Set-EpsWebAccess
Documentation out of date
The documentation below was written for a different copy of this script than the one published now. Read the script itself before you run it, or ask support@invardia.com.
- the .doc.json names no sha256 of the script it documents
- the .doc.json is for version 2.0.0, the published script is 2.0.107
The published script's own summary: Names who may use the Entra Policy Suite web app: SuperAdmin, Admin or Reader. Used once to name the first SuperAdmin.
Purpose
Names a SuperAdmin of the web app when there is none: it starts the install's database setup job with that person, which writes the access list and the audit trail. A SuperAdmin then manages access in the app (Admin and Reader are given there). An install made before 2.0.59 is written directly (any role).
When to run it
Once after the install, or when no SuperAdmin is left.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor (or any role that may start a Container Apps job) | the install's resource group | starts the database setup job, which names the SuperAdmin when there is none - no database right needed (installs made since 2.0.59) |
| other | the Entra Policy Suite SQL server's Entra admin - only for an install made before 2.0.59 (no database setup job) | the Entra Policy Suite database | writes the access list directly |
| entraRole | any user who can read users (Directory Readers is enough) | the tenant | checks the person exists and pins their object id |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| SQL | update | eps.WebAccess (one row) | the Entra Policy Suite database | who may use the web app | remove the person in the app's Access page (a SuperAdmin), or run again with -Role Reader | |
| SQL | create | eps.AuditEvent (one row, access.grant) | the Entra Policy Suite database | every access change is audited | not possible: the audit trail is append-only |
What it only reads
- Graph: the signed-in user and the named user (id, UPN)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | your Entra tenant | |
| -SubscriptionId | yes | the subscription Entra Policy Suite is installed in | |
| -UserPrincipalName | yes | the person | |
| -Role | no | SuperAdmin | SuperAdmin, Admin or Reader |
| -Reason | yes | why (goes into the audit trail) | |
| -ResourceGroup | no | rg-eps | the install's resource group (an install made before 2.0.55: rg-entrapolicysuite, found by itself when it is there) |
Preview with -WhatIf
The person, the role and who grants it; nothing is changed.
Undo
A SuperAdmin removes the person on the app's Access page.
Network
It connects to: login.microsoftonline.com, management.azure.com, graph.microsoft.com, <server>.database.windows.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/eps/Set-EpsWebAccess.ps1 -OutFile Set-EpsWebAccess.ps1
.\Set-EpsWebAccess.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -UserPrincipalName <UserPrincipalName> -Reason <Reason>To check the download first, compare its SHA-256 with the published one:
SHA-256 463b67c29bffd5019447e850fda7aaf382af74c418bc31148ac1921eb21ec765
Checksums: SHA256SUMS.txt · Version 2.0.107 · Documentation for version 2.0.0
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Set-EpsWebAccess.ps1 -Full · Source: Set-EpsWebAccess.ps1
Every script, identity and permission for your security review: Entra Policy Suite