Grant-PimSupportAccess
Give (or take back) Invardia support access to a PIM Manager installation
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Gives (or with -Remove takes back) the customer's Invardia Support app its access to this PIM Manager installation: its own read-only database user (the read role pim_support_read) and the time-limited support access module with the level as the consent (troubleshoot = read only; setup = admin rights only inside an open support session, at most 8 hours); asbuilt = start the as-built job (caj-pim-asbuilt) and read the PDFs it writes (troubleshoot and setup include it). The Support app is never made a member of the SQL admin group, never a database owner and never an owner of PIM's app registrations or groups. Every change is read back.
When to run it
When the customer wants Invardia support to look at (troubleshoot) or repair (setup) their installation, and to take that access back afterwards (-Remove). The guided public install runs it for you when a support app is named. For a private installation, run it from inside the network (the SQL server has no public endpoint). It is part of the PIM Manager release package, not a separate download: run it from the package folder that Install-Invardia (or the guided install) downloaded and verified (.\tools\setup\Grant-PimSupportAccess.ps1). Invardia's New-InvardiaSupportApp.ps1 must have created the support app in the tenant first.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | Member of the environment's SQL admin group (grp-pim-sql-admins) or the server's Entra admin, signed in through the browser or the Invardia Support app session (no Azure CLI) | the environment's SQL database (every level) | Creates the support app's read-only database user, installs the time-limited support access module (the read role, the consent, the signed procedures) and reads it back; with -Remove drops the user. |
| entraRole | Privileged Role Administrator | the tenant (only for -Remove, where an earlier grant made the support app a member of the SQL admin group) | The SQL admin group is role-assignable: removing a member needs this role. Without it that part is reported and the rest continues (exit 1). |
| other | Owner of PIM's app registrations and groups (or Application Administrator / Groups Administrator) | PIM's own objects in the tenant (only for -Remove, where an earlier grant made the support app an owner) | Removes the support app as an owner of the Manager's sign-in app, the access request API app, the Manager members group and the SQL admin group. |
| azureRbac | Reader | the PIM resource group (only when -SqlServer is not given) | Finds the PIM SQL server in -ResourceGroup. |
| azureRbac | User Access Administrator | the PIM resource group (only for the as-built access: -Level asbuilt / troubleshoot / setup / -Remove with -SubscriptionId and -ResourceGroup) | Creates the custom Azure role 'PIM Manager as-built runner' (Owner works too) and assigns it plus Storage Blob Data Reader to the support app. Role Based Access Control Administrator is enough once the role exists (Deploy-PimAsBuiltJob creates it). |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Environment SQL database | grant | the support app's own database user, created from the application's client id as a SID (never FROM EXTERNAL PROVIDER) when no user has that id -- named [invardia-support]; an existing user of the support app is reused whatever its name | the read role pim_support_read only (SELECT on the product schemas pim and platform) -- the ONE standing database right, at every level | the environment's SQL database | Invardia support reads the store to troubleshoot. No db_owner, no db_datareader and no VIEW DEFINITION are given. | Run the script with -Remove (drops the user), or switch the Invardia Support app off in Microsoft Entra ID. |
| Environment SQL database | create | the time-limited support access module: the schema pimsupport (the consent and the grant records), the read role pim_support_read, three signed procedures (open, close, state) | the consent level: troubleshoot (troubleshoot and asbuilt) = read only; setup = admin rights (db_owner) only inside an open support session, at most 8 hours, closed by the installation's own support job | the environment's SQL database | Admin rights for a repair exist only for the length of a support session, never as a standing right. | Run the script with -Remove (drops the support app's user; its rights go with it). |
| Azure RBAC | create | the custom role 'PIM Manager as-built runner (<resource group>)' when it does not exist yet: Microsoft.App/jobs/start/action + Microsoft.App/jobs/executions/read, assignable in the PIM resource group | The narrowest right to start the as-built job and follow its execution -- no job read, no logs, no secrets, no stop. | Delete the role definition after its assignments are removed. | ||
| Azure RBAC | grant | the support app's service principal (as-built document, PIM 100.61) | the custom role 'PIM Manager as-built runner' (start the job + read its executions) | the ONE job caj-pim-asbuilt | -Level asbuilt (included in troubleshoot and setup): Invardia support starts the as-built job on request. | Run the script with -Remove (deletes the assignment). |
| Azure RBAC | grant | the support app's service principal (as-built document, PIM 100.61) | Storage Blob Data Reader | the ONE container 'asbuilt' of the PIM storage account (the PDFs are deleted after 1 day) | Invardia support reads the PDF the job wrote, for that occasion, and stores nothing. | Run the script with -Remove (deletes the assignment). |
| Microsoft Entra ID, the SQL database and Azure RBAC | remove | the database user (with every role it holds), a membership of the SQL admin group and owner entries on PIM's app registrations and groups that an earlier version gave, and the as-built role assignments (only with -Remove) | this installation | Ends Invardia's access. | Run the script again without -Remove. |
What it only reads
- the support app's service principal, the SQL admin group's members, and with -Remove PIM's app registrations and groups and their owners (Microsoft Graph)
- the SQL servers in -ResourceGroup (only when -SqlServer is not given)
- the support app's database user by its id and its roles, and the support access module's state (read-back)
- the as-built job (the storage account it names) and the support app's role assignments on that job and on the container asbuilt
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -AppId | yes | The Invardia Support app's application (client) id in this tenant. | |
| -Level | no | troubleshoot | troubleshoot (read-only database user + the as-built access), setup (the same, and admin rights only inside an open support session of at most 8 hours) or asbuilt (start the as-built job and read its PDFs; with -SqlServer also the read-only database user). |
| -TenantId | yes | The tenant id. Every token is pinned to it. | |
| -SubscriptionId | no | The PIM subscription (used to find the SQL server when -SqlServer is not given). | |
| -ResourceGroup | no | The PIM resource group (used to find the SQL server when -SqlServer is not given). | |
| -SqlServer | no | The store's SQL server FQDN (<server>.database.windows.net). | |
| -SqlDatabase | no | PimPlatform | The database. |
| -EnvLabel | no | The per-environment label the deploy used (-EnvLabel), so the right app registrations and groups are found. | |
| -SqlAdminGroupName | no | grp-pim-sql-admins | The SQL admin group's name (read to report an earlier membership; -Remove takes it back). |
| -DbUserName | no | invardia-support | The contained database user's name. |
| -AsBuiltJobName | no | caj-pim-asbuilt | The as-built job (Deploy-PimAsBuiltJob.ps1); the storage account it names in PIM_ASBUILT_STORAGE is where the container asbuilt is granted. |
| -Remove | no | false | Take back everything: the database user, a membership and owner entries an earlier version gave, and the as-built role assignments. |
Preview with -WhatIf
Reads the support app and the SQL admin group and prints 'What if: Performing the operation "the Support app's own database user (from its client id) in pim_support_read only, and the support access module with consent '<level>'" on target ...' and the as-built grants it would make, then 'preview only -- nothing was changed'. Nothing is written.
Undo
Run the script again with -Remove: it drops the database user and takes back a membership, every owner entry and the as-built role assignments.
Network
It connects to: login.microsoftonline.com (sign-in), graph.microsoft.com, management.azure.com (to find the SQL server, and the as-built role assignments), <server>.database.windows.net:1433
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager