Import-PimV1Data
Import the data of a PIM version 1 installation into PIM Manager
Purpose
Imports the data of a PIM version 1 installation (its CSV files and naming conventions) into an existing PIM Manager installation. By default it only checks and previews -- it writes nothing; -Apply adds the new rows by key, never deletes, and stops before writing anything when a row conflicts.
When to run it
Once, when you move from PIM version 1 to PIM Manager: after PIM Manager is installed, point it at the version 1 data folder (the folder with the *.custom.csv files). Run it first without -Apply and read the preview; then run the same command with -Apply. Running it again is safe: rows already there are left alone. For a private installation (the SQL server has no public endpoint), run it from a machine inside the installation's network, or ask Invardia support.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | A member of the installation's SQL admin group (grp-pim-sql-admins), or a database user in the PIM database | the PIM database | Reads what PIM Manager already holds (the preview) and, with -Apply, adds the rows. -Apply needs the database owner role (db_owner), which the SQL admin group gives. The run checks this first and says plainly what is missing; a Privileged Role Administrator can add you to the group (it is role-assignable). |
| azureRbac | Reader | the installation's subscription or resource group | Finds the installation: the SQL server that holds the PIM database, its network setting, its administrator and its firewall rules. |
| azureRbac | SQL Server Contributor (or Contributor / Owner) | the PIM SQL server (or its resource group) -- only when this machine is not allowed through its firewall | Adds the temporary firewall rule for this machine's public address and removes it at the end of the run. |
| other | Your own browser sign-in, or the Invardia Support app's session in this window | the target tenant and subscription | A session of another tenant or subscription is refused. No Azure CLI, no PowerShell modules, no secret on the command line. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| The PIM database | create | the rows of the version 1 files that PIM Manager does not have yet (pim.Rows, added by their natural key, one transaction per file) -- only with -Apply | the one PIM database (-Database, default PimPlatform) | That is the import. A row whose key is already there with the same content is left alone; nothing is ever deleted. | Delete the added rows in PIM Manager (each imported row shows there like any other), or restore the database from its point-in-time backup to before the run. | |
| The PIM database | update | a row whose key is already in PIM Manager with different content -- only with -Apply -OnKeyConflict Overwrite; without it a conflict stops the run before anything is written (KeepExisting keeps PIM Manager's row). Manager super admins and break-glass admins are never overwritten. | the one PIM database | Lets you choose the file's version of a conflicting row explicitly, after the preview has listed every conflict. | Restore the database from its point-in-time backup to before the run, or edit the rows back in PIM Manager. | |
| The PIM database | create | settings from the version 1 folder, each only when PIM Manager does not have it yet: the naming conventions you changed from the defaults (a value already changed in PIM Manager is kept), warning overrides, exemptions and workload exemptions -- only with -Apply; the PIM tables are made sure to exist first (an existing table is not changed) | the one PIM database (pim.Settings) | The naming conventions are part of the version 1 data: the names your existing groups were built with. | Change the settings back in PIM Manager (Settings). | |
| Azure SQL server | create | a temporary firewall rule 'PimV1Import-<time>' for this machine's public address, only when no rule allows it; removed again at the end of the run and read back, also after a failed step (also in the preview without -Apply; never with -WhatIf) | the PIM SQL server | The run reads (and with -Apply writes) the database from this machine. | None needed: the run removes it. If the run is killed: Azure portal > the SQL server > Networking > Firewall rules: delete 'PimV1Import-<time>'. |
What it only reads
- the files in -SourcePath (the naming conventions file is parsed first and refused when it contains commands; the importer then loads it to read its values, as PIM version 1 did)
- the subscription (visible, and in -TenantId)
- the SQL servers of the subscription (or -ResourceGroup) and whether each holds the PIM database
- the SQL server: its public network access, its Microsoft Entra administrator, its firewall rules
- in the PIM database: your user, whether you are database owner, the rows PIM Manager holds for each imported file, and who the Manager super admins and break-glass admins are
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SourcePath | yes | The PIM version 1 data folder (the *.custom.csv files and PIM4EntraPS.NamingConventions.custom.ps1). The files are read, never changed; *_Delta.csv and *_LastApplied.csv are skipped. | |
| -TenantId | yes | The tenant of the PIM Manager installation. Every sign-in is pinned to it. | |
| -SubscriptionId | yes | The subscription of the PIM Manager installation. | |
| -ResourceGroup | no | searched in the whole subscription | The installation's resource group. Needed only when the subscription holds more than one PIM installation (the run lists them). |
| -SqlServerName | no | found | The installation's SQL server. Needed only when one resource group holds more than one PIM installation. |
| -Database | no | PimPlatform | The PIM database. |
| -Apply | no | off (check + preview only) | Write: add the new rows by key, never delete. Without it nothing is written. |
| -OnKeyConflict | no | Refuse | With -Apply, a row whose key is already in PIM Manager with different content: Refuse (nothing is written), KeepExisting (PIM Manager's row stays, the rest is imported) or Overwrite (the file's row replaces it). |
| -ForceLocal | no | off | Imported rows stay on this tenant (Replicate=No; admins ManagementMode=local) unless the file sets the value. |
| -MspMaster | no | off | Give it only when the installation is an MSP managing tenant: the check then also shows what each row would send to the managed tenants. Without it the installation is treated as a single tenant. |
| -NotMspMaster | no | off | Not needed any more (single tenant is the default); still accepted so older command lines keep working. |
| -DefaultDomain | no | The tenant's default sign-in domain, for admin rows that have a user name but no user principal name. | |
| -AllowValidationErrors | no | off | Import even though the check found errors in the files (they are listed). Without it -Apply refuses such files. |
| -ClientIp | no | read from api.ipify.org (said on screen) | This machine's public address for the temporary firewall rule. |
Preview with -WhatIf
Without -Apply the run only checks and previews: it prints, per file, the rows to add, the rows already there, the conflicts and the problems the check found, and writes nothing to the database (it may add the temporary firewall rule, and removes it again). With -WhatIf it also adds no firewall rule: when this machine is not allowed through the firewall it prints the 'What if:' line for the rule and reads no rows.
Undo
Nothing is ever deleted. Rows that were added can be deleted in PIM Manager, or the database restored from its point-in-time backup to before the run. The temporary firewall rule is removed by the run itself.
Network
It connects to: login.microsoftonline.com (sign-in), management.azure.com (Azure Resource Manager), <server>.database.windows.net:1433, api.ipify.org (this machine's public address, unless -ClientIp is given), localhost (the browser returns the sign-in to a local port on this computer)
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/pim/Import-PimV1Data.ps1 -OutFile Import-PimV1Data.ps1
.\Import-PimV1Data.ps1 -SourcePath <SourcePath> -TenantId <TenantId> -SubscriptionId <SubscriptionId>To check the download first, compare its SHA-256 with the published one:
SHA-256 5e88f699e1340eedede3937c87ffc28fee7fe4996769155e0c7acd41a672b424
Checksums: SHA256SUMS.txt · Version 3.0.70
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Import-PimV1Data.ps1 -Full · Source: Import-PimV1Data.ps1
Every script, identity and permission for your security review: PIM Manager