Grant-EpsHybridWorkerAccess
Documentation out of date
The documentation below was written for a different copy of this script than the one published now. Read the script itself before you run it, or ask support@invardia.com.
- the .doc.json names no sha256 of the script it documents
- the .doc.json is for version 2.0.0, the published script is 2.0.107
The published script's own summary: Gives the hybrid worker's MANAGED IDENTITY access to the Entra Policy Suite database (or takes it away with -Remove).
Purpose
Adds the worker machine's managed identity to the Entra Policy Suite database as the contained user eps-hybrid-worker (WITH SID = its client id) in the role eps_worker only (its work packages, its heartbeat, the AD group snapshots; never db_datareader / db_datawriter). You sign in in a browser as the SQL server's Entra admin.
When to run it
Once per worker, after the worker machine has its managed identity. -Remove when the worker goes.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor (or any role that may start a Container Apps job) | the install's resource group | starts the database setup job, which creates (or removes) the database user and reads it back - no database right needed (installs made since 2.0.59) |
| other | the SQL server's Entra admin - only for an install made before 2.0.59 | the Entra Policy Suite database | creates the database user directly |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| SQL | create | database user eps-hybrid-worker | role eps_worker (object-level grants from sql/eps-grants.json) | the Entra Policy Suite database | the worker reads its work packages and writes their results and its heartbeat | -Remove (drops the user) |
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | your Entra tenant | |
| -SubscriptionId | yes | the subscription Entra Policy Suite is installed in | |
| -WorkerClientId | yes | the client (application) id of the worker machine's managed identity | |
| -ResourceGroup | no | rg-eps | the install's resource group (an install made before 2.0.55: rg-entrapolicysuite, found by itself when it is there) |
| -Remove | no | false | drop the user instead |
Preview with -WhatIf
The T-SQL it would run; nothing is run.
Undo
Run again with -Remove.
Network
It connects to: login.microsoftonline.com, <server>.database.windows.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/eps/Grant-EpsHybridWorkerAccess.ps1 -OutFile Grant-EpsHybridWorkerAccess.ps1
.\Grant-EpsHybridWorkerAccess.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -WorkerClientId <WorkerClientId>To check the download first, compare its SHA-256 with the published one:
SHA-256 c4c115d536a91e3476fa8f515ebbc1788c904d5f67eb03f153942a1d666604c8
Checksums: SHA256SUMS.txt · Version 2.0.107 · Documentation for version 2.0.0
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Grant-EpsHybridWorkerAccess.ps1 -Full · Source: Grant-EpsHybridWorkerAccess.ps1
Every script, identity and permission for your security review: Entra Policy Suite