Confirm-PimInstall
Verify a PIM Manager installation
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Verifies a PIM Manager installation at the end of the install (and any time later): it reads every result an install must leave behind, repairs what can be repaired, prints one table with the fix for each line, and refuses "done" when a required line fails.
When to run it
Every install path runs it as its last step. Run it yourself after a private installation (from inside the network: the store has no public endpoint), after an interrupted install, or whenever you want to know the installation is complete. It is part of the PIM Manager release package, not a separate download: run it from the package folder that Install-Invardia (or the guided install) downloaded and verified (.\tools\setup\Confirm-PimInstall.ps1). It reads over REST (browser sign-in or the Invardia Support app session; no Azure CLI).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Reader | the PIM resource group (Contributor for the updater repair; Owner or User Access Administrator for the role repairs) | Reads the Manager app, the engine and updater jobs, their identities, role assignments and the SQL firewall rules. A repair (updater re-install, the Manager's Reader on the resource group, removing this run's 'AllowSetupHost' rule) needs the matching write right; without it the line stays failed or a warning, with its fix. |
| other | Member of the environment's SQL admin group (grp-pim-sql-admins), signed in through the browser or the Invardia Support app session (-UseSignedInAccount), or an admin application with a certificate (-ClientId + -CertThumbprint) | the environment's SQL database | Reads ManagerAccess, the licence, the mail sender and the alert recipients from pim.Settings; the SuperAdmin and alert-recipient repairs write them (Set-PimManagerAccess / Set-PimAlertRecipients). |
| entraRole | Global Reader (or any role that can read service principals and their application permission assignments) | the tenant | Checks that the engine identity holds every required Microsoft Graph application permission (appRoleAssignments) and that every SuperAdmin may sign in to the Manager (Easy Auth assignments). |
| entraRole | Global Administrator (only for the tenant-root Reader repair) | the tenant root management group | The one grant attempt of the engine's Reader at the tenant root. Without it the line is a warning carrying the Global Administrator's command; the install is still done. Missing Graph permissions are granted by a Privileged Role Administrator with Grant-PimEnginePermissions.ps1 (printed as the fix). |
| exchange | Exchange Administrator (optional) | Exchange Online | Tests that each sending identity holds the scoped 'Application Mail.Send' right (Test-ServicePrincipalAuthorization). Without it the mail line is a warning; mail is optional. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Environment SQL database | update | pim.Settings ManagerAccess (a named SuperAdmin missing) -- repair, via Set-PimManagerAccess | this environment | Every SuperAdmin of the install must be a SuperAdmin in the Manager. Never written when the store could not be read. | Manager > Settings > Access: change the role back. | |
| Environment SQL database | update | pim.Settings alert recipients (empty) -- repair, via Set-PimAlertRecipients | this environment | An install must not leave alerting without recipients. | Manager > Settings > Alerting > Recipients. | |
| PIM resource group | update | the updater job ca-pim-update (missing or wrong ring) -- repair, via Deploy-PimUpdateJob on the running image | this installation | A Pro installation must keep itself updated. | Delete or change the updater job (its ring is PIM_UPDATE_RING). | |
| Azure RBAC | grant | the engine job's managed identity -- one attempt | Reader (plus User Access Administrator with -EngineAzureRootUserAccessAdmin) | the tenant root management group | So the engine sees every subscription. Refused = a warning with the command. | Remove the role assignment at the tenant root. |
| Azure RBAC | grant | the Manager's managed identity -- one attempt | Reader | the PIM resource group only | The Manager's Environment report reads its own resources. | Remove the role assignment on the resource group. |
| Azure RBAC | grant | the engine job's managed identity -- only at a defined Azure scope it does not already hold it at (or above), read back | User Access Administrator (never Owner) | each Azure scope the store defines (Azure resource assignments and definitions: management groups, subscriptions, resource groups); the tenant root only with -EngineAzureRootUserAccessAdmin | The engine creates the Azure role assignments and role policies defined there. Refused = a warning with the command; nothing is ever removed. | Remove the role assignment at that scope (its description says 'converge engine access'). |
| SQL server firewall | remove | the 'AllowSetupHost' rule this run opened (only with -CloseSetupHostRule and -SetupHostRuleOwner this) | the environment's SQL server | No setup-time firewall opening is left behind. | None needed (an install opens it again when it needs it). | |
| Local file (only with -OutFile) | create | the result as JSON (done, failed, warnings, rows) | this computer | For a caller that reads the outcome. | Delete the file. |
What it only reads
- pim.Settings: ManagerAccess, License, the install key state, the mail sender, the alert recipients
- pim.Rows: the Azure resource assignments and definitions (their Azure scopes only)
