLocation |
the install’s region | The Azure SQL server’s region, when Azure SQL does not take new servers in the install’s region |
-SqlAdminGroupId, -SqlAdminGroupName |
the product’s SQL admin group (found, else created; its name is in the naming table below) | Your own Entra security group as the Azure SQL server’s admin. Either way the database setup job’s identity is added to it; you need no database right. An existing server keeps its admin. |
-ReplaceSqlAdminGroup |
off | Replaces a SQL admin group that is not role-assignable with a new role-assignable one (the old one is kept as <name>-old); the admin moves after 24 hours, on a second run |
-RenameJobs |
off | On an install made before 2.0.55: moves the scheduler and update jobs to the standard names, each proven with one run first |
-Ring |
the install’s ring | The update ring this install belongs to (0-10). Invardia tells you the ring. |
-ExcludeGraphRole |
none | A Microsoft Graph permission your approver did not approve: never granted, and the feature that needs it reports its data as unavailable |
-SupportAppId, -SupportAccess |
none, troubleshoot | Your Support app for Invardia, by its client id, and its starting level (troubleshoot, setup, read or none). Without -SupportAppId nothing is granted to it. |
-Quiet |
off | Prints less while installing |
A private network (-PrivateNetwork): everything runs in your virtual network. Run it from a machine inside your network, or one that resolves its private names. The network parameters:
| Parameter | Default | What it is |
|---|---|---|
-PrivateNetwork |
off | No public address; Azure SQL, Key Vault, the job queues and the registry (Premium) are created with public access off and reached through private endpoints |
-VnetId |
(the install makes its own network) | Your existing network in the same region (Network Contributor on it) |
-VnetAddressPrefix, -VnetName |
10.230.0.0/24, the product’s network name |
The network the install makes (at least a /25) |
-AppsSubnetName, -AppsSubnetPrefix |
the product’s apps subnet name, the first /26 | The Container Apps environment’s subnet (at least a /27, delegated to Microsoft.App/environments) |
-EndpointsSubnetName, -EndpointsSubnetPrefix |
the product’s endpoints subnet name, the second /26 | The private endpoints’ and the registry build pool’s subnet |
The default names of the network and its subnets are in the naming table below.
| -PrivateDnsZonesResourceGroupId | (zones made in the install’s resource group) | The resource group of your central private DNS zones: used, never written |
| -HubVnetId | none | Your hub network: makes the hand-off list exact and writes a script for the hub owner. Nothing is written in the hub by default. |
| -PeerToHub, -LinkZonesToHub | off | Peer with the hub in both directions, link the zones to the hub - only when your rights allow it, checked first |
| -InternalRanges, -FirewallIp | none | Your internal ranges that reach the web app through your hub firewall, and the firewall’s address for the return route |
| -WebAppAccess | external (a private install: internal) | Whether the web app is reached from the internet behind the sign-in, or from your network only |
| -ConfirmedFromInside | off | Only when the install cannot prove a private install from inside: you checked the web app from inside yourself |
When a name does not resolve to its private endpoint yet, the install waits (exit code 4) and prints the DNS records your hub needs; run the same command again afterwards.
2. Install
Run the two lines as shown (without -WhatIf). Each step prints ok, skipped (already there) or failed. If a step fails, fix the cause and run the same command again: the steps already done are kept and the install continues where it stopped.
The installer creates:
| What | Why |
|---|---|
| Five managed identities: the engine (it also runs the schedule check), the web app, the database setup job, the update job and the support read job | Each part signs in as its own identity, with only its own rights. No identity has a client secret or a certificate. A hybrid worker, when you install one, signs in as its own identity too. |
| An Azure SQL database (Microsoft Entra authentication only) | Every rule, setting, run, tag change, snapshot and audit row |
| A container registry, with the Entra Policy Suite image built inside it | The jobs and the web app run this image |
| A Container Apps environment with the jobs and the web app | The scheduler every 5 minutes; one job per feature, each started from its own queue |
| A storage account with one queue per job (no shared keys) | The scheduler asks for a run by a message on the job’s queue |
| A Log Analytics workspace | The container logs |
| A Key Vault (Standard, soft delete, purge protection) with one key | Protects the web app’s sign-in sessions. When Invardia issues a connection key for the Invardia support link, it is kept here too, and only the engine can read it. |
| An app registration named “Entra Policy Suite” for the web app sign-in, with no secret and no certificate | People sign in to the web app with Microsoft Entra ID. Only users you assign can sign in. |
It grants:
| Identity | Permission | Why |
|---|---|---|
| Engine | Microsoft Graph application: User.Read.All, Device.Read.All (read only, always); User.ReadWrite.All granted once user tagging, the tamper monitor or the stale identity clean-up’s disable action is turned on, Device.ReadWrite.All once device tagging is turned on (turning a feature off keeps the right - nothing is removed by itself) |
Reads users and devices; writes the tags |
| Engine | Microsoft Graph application: Policy.ReadWrite.ConditionalAccess |
Writes a Conditional Access policy only when a SuperAdmin asks for it, after seeing what changes: deploys a template, saves an edit or a copy, moves a policy to another stage, promotes or rolls back a new version, puts a policy back from a backup, and deletes policies that are off |
| Engine | Microsoft Graph application: Policy.ReadWrite.AuthenticationMethod |
Creates the two authentication strengths (FIDO2 + Temporary Access Pass, Windows Hello for Business + Temporary Access Pass) when they are missing - only when a SuperAdmin approves it |
| Engine | Microsoft Graph application: Group.ReadWrite.All, AdministrativeUnit.ReadWrite.All |
Creates the groups the Conditional Access policies use, sets a dynamic pilot group’s rule for the policy’s stage, changes pilot and exclude group members, and makes the administrative units - only when a SuperAdmin approves the change |
| Engine | Microsoft Graph application (read only): GroupMember.Read.All, Organization.Read.All, AuditLog.Read.All, Policy.Read.All, RoleManagement.Read.Directory, DeviceManagementManagedDevices.Read.All, Application.Read.All, UserAuthenticationMethod.Read.All, PrivilegedEligibilitySchedule.Read.AzureADGroup, PrivilegedAssignmentSchedule.Read.AzureADGroup |
Group membership and licenses for the rules, sign-in activity and audit log for the identity report and the tamper monitor, Intune devices for the identity report, Conditional Access policies and application names for the Conditional Access page, each user’s sign-in methods (the per-user sign-in methods job), and who is eligible for or active in a role group through Privileged Identity Management for Groups (counted as admins in the identity report) |
| Engine | Exchange Online Exchange.ManageAsApp and the Exchange Recipient Administrator role, only while user tagging, the identity report or a rule with a mailbox condition is on |
Reads mailbox types for the rules and the identity report (shared mailbox, room mailbox), and writes the tag of a mail-enabled user when Microsoft Graph cannot. A new install grants neither; when you switch on one of these features, run the install again (or Grant-EpsEnginePermissions.ps1 -Exchange). When none of them is on any more, the rights are kept: Entra Policy Suite never removes a right by itself (take them away with Grant-EpsEnginePermissions.ps1 -Exchange -Remove). |
| Engine | Exchange Online application Mail.Send, limited to the sender mailbox only, when alert mail is sent from a mailbox of yours |
Alert and report mail (set up once by an Exchange admin with Initialize-EpsMailSender.ps1) |
| Engine | Message sender, processor and reader on the job queues | The schedule check asks for a run; a job takes its own run request |
| Engine | Pull from the container registry; Reader on the web app; read the key of the Invardia support link in the Key Vault | Runs the image; reports the web app’s version in the heartbeat; signs the Invardia support link with the install’s key |
| Engine | Monitoring Metrics Publisher on one data collection rule, Log Analytics Reader on one workspace - only after you ran Initialize-EpsLogAnalytics.ps1 |
Sends the identity report’s rows to your Log Analytics and checks they landed |
| Web app | Its own database role; pull from the container registry; send on the wake-up queue only; use its sign-in key in the Key Vault; a federated credential on its app registration | It reads and stages, wakes the engine right after a request instead of waiting up to 5 minutes, and signs people in with no stored password or key. It holds no Microsoft Graph or Exchange right. |
| Database setup job | Member of the Azure SQL server’s Entra admin group; pull from the container registry; read the key of the Invardia support link | Creates the schema and every database role, so no person needs a database right; reads Invardia’s support consent state |
| Support read job | Its own database role; processor and reader on its own queue; pull from the container registry | Runs a named read that Invardia’s support asked for and you allowed, and records it in the audit |
| Updater | Contributor on the resource group; pull from the container registry | Installs an approved release: builds the image in your registry and moves the jobs and the web app to it |
| Hybrid worker | Its own database role (only when a hybrid worker is installed) | Takes its Active Directory work and reports back |
| Updater | Microsoft Graph application: PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup, PrivilegedAssignmentSchedule.Read.AzureADGroup, RoleManagementPolicy.Read.AzureADGroup, GroupMember.Read.All and Application.Read.All (both read only), and Application.ReadWrite.OwnedBy (only the app registration it owns) |
The SQL admin group is role-assignable. On every run the update job keeps the database setup identity a member of it through a Privileged Identity Management for Groups assignment and renews a time-limited one before it ends. It also owns the web app’s sign-in registration and keeps that registration’s own settings (its address, sign-in addresses, the web identity’s credential) as they should be - no other app |
Did your approver not approve one of the read permissions? Run the install with -ExcludeGraphRole <permission>. The feature that needs it then reports its data as unavailable instead of failing.
The database has one role per part (engine, schedule check, web app, support read job, hybrid worker), each with grants on the tables it uses. None of these parts is a database owner, reader or writer of everything. Only the database setup job is the server’s admin, through the admin group, because it creates the schema and the roles.
3. Name the first SuperAdmin
You are the web app’s first SuperAdmin after the install. A SuperAdmin grants access to other people on the Access page. If no SuperAdmin is left, Set-EpsWebAccess.ps1 from the release names one through the install’s database setup job (you need the right to start a job in the resource group, no database right). The user and a reason are required; the job names a SuperAdmin only when there is none, and the change is written to the audit trail. Admin and Reader are given on the Access page.
./Set-EpsWebAccess.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -UserPrincipalName admin@contoso.test -Reason 'first SuperAdmin after the install' -WhatIf
``` See [Access and audit](/docs/entrapolicysuite/access-and-audit/).
## 4. Set up the alert mail
Alerts (for example a change to a watched tag that the engine did not make) are sent from a shared mailbox. `Initialize-EpsMailSender.ps1` creates the shared mailbox (no license), lets the engine identity send as that one mailbox only, and stores the sender and the recipients. Run it as an Exchange Administrator:
```powershell
./Initialize-EpsMailSender.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -Sender eps-alerts@contoso.test -Recipients soc@contoso.test -WhatIf
Run it again without -WhatIf to make the change. The engine never gets a tenant-wide right to send mail.
Scripts you run
Every script below is one file from the release (or from invardia.com/support/eps), signs you in in your browser, needs no PowerShell module, and shows its plan with -WhatIf first. Each has its own page with its parameters, the rights it needs and how to undo it.
| Script | What it does |
|---|---|
Start-EpsInstall.ps1 |
Downloads the release, checks it, and runs the installer |
Set-EpsWebAccess.ps1 |
Names a SuperAdmin when there is none |
Initialize-EpsMailSender.ps1 |
Creates the shared mailbox the alerts are sent from, and lets the engine send as that mailbox only |
Initialize-EpsLogAnalytics.ps1 |
Sets up sending the identity report to your Log Analytics workspace |
Deploy-EpsAzureMonitorAlerts.ps1 |
Deploys Azure Monitor alert rules in your Azure that keep working even when the product does not |
Enable-EpsUserTagging.ps1 |
Grants the one right writing to users needs: User.ReadWrite.All |
Enable-EpsDeviceTagging.ps1 |
Grants the one right device tagging needs: Device.ReadWrite.All |
Enable-EpsExchangeAccess.ps1 |
Grants the Exchange rights: Exchange.ManageAsApp and the Exchange Recipient Administrator role |
Grant-EpsEnginePermissions.ps1 |
Grants the engine any Microsoft Graph or Exchange right it is missing, or takes one away with -Remove |
Grant-EpsUpdaterPermissions.ps1 |
Grants the update job any Microsoft Graph right it is missing, or takes one away with -Remove |
Import-EpsV1Data.ps1 |
Shows what an Entra Policy Suite 1 install’s rules and settings become; writes nothing |
Initialize-EpsHybridWorkerAd.ps1, Grant-EpsHybridWorkerAccess.ps1, Install-EpsHybridWorker.ps1 |
The hybrid worker - see Hybrid worker |
Every grant is read back. Entra Policy Suite never removes a right by itself.
5. Install the hybrid worker
Only needed when you have AD-synced users. See Hybrid worker.
6. Bring your rules
- Coming from Entra Policy Suite 1? Import your v1 files. See Move from v1.
- Starting fresh? Create your tag types and rules. See Tag types and conditions and Rules.
7. Switch the features on
Open the web app (its address is printed at the end of the install) and go to Settings:
- User tagging and Device tagging: switch them on with the mode on Preview. A preview run computes every change and writes none.
- Check the preview on the Tag changes page, then run an Apply on a test scope from the Jobs page.
- When the result is right, set the mode to Apply.
- Identity report and Tamper monitor: switch them on.
See Jobs and runs and Settings.
Names in your Azure and Entra ID
The rest of this documentation names each part by its role. This is the one place with the names you will see in your
Azure resource group and in Entra ID. <t> is a short code the install derives from your install.
| Role | Azure name | Signs in as |
|---|---|---|
| Engine job (the schedule check every 5 minutes) | caj-eps-engine |
id-eps-engine |
| Work jobs (tagging, tamper monitor, CA analyzer, identity report, per-user sign-in methods, the wake-up check, configuration, the Invardia support link, named locations, backup, CA options) | caj-eps-usertag, caj-eps-devicetag, caj-eps-tamper, caj-eps-caanalyzer, caj-eps-idreport, caj-eps-signinmethods, caj-eps-wake, caj-eps-config, caj-eps-uplink, caj-eps-namedloc, caj-eps-backup, caj-eps-caoptions |
id-eps-engine |
| Update job | caj-eps-updater |
id-eps-updater |
| Database job and support access check | caj-eps-dbinit, caj-eps-support |
id-eps-dbinit |
| Support read job | caj-eps-supportread |
id-eps-support |
| Web app | ca-eps-web |
id-eps-web |
| Hybrid worker (on a server that also runs another product’s worker) | - | id-eps-worker |
| SQL admin group | grp-eps-sql-admins |
- |
| Database | sql-eps-<t>, database eps |
- |
| Key Vault, registry, storage | kv-eps-<t>, acreps<t>, steps<t> |
- |
| Container Apps environment, logs | cae-eps, log-eps |
- |
| Private network install: the network and its subnets | vnet-eps, snet-eps-apps, snet-eps-endpoints |
- |
| Web sign-in registration | Entra Policy Suite | - |
An install made before version 2.0.55 named its engine job and its update job differently; one install run with
-RenameJobs moves them to the names above. The web app keeps its address.
Remove Entra Policy Suite
Delete the resource group. Then remove the app registration “Entra Policy Suite” of the web app sign-in. The tags already written stay on your users and devices until you clear them.
Verified against Entra Policy Suite 2.1.4 on 2026-11-11
Verified against Entra Policy Suite 2.1.4 on Nov 11, 2026