Grant-EpsUpdaterPermissions
Documentation out of date
The documentation below was written for a different copy of this script than the one published now. Read the script itself before you run it, or ask support@invardia.com.
- the .doc.json names no sha256 of the script it documents
- the .doc.json is for version 2.0.0, the published script is 2.0.107
The published script's own summary: Gives the Entra Policy Suite update identity (id-eps-updater) the Microsoft Graph permissions it is missing - or takes one away with -Remove. Every grant is read back.
Purpose
Grants the update identity (id-eps-updater) the Microsoft Graph application permissions Entra Policy Suite declares for it, when one is missing after the install - or takes one away with -Remove. Only the declared permissions can be asked for. Every change is read back.
When to run it
When the update run says one of its rights is missing (the install ran as an account that could not grant it, or a release declares a new one). The update job never grants itself a right.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Privileged Role Administrator (or Global Administrator) | the tenant | grants application permissions to a managed identity |
| azureRbac | Reader | the Entra Policy Suite resource group | finds the update identity |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Entra | create | app role assignments on the update identity | the Graph permissions asked for (from the declared list) | the tenant | the update job keeps the database setup identity in the SQL admin group (PIM for Groups), reads that membership back, and keeps the web app's sign-in registration it owns as it should be | run again with -Remove and the same permissions |
What it only reads
- Azure: the update identity's object id
- Graph: the update identity's app role assignments
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | your Entra tenant | |
| -SubscriptionId | yes | the subscription Entra Policy Suite is installed in | |
| -ResourceGroup | no | rg-eps | the install's resource group (an install made before 2.0.55: rg-entrapolicysuite, found by itself when it is there) |
| -GraphPermission | no | [] | the Graph permissions to grant or remove; none given: every Graph permission the update identity needs |
| -Remove | no | false | take the named rights away instead (it never removes everything at once) |
Preview with -WhatIf
What the update identity has, and what would be granted or removed; nothing is changed.
Undo
Run again with -Remove (or without it, to grant back).
Network
It connects to: login.microsoftonline.com, management.azure.com, graph.microsoft.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/eps/Grant-EpsUpdaterPermissions.ps1 -OutFile Grant-EpsUpdaterPermissions.ps1
.\Grant-EpsUpdaterPermissions.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>To check the download first, compare its SHA-256 with the published one:
SHA-256 c9e39f34b8c5157d6616a9762b34827a029d642e8325d8983a09781dbbb744df
Checksums: SHA256SUMS.txt · Version 2.0.107 · Documentation for version 2.0.0
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Grant-EpsUpdaterPermissions.ps1 -Full · Source: Grant-EpsUpdaterPermissions.ps1
Every script, identity and permission for your security review: Entra Policy Suite