- the Manager app, the engine / updater / downlink jobs and their executions, their identities and role assignments (management.azure.com)
- the engine identity's Microsoft Graph application permissions (appRoleAssignments) and the Manager's sign-in app assignments
- Exchange Online Test-ServicePrincipalAuthorization for each sending identity (when Exchange is reachable)
- the SQL server's firewall rules; managed tenant: the managing tenant's store network rules
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Role | no | Single | Single, Master (managing tenant) or Slave (managed tenant: adds the registered / subnet / first-pull lines). |
| -TenantId | yes | The tenant id. | |
| -SubscriptionId | yes | The PIM subscription. | |
| -ResourceGroup | yes | The PIM resource group. | |
| -SqlServerFqdn | yes | The store's SQL server FQDN. | |
| -SqlDatabase | no | PimPlatform | The database. |
| -SqlResourceGroup | no | the PIM resource group | The SQL server's resource group, when it differs. |
| -ManagerApp | no | ca-pim-manager | The Manager container app. |
| -TickJobName | no | ca-pim-tick | The engine job. |
| -UpdateJobName | no | ca-pim-update | The updater job. |
| -DownlinkJobName | no | ca-pim-downlink-s6 | Managed tenant: the job that pulls the managing tenant's bundle. |
| -EnvName | no | The Container Apps environment (needed for the updater repair). | |
| -AcrName | no | The registry (needed for the updater repair). | |
| -ImageRepo | no | pim-manager | The image repository. |
| -AcrAgentPoolName | no | The registry's build pool (private registry). | |
| -SuperAdmins | no | none | The install's SuperAdmins (comma-separated or a list). |
| -AlertRecipients | no | none | The alert recipients to repair an empty list with. |
| -UpdateRing | no | -1 | The update ring you expect (0-3). Left out, the check reports the ring the installation runs. |
| -UpdateSource | no | The update source of the updater repair (e.g. Invardia). | |
| -NoUpdater | no | false | A Community installation without a feed: there is no in-cloud updater by design (Update-PimCommunity.ps1 is its updater). |
| -LicenceExpected | no | false | Pro, trial or multi-tenant: a registered licence is required. |
| -LicenceLater | no | false | A trial or Pro installed without a licence: the licence line reminds you to add it in PIM Manager > Settings > Licence, never a stop. |
| -MailDeferredReason | no | Why the install could not set the mail sender (the line is then a warning with the Get Started follow-up). | |
| -SetupHostRuleOwner | no | this | Who owns the 'AllowSetupHost' SQL firewall rule: this run, the caller (the multi-tenant build closes it in its last step) or none. |
| -ClosingStep | no | sqlhostclose | The caller's step that closes the rule (shown in the line). |
| -CloseSetupHostRule | no | false | Remove this run's 'AllowSetupHost' rule and read it back. |
| -EngineAzureRootUserAccessAdmin | no | false | The root repair also grants the engine User Access Administrator (so it can assign Azure roles). |
| -SupportAppId | no | The Invardia Support app's application (client) id, when the installation named one. The line 'Invardia support: database access' then reads whether a database user with that id is in the read role pim_support_read (and says so when it also holds db_owner from an earlier grant -- a warning, never ok). Without it the line says 'not checked'. Read only: nothing is created or repaired by this line. | |
| -MasterSubscriptionId | no | Managed tenant: the managing tenant's subscription (for the lines it can read from here). | |
| -MasterStorageAccount | no | Managed tenant: the managing tenant's bundle store. | |
| -ManagingTenantStep | no | Managed tenant: the managing tenant's step shown when a line cannot be read from here. | |
| -EnrollmentWait | no | false | Enrolled managed tenant: a network not allowed yet and a first pull not yet done show as WAITING (the managing tenant allows it within minutes), never as a failure. |
| -ResumeCommand | no | The command that re-runs this install's verify (shown as the fix of a repairable line). | |
| -ClientId | no | Automation: an admin application's client id (with -CertThumbprint) instead of the signed-in account. | |
| -CertThumbprint | no | Automation: that application's certificate thumbprint (local machine store). | |
| -UseSignedInAccount | no | false | Read (and repair) as the signed-in person: the recommended way. |
| -NoRepair | no | false | Read and report only; no repair runs. |
| -OutFile | no | Write the result as JSON to this file. | |
| -SkipEngineAzureAccess | no | false | Do not converge the engine's Azure rights to the Azure scopes the store defines (by default it does: User Access Administrator where missing, read back; -WhatIf / -NoRepair only plan it). |
Preview with -WhatIf
Reads every line and prints the table with each fix; every repair it would make is previewed as 'What if: Performing the operation "repair" on target "install check '<line>'"' and not run, so a repairable line keeps its failed state. Nothing is written.
Undo
Nothing to undo for the check itself. A repair is undone the way its line says: the SuperAdmin / alert recipients in the Manager's Settings, the updater job, the two Reader role assignments.
Network
It connects to: login.microsoftonline.com (sign-in), management.azure.com, graph.microsoft.com, outlook.office365.com (Exchange admin API, mail line), <server>.database.windows.net:1433
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager