PIM Manager command wizard

The commands are made for PIM Manager 2.4.579 · 2026-10-10 (written by the PIM Manager team).

Answer the questions and get the commands, in order, for your combination. The wizard runs nothing in your tenant and configures nothing in your network; your answers stay in this browser.

Read first: Network options ·Install in private mode ·Convert public to private

Your setupEditionCommunity: no update source; updates with Update-PimCommunity.ps1. Pro / trial: updates from Invardia on your ring, plus the licence step.TenancySingle: one tenant. Managing tenant / Managed tenant: the multi-tenant build. The commands use the scripts' own values (-Role Master / -Role Slave, master.*, slaves[]); they mean Managing tenant and Managed tenant.ExposureThis cannot be changed later without a rebuild (see the conversion guide).Hub VNet: who creates the hub side of the peering?PIM setup needs Network Contributor on the hub. If the hub belongs to another team, the hub owner runs a preparation script and the install skips the peering.Does your firewall allow only port 1433 to SQL?Give the PIM Manager a custom name?Optional. A private environment needs your own certificate (Key Vault or a PFX file).Add the access-request portal (RFA)?Pro only. The broker is always public; the PIM Manager stays as chosen above.

Optional: fill in your values

Ids and names only - never a secret. Anything left empty stays a placeholder in <angle brackets>.

Tenant idSubscription idRegionResource groupShort name (used to derive the other names)

What the wizard does not offer

Combination / option	Why
Community with Managing tenant / Managed tenant	Pro only, hard-enforced
A managed tenant hosted by the provider	Not a current build path
Changing exposure "in place"	Impossible in Azure. Use the conversion guide instead (Rebuild-PimEnvInternal.ps1 / Rebuild-PimEnvExternal.ps1).
A private RFA portal	Deploy-PimRfaBroker.ps1 refuses an internal environment by design
An enrollment key with private SQL	Refused by Invoke-PimDeployAll. Use a licence file and Set-PimLicense.ps1 from inside.
Free managed certificate on a private environment; private top-level names on a public one	Refused by Set-PimManagerCustomHost.ps1