Deploy-EpsAzureMonitorAlerts
Documentation out of date
The documentation below was written for a different copy of this script than the one published now. Read the script itself before you run it, or ask support@invardia.com.
- the .doc.json names no sha256 of the script it documents
- the .doc.json is for version 2.0.0, the published script is 2.0.107
The published script's own summary: Deploys (or updates) Entra Policy Suite's EXTERNAL alarm in your Azure: an Azure Monitor rule set that keeps working even when the product does not (DESIGN §5.7a).
Purpose
Creates or updates an Azure Monitor rule set that alerts independently of the product: missing log data, Conditional Access policy changes, break-glass account sign-ins and actions in Entra and AD, a watched tag changed by a foreign writer, and the product's heartbeat stopping. Built from the product's settings each time it runs.
When to run it
After the install, and again after a break-glass account, a tag type, the tamper allow list or the recipients change.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor (Monitoring Contributor is enough for the rules and the action group) | the Entra Policy Suite resource group | creates the action group and the scheduled query rules |
| entraRole | Security Administrator or Global Administrator | the tenant | creates the Entra diagnostic setting that sends AuditLogs and the sign-in logs to Log Analytics (only if none does yet) |
| other | an Admin or SuperAdmin of the web app | the Entra Policy Suite web app | downloads the alarm inputs file (Tamper > Download the alarm inputs) - the script reads no database |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Entra | create | diagnostic setting eps-entra-logs (AuditLogs, SignInLogs, NonInteractiveUserSignInLogs -> the install's Log Analytics workspace), unless one already sends AuditLogs | the tenant | the rules read these logs | delete the diagnostic setting eps-entra-logs | |
| Azure | create | action group ag-eps-alarm (mail + SMS) | the Entra Policy Suite resource group | where the alerts go | delete it | |
| Azure | create | scheduled query rules eps-* (up to 10) | the Entra Policy Suite resource group | the alarm itself | delete the eps-* rules | |
| Azure | remove | eps-* rules no longer wanted (e.g. the AD rules when no AD break-glass account remains) | the Entra Policy Suite resource group | the rules follow exactly the accounts in the module | run again after adding the account back |
What it only reads
- the alarm inputs file from the web app (break-glass accounts, watched tag attributes, the tamper allow list)
- the Entra diagnostic settings
- the existing eps-* rules
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | your Entra tenant | |
| -SubscriptionId | yes | the subscription Entra Policy Suite is installed in | |
| -ResourceGroup | no | rg-eps | the install's resource group (an install made before 2.0.55: rg-entrapolicysuite, found by itself when it is there) |
| no | mail addresses for the alarm | ||
| -Sms | no | SMS numbers, '+<country code> <number>' | |
| -WorkspaceResourceId | no | the install's log-eps | another Log Analytics workspace |
| -InputFile | yes | the alarm inputs downloaded from the web app (Tamper > Download the alarm inputs) |
Preview with -WhatIf
Every resource it would create, update or remove; nothing is changed.
Undo
Delete ag-eps-alarm and the eps-* rules; delete the diagnostic setting eps-entra-logs if it was created by this script.
Network
It connects to: login.microsoftonline.com, management.azure.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/eps/Deploy-EpsAzureMonitorAlerts.ps1 -OutFile Deploy-EpsAzureMonitorAlerts.ps1
.\Deploy-EpsAzureMonitorAlerts.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -InputFile <InputFile>To check the download first, compare its SHA-256 with the published one:
SHA-256 66a3e55b5c377bf32de1d4f7419eebba92138d983185e661925e7be9e7457253
Checksums: SHA256SUMS.txt · Version 2.0.107 · Documentation for version 2.0.0
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Deploy-EpsAzureMonitorAlerts.ps1 -Full · Source: Deploy-EpsAzureMonitorAlerts.ps1
Every script, identity and permission for your security review: Entra Policy Suite