Grant-EpsEnginePermissions
Documentation out of date
The documentation below was written for a different copy of this script than the one published now. Read the script itself before you run it, or ask support@invardia.com.
- the .doc.json names no sha256 of the script it documents
- the .doc.json is for version 2.0.0, the published script is 2.0.107
The published script's own summary: Gives the Entra Policy Suite engine identity (id-eps-engine) the Microsoft Graph permissions and the Exchange right it is missing - or takes one away with -Remove. Every grant is read back.
Purpose
Grants the engine identity (id-eps-engine) the Microsoft Graph application permissions and the Exchange right Entra Policy Suite declares for it, when one is missing after the install - or takes one away with -Remove. Only the declared permissions can be asked for. Every change is read back.
When to run it
When the permission check shows a missing right (the install ran as an account that could not grant it, or an approver granted it later), when a feature that needs a right is switched on, or with -Remove when a feature no longer needs it.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Privileged Role Administrator (or Global Administrator) | the tenant | grants application permissions and the Exchange Recipient Administrator role to a managed identity |
| azureRbac | Reader | the Entra Policy Suite resource group | finds the engine identity |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Entra | create | app role assignments on the engine identity | the Graph permissions asked for (from the declared list); Exchange.ManageAsApp with -Exchange | the tenant | the engine's features read and tag users and devices, read Conditional Access and the sign-in logs, move an adopted Conditional Access policy to the stage a SuperAdmin approved, and read Exchange recipients for the recipient conditions | run again with -Remove and the same permissions |
| Entra | create | directory role assignment Exchange Recipient Administrator (with -Exchange) | the tenant | the recipient conditions read Exchange recipients | run again with -Exchange -Remove |
What it only reads
- Azure: the engine identity's object id
- Graph: the engine identity's app role and directory role assignments
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | your Entra tenant | |
| -SubscriptionId | yes | the subscription Entra Policy Suite is installed in | |
| -ResourceGroup | no | rg-eps | the install's resource group (an install made before 2.0.55: rg-entrapolicysuite, found by itself when it is there) |
| -GraphPermission | no | [] | the Graph permissions to grant or remove; none given: every Graph permission the engine needs |
| -Exchange | no | false | the Exchange right of the recipient conditions (Exchange.ManageAsApp + Exchange Recipient Administrator) |
| -Remove | no | false | take the named rights away instead (it never removes everything at once) |
Preview with -WhatIf
What the engine has, and what would be granted or removed; nothing is changed.
Undo
Run again with -Remove (or without it, to grant back).
Network
It connects to: login.microsoftonline.com, management.azure.com, graph.microsoft.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/eps/Grant-EpsEnginePermissions.ps1 -OutFile Grant-EpsEnginePermissions.ps1
.\Grant-EpsEnginePermissions.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>To check the download first, compare its SHA-256 with the published one:
SHA-256 5fa791d09dc3068c9d0a3276281c0f545c8903189d580715d7749687c7544085
Checksums: SHA256SUMS.txt · Version 2.0.107 · Documentation for version 2.0.0
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Grant-EpsEnginePermissions.ps1 -Full · Source: Grant-EpsEnginePermissions.ps1
Every script, identity and permission for your security review: Entra Policy Suite