Grant-PimHybridWorkerAccess
PIM for Active Directory: grant the hybrid worker's identity its cloud access
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Grants the hybrid worker's managed identity (Azure VM or Azure Arc server) exactly what it needs outside Active Directory: a database user in the PIM store, read-only Microsoft Graph roles and read access to the PIM source store.
When to run it
Once per worker, after the infrastructure step and before Install-PimHybridWorker.ps1 -Phase Configure (the install fetches the code with the identity). -PrincipalId for the Azure VM's identity, -ArcMachineResourceId for an Azure Arc server. Runs in Windows PowerShell 5.1 or PowerShell 7 (on a PowerShell 7 transport failure the SQL step re-runs once in a Windows PowerShell 5.1 child; the token travels on its standard input).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Privileged Role Administrator | the tenant | grants Microsoft Graph application roles to the worker identity |
| azureRbac | User Access Administrator | the source-store container | assigns Storage Blob Data Reader (Owner or Role Based Access Control Administrator also work) |
| other | Microsoft Entra admin of the PIM SQL server | the PIM database | creates the worker's contained database user and adds it to db_datareader + db_datawriter |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Microsoft Graph | grant | application permission (app role assignment) of the worker identity | Group.Read.All, User.Read.All, PrivilegedAssignmentSchedule.Read.AzureADGroup (+ Mail.Send with -GrantMailSend) | the tenant | the worker reads the PIM groups and who is active in them; read only | remove the app role assignments in the identity's enterprise application |
| Azure RBAC | grant | the worker identity | Storage Blob Data Reader | the source-store container (-SourceContainerId) | self-update with the identity -- no SAS, no PAT | remove the role assignment |
| PIM database | grant | contained user -SqlUserName created from the identity's application id | db_datareader, db_datawriter (never db_ddladmin) | the PIM database (-SqlDatabase) | the worker reads its work and writes its state and audit | DROP USER [<name>] |
What it only reads
- the subscription's tenant
- the identity's service principal and its current app role assignments
- the current role assignments on the container and the current database principals (read-before-write)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | The subscription (tenant check; the Arc machine's subscription). | |
| -TenantId | yes | The tenant; Graph calls follow it and the script refuses another. | |
| -PrincipalId | no | Azure VM worker: the VM's managed identity object id (the infrastructure step returns it). | |
| -ArcMachineResourceId | no | Azure Arc worker: the Arc machine's resource id; its identity is read from Azure. | |
| -ArcApiVersion | no | 2024-07-10 | Microsoft.HybridCompute api-version. |
| -SqlServer | no | The PIM SQL server FQDN (<server>.database.windows.net). Omitted: no SQL step. | |
| -SqlDatabase | no | PimPlatform | The PIM database. |
| -SqlUserName | no | PIMHYBRIDWRK | The contained user's name; one per worker. |
| -SourceContainerId | no | The source-store container's resource id. Omitted: no storage grant. | |
| -GrantMailSend | no | false | Also grant Mail.Send (new AD admin accounts get their initial password by mail). |
Preview with -WhatIf
Prints each Graph role, the storage role and the SQL user / role memberships it would grant; grants nothing.
Undo
Remove the Graph app role assignments, the Storage Blob Data Reader assignment and DROP USER the contained user.
Network
It connects to: management.azure.com, graph.microsoft.com, login.microsoftonline.com (REST, browser sign-in or an Invardia support session); the PIM SQL server on 1433; no Azure CLI, no PowerShell module
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager