Documentation

Entra Policy Suite scripts

Every Entra Policy Suite script you may be asked to run: what it is for, who may run it, every permission and change it makes (with scope and why), its parameters, what -WhatIf shows and how to undo it. Read the page before you run the script.

Always save a script, check its SHA-256 against the published SHA256SUMS.txt, read it, then run it - each page shows the commands.

• Deploy-EpsAzureMonitorAlerts · Documentation out of date

  Deploys (or updates) Entra Policy Suite's EXTERNAL alarm in your Azure: an Azure Monitor rule set that keeps working even when the product does not (DESIGN §5.7a).

• Grant-EpsEnginePermissions · Documentation out of date

  Gives the Entra Policy Suite engine identity (id-eps-engine) the Microsoft Graph permissions and the Exchange right it is missing - or takes one away with -Remove. Every grant is read back.

• Grant-EpsHybridWorkerAccess · Documentation out of date

  Gives the hybrid worker's MANAGED IDENTITY access to the Entra Policy Suite database (or takes it away with -Remove).

• Grant-EpsUpdaterPermissions · Documentation out of date

  Gives the Entra Policy Suite update identity (id-eps-updater) the Microsoft Graph permissions it is missing - or takes one away with -Remove. Every grant is read back.

• Import-EpsV1Data · Documentation out of date

  Shows what a v1 Entra Policy Suite install's rules and settings become in Entra Policy Suite 2.0. Writes nothing.

• Initialize-EpsHybridWorkerAd · Documentation out of date

  Delegates the Entra Policy Suite hybrid worker in Active Directory: the right to write EXACTLY the tag attributes you choose on user (and, for device tags, computer) objects - nothing else (DESIGN §6). Run once by a domain admin on a domain machine.

• Initialize-EpsLogAnalytics · Documentation out of date

  Sets up Entra Policy Suite's Log Analytics integration (v1: EPSIntegration): the identity report's users go to the custom table EntraUsersMetadata_CL, and the exposure lists are read back from it with the Entra sign-in logs.

• Initialize-EpsMailSender · Documentation out of date

  Sets up Entra Policy Suite's mail (framework MAIL-1): a shared mailbox the engine sends its alerts from - and the right to send as THAT mailbox only.

• Install-EpsHybridWorker · Documentation out of date

  Installs the Entra Policy Suite hybrid worker on a domain-joined Windows server (an Azure VM or an Azure Arc-enabled on-premises server) - run ON the worker, elevated (DESIGN §6; one worker per product, D5).

• Set-EpsWebAccess · Documentation out of date

  Names who may use the Entra Policy Suite web app: SuperAdmin, Admin or Reader. Used once to name the first SuperAdmin.

• Start-EpsInstall · Documentation out of date

  Downloads Entra Policy Suite 2.0 Pro - the signed Pro package from Invardia - and starts the install.

Every script, identity and permission for your security review: Entra Policy Suite

Other products:PIM Manager · SecurityInsight · Invardia· Download page