Documentation

PIM Manager scripts

Every PIM Manager script you may be asked to run: what it is for, who may run it, every permission and change it makes (with scope and why), its parameters, what -WhatIf shows and how to undo it. Read the page before you run the script.

Always save a script, check its SHA-256 against the published SHA256SUMS.txt, read it, then run it - each page shows the commands.

• Deploy-PimActivatorBackend

  PIM Activator: create the sign-in app registration

• Deploy-PimActivatorClient

  PIM Activator: install the extension on a machine without Intune

• Deploy-PimHybridWorker

  PIM for Active Directory: deploy the hybrid worker (Azure VM or on-premises with Azure Arc)

• Grant-PimEnginePermissions

  Grant the PIM Manager engine identity its missing permissions

• Grant-PimSupportSqlAccess

  Give the Invardia Support app its read-only database access on an existing installation

• Import-PimV1Data

  Import the data of a PIM version 1 installation into PIM Manager

• Initialize-PimHybridWorkerAd

  PIM for Active Directory: prepare Active Directory for the hybrid worker

• Initialize-PimMailSender

  Set up the shared mailbox PIM Manager sends mail from

• Initialize-PimSqlAdminGroup

  Make the SQL admin group the Entra admin of the PIM Manager database server

• Initialize-PimWorkloadPrereqs

  Check and fix a workload's prerequisites for PIM Manager

• Install-PimHybridWorker

  PIM for Active Directory: install and configure the hybrid worker on the worker machine

• Invoke-PimSupportSqlAccessJob

  Give the Invardia Support app its read-only database user on an installation with a private database, from inside

• New-PimHubPrepareScript

  Write the hub owner's preparation script (private install)

• Publish-PimActivatorRemediation

  PIM Activator: upload the Intune Remediation

• Set-PimLicense

  Register the PIM Manager licence

• Set-PimSigninFrontSqlState

  Give the sign-in front its place in a private PIM database

• Set-PimSmtpRelayPassword

  Store the SMTP relay password in the environment's Key Vault

• Set-PimSqlTier

  Set the PIM Manager SQL database tier and its 250 GB maximum size

• Start-PimManagerInstall

  Install PIM Manager (one command)

Part of the release

Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.

• Confirm-PimInstall

  Verify a PIM Manager installation

• Convert-PimToPrivate

  Convert a public PIM Manager environment to private with one command

• Copy-PimSettings

  Copy settings from one PIM Manager environment to another

• Deploy-PimActivatorHybrid

  PIM Activator: deploy to machines without Intune (local policy or AD Group Policy)

• Deploy-PimRfaBroker

  Deploy the access-request (RFA) broker

• Export-PimSettings

  Export PIM Manager settings to a settings document (settings as code)

• Find-PimStrayTestObjects

  Find objects left behind by test runs

• Grant-PimHybridWorkerAccess

  PIM for Active Directory: grant the hybrid worker's identity its cloud access

• Grant-PimSupportAccess

  Give (or take back) Invardia support access to a PIM Manager installation

• Import-PimSettings

  Apply a settings document to a PIM Manager environment (settings as code)

• Install-PimManager

  Install PIM Manager (guided install)

• Invoke-PimDeployAll

  Deploy or update PIM Manager (deploy everything)

• Invoke-PimHybridWorkerRunCommand

  PIM for Active Directory: run the hybrid worker installer through Azure run-command

• Invoke-PimMspBuild

  Build a managing or managed tenant (MSP build)

• Move-PimIdentities

  Move each PIM Manager app and job to its own identity

• New-PimHostingPrerequisites

  Create the Azure prerequisites of a PIM Manager environment

• New-PimHybridWorkerInfra

  PIM for Active Directory: build the hybrid worker's Azure side (or check an Azure Arc server)

• Rebuild-PimEnvExternal

  Rebuild a PIM Manager environment with the other exposure

• Rebuild-PimEnvInternal

  Convert a public PIM Manager environment to private

• Remove-PimContainerStack

  Remove the Container Apps part of a PIM Manager environment (keep the data)

• Remove-PimHybridWorker

  PIM for Active Directory: remove the hybrid worker (Azure VM or Azure Arc server)

• Rename-PimJobs

  Rename each PIM Manager job to its standard name

• Set-PimBreakGlassAccounts

  Set the break-glass accounts (operator route)

• Set-PimEmergencyPassphrase

  Set up the emergency override passphrase

• Set-PimHybridWorkerEgress

  PIM for Active Directory: NAT gateway egress for the hybrid worker VM (no public IP)

• Set-PimHybridWorkerPeering

  PIM for Active Directory: show, cut or restore the hybrid worker's network reach

• Set-PimManagerAccess

  Set who may use PIM Manager

• Set-PimManagerCustomHost

  Give the PIM Manager a custom host name

• Set-PimSqlPublicAccess

  Turn the PIM SQL server's public network access off or on

• Update-PimCommunity

  Update an installation by hand (signed release)

Every script, identity and permission for your security review: PIM Manager

Installing on a private network: PIM Manager network guides · command wizard

Other products:SecurityInsight · Entra Policy Suite · Invardia· Download page