Install-Invardia
Install-Invardia (retired 2 November 2026 - installs nothing)
Purpose
Retired. Products are installed with the product's own install command, every value written out - never with an Invardia command. Install-Invardia now stops at once with that message, in every form (-Code, -Resume, -EnrollmentKey): it contacts nobody and writes nothing.
When to run it
Never. Use the product's own install command (PIM Manager, SecurityInsight).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | The person who installs, signed in to the tenant the installation is for | PIM Manager: PowerShell 7 on your own machine (a browser sign-in - nothing else to install, no Azure CLI, no modules). SecurityInsight: Azure Cloud Shell (PowerShell). | The bootstrap reads which tenant you are signed in to (Cloud Shell's own tenant and token, or the browser sign-in) and stops before the product installer if it is not the installation's tenant. It asks for no password and keeps no token. |
| other | The rights the product's installer needs | As listed with the install command (Before you start) and in the product's own documentation | The product's installer creates the product's Azure resources and Entra objects under your sign-in; the bootstrap needs no role of its own. |
What it changes
Nothing - it only reads.
What it only reads
- Nothing - it stops before reading or sending anything.
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Code | yes | The one-time install code from your installation page (parameter set Code). | |
| -EnrollmentKey | yes | An enrollment key (ek-...) from your company's portal (parameter set Enroll). Give it to the people who install for your organisation; if it gets outside, re-issue it in the portal. | |
| -Product | yes | With -EnrollmentKey: pim-manager or securityinsight. | |
| -SubscriptionId | no | the subscription the shell is signed in to (asked if none) | With -EnrollmentKey: the Azure subscription to install into. |
| -Location | no | the product's own default | With -EnrollmentKey: the Azure region. |
| -LegalName | no | asked in an interactive run; not asked when the environment is pre-staged | With an MSP's managed-tenant key: the legal name of the customer the tenant belongs to (e.g. 'Example School'). Invardia records it as a customer of the MSP; the MSP keeps the bill and the mails. |
| -EnvironmentName | no | asked in an interactive run; not asked when the environment is pre-staged | With -EnrollmentKey: the name of this tenant's environment (e.g. PROD). It can be renamed later in the customer portal; the products show the current name. |
| -Answers | no | none - the product's defaults | With -EnrollmentKey: the product's own install answers, the same choices as its Community install samples, e.g. @{ location = 'northeurope'; resourceGroup = 'rg-securityinsight'; mailTo = 'secops@contoso.com' }. They are added to the product's config file and checked by the product; the install's identity (tenant, install id, keys) never comes from here. |
| -TenantId | no | the tenant you sign in to | With -EnrollmentKey: the tenant the product goes into. The browser sign-in is pinned to it, and the run stops at once if this shell is signed in to another tenant. |
| -Resume | yes | Continue an installation from its saved state (parameter set Resume, with -InstallId). | |
| -InstallId | yes | With -Resume: the installation id the first run printed. | |
| -StateRoot | no | ~/clouddrive/invardia in Cloud Shell, else ~/invardia | Where the state folders are kept. |
| -PreflightOnly | no | false | Passed to the product's installer: run its checks only. |
| -ViaSupportApp | no | false | Invardia staff only: install through the Invardia Support app session of this shell (tools/Connect-InvardiaSupport.ps1 -Environment <handle> -Reason <why>) instead of a person's sign-in - for a customer who asks Invardia to install. Every token the session uses is recorded in the customer's audit log. Refused without such a session; customers run the command without it. |
| -Origin | no | https://invardia.com | For testing only. |
| -PollSeconds | no | 15 | How often it asks whether a trial or enrollment licence is signed yet (up to 10 minutes). |
| -WhatIf | no | false | Read and say what it would do; write nothing. |
Preview with -WhatIf
Install-Invardia -WhatIf stops the same way: nothing is written or sent.
Undo
Nothing to undo: it changes nothing.
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/install/bootstrap.ps1 -OutFile bootstrap.ps1
. .\bootstrap.ps1
Install-Invardia -Code <install code>To check the download first, compare its SHA-256 with the published one:
SHA-256 f393fdc2d032f56bae5ce2b2bd0a43e7813ebf2972eff4e356473a7bd48f1507
Checksums: SHA256SUMS.txt · Version 2026.11.01.1
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\bootstrap.ps1 -Full · Source: bootstrap.ps1
Every script, identity and permission for your security review: PIM Manager · SecurityInsight · Entra Policy Suite