Initialize-EpsLogAnalytics
Documentation out of date
The documentation below was written for a different copy of this script than the one published now. Read the script itself before you run it, or ask support@invardia.com.
- the .doc.json names no sha256 of the script it documents
- the .doc.json is for version 2.0.83, the published script is 2.0.107
The published script's own summary: Sets up Entra Policy Suite's Log Analytics integration (v1: EPSIntegration): the identity report's users go to the custom table EntraUsersMetadata_CL, and the exposure lists are read back from it with the Entra sign-in logs.
Purpose
Makes (or completes) the custom table EntraUsersMetadata_CL with v1's columns, a data collection endpoint and the data collection rule dcr-entra-EntraUsersMetadata_CL in your workspace, gives the engine's managed identity exactly two rights (Monitoring Metrics Publisher on that rule, Log Analytics Reader on that workspace), reads every step back and stores the target in the Entra Policy Suite database. It does not switch the upload on.
When to run it
Once, before switching on 'Send the report to Log Analytics' (Settings > Identity report); again after adding a user tag type, so the table gets its column.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor + User Access Administrator (or Owner) | the workspace's resource group (and the data collection resource group, if another) | creates the table, the endpoint and the rule, and the engine's two role assignments |
| azureRbac | Contributor (or any role that may start a Container Apps job) | the install's resource group | starts the database setup job, which stores the target (audited) - no database right needed |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure | create | the table EntraUsersMetadata_CL (or its missing columns; existing columns and their types are kept) | the workspace | the identity report's users are stored there, as v1 did | delete the table | |
| Azure | create | the data collection endpoint (default dce-entrapolicysuite) and the rule dcr-entra-EntraUsersMetadata_CL | the workspace's resource group, or -DataCollectionResourceGroup | the Logs Ingestion API sends through them | delete the rule and the endpoint | |
| Azure | grant | the engine identity (id-eps-engine) | Monitoring Metrics Publisher | the one data collection rule ONLY | it sends the rows | remove the role assignment |
| Azure | grant | the engine identity (id-eps-engine) | Log Analytics Reader | the one workspace ONLY | it reads the exposure lists (the table + the sign-in logs) | remove the role assignment |
| SQL | update | setting IdentityReport.LogAnalytics.Target | the Entra Policy Suite database | the engine reads where to send | switch 'Send the report to Log Analytics' off |
What it only reads
- Azure: the workspace, the table, the endpoint, the rule, the engine identity's role assignments on the rule and the workspace
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | your Entra tenant | |
| -SubscriptionId | yes | the subscription Entra Policy Suite is installed in | |
| -WorkspaceResourceId | yes | the Log Analytics workspace (its resource id) - the one that holds the Entra sign-in logs, so the exposure lists can be built | |
| -DataCollectionResourceGroup | no | the workspace's resource group | where the endpoint and the rule are made |
| -DceName | no | dce-entrapolicysuite | the data collection endpoint to make or to use (v1's EPSAzDceNameSrv, to reuse v1's) |
| -TagColumn | no | user tag type columns beyond v1's four, as the Identity page names them (e.g. Company, Tag_Department) | |
| -ResourceGroup | no | rg-eps | the install's resource group (found by itself when it is the default) |
Preview with -WhatIf
Every step it would take; nothing is changed.
Undo
Switch 'Send the report to Log Analytics' off; remove the two role assignments, the rule, the endpoint and (if wanted) the table.
Network
It connects to: login.microsoftonline.com, management.azure.com, graph.microsoft.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/eps/Initialize-EpsLogAnalytics.ps1 -OutFile Initialize-EpsLogAnalytics.ps1
.\Initialize-EpsLogAnalytics.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -WorkspaceResourceId <WorkspaceResourceId>To check the download first, compare its SHA-256 with the published one:
SHA-256 de9c9671013bd168f42929ca4e3f9c46965cde6d84c87e7e943e06bb94449522
Checksums: SHA256SUMS.txt · Version 2.0.107 · Documentation for version 2.0.83
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Initialize-EpsLogAnalytics.ps1 -Full · Source: Initialize-EpsLogAnalytics.ps1
Every script, identity and permission for your security review: Entra Policy Suite