Install-PimManager
Install PIM Manager (guided install)
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Install PIM Manager into your own Azure subscription in one guided run: check the answers, check your sign-in, rights and subscription, deploy PIM Manager, give the Invardia Support app its access when you named one, and verify the installation.
When to run it
Once, to install PIM Manager -- with only -TenantId and -SubscriptionId; the edition comes from the installer copy you downloaded (Community from the public GitHub release, trial and Pro from invardia.com -- a Pro install starts without a licence: afterwards you add it in PIM Manager > Settings > Licence); normally started by Start-PimManagerInstall.ps1, the launcher of the public release (Azure Cloud Shell or PowerShell 7). Every answer is a parameter. Run it again with the same parameters and -Resume after fixing a failed step. Run it with -WhatIf first to see the checks and every step without changing anything.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Owner | the target subscription | The deploy creates the resource group and its resources and assigns Azure roles to the identities it creates (Contributor + User Access Administrator is the equivalent). The check 'preflight-rights' refuses without it and prints the az role assignment create --role Owner command for a subscription Owner. |
| entraRole | Privileged Role Administrator | tenant | Microsoft Graph application permissions for the engine and Manager identities, the role-assignable SQL admin group. Global Administrator also works. Without an Entra admin role the install continues with a warning and the command for the right person. |
| entraRole | Application Administrator | tenant | The Manager's sign-in app registration. |
| exchange | Exchange Administrator | Exchange Online (optional) | Only for the mail sender (shared mailbox + its scoped send right). Without it the step is a warning with the command for an Exchange Administrator. |
| other | Signed in in the browser as yourself (or the Invardia Support app session opened by Invardia's connect script) | the tenant and subscription you name | Never a secret or certificate: a service principal, another tenant or another subscription is refused before anything is touched. When the Invardia Support app installs, it needs Owner on the subscription and the Graph application permissions RoleManagement.ReadWrite.Directory, AppRoleAssignment.ReadWrite.All and DelegatedPermissionGrant.ReadWrite.All (granted by Invardia's New-InvardiaSupportApp.ps1, checked here). |
| other | Or the Invardia Support app itself (an application, no person) | the tenant and the target subscription | Install-Invardia -ViaSupportApp runs the install inside a Connect-InvardiaSupport session. The application needs Contributor + User Access Administrator on the subscription and the Microsoft Graph application permissions RoleManagement.ReadWrite.Directory, AppRoleAssignment.ReadWrite.All, Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All, Group.Create, GroupMember.ReadWrite.All and Directory.Read.All (broader ones count: Group.ReadWrite.All, Directory.ReadWrite.All); the preflight names any that is missing. The administrators then come only from -SuperAdmins; no Exchange role, so mail is set up later. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure | create | the whole PIM Manager deployment (Invoke-PimDeployAll.ps1, signed in, external Container Apps): resource group, virtual network, container registry, Log Analytics, Azure SQL server + database, managed identities, Container Apps environment, the Manager app, the tick, bootstrap and updater jobs | PIM Manager runs entirely in your own subscription. | Delete the resource group (export the database first). The deploy's own page lists every object: https://invardia.com/docs/pim/scripts/Invoke-PimDeployAll/ | ||
| Azure | create | -PrivateNetwork only: the Container Apps environment internal (no public address); Azure SQL with public network access DISABLED and no firewall rule; a Premium registry with public access DISABLED and its agent pool pimpool (the image builds run inside the network, billed while it exists); a subnet for private endpoints; private endpoints for the database and the registry with their privatelink zones in the PIM resource group linked to the PIM network (or, with -PrivateDnsZonesResourceGroupId, registrations in your central zones through the endpoints' DNS zone groups -- no zone or link is written there); the environment's private zone linked to the PIM network; with -PeerToHub the peering with -HubVnetId (rights on both networks checked first, never half made), with -LinkZonesToHub all the installation's own zones linked to the hub | The private network install: PIM Manager, its database and its registry are reached only from your network. | Delete the resource group; remove the peering and the hub links on the hub when they were made. | ||
| Azure | update | -PrivateNetwork on an existing PUBLIC installation: the conversion to the private network (Convert-PimToPrivate.ps1 underneath: safety copy, private registry, the Container Apps part re-created internal, SQL private endpoint, then the public access of the registry and SQL off) | The same two lines convert a public installation; data is kept. | The conversion prints its rollback; Rebuild-PimEnvExternal.ps1 returns the Container Apps part to public. | ||
| Local machine | create | -PrivateNetwork only: network-hand-off.txt in the state folder (what your network team peers and links) | The network hand-off of a private install, also printed at the end. | Delete the file. | ||
| Microsoft Graph | grant | the tick job identity (engine set) and the Manager identity (read-only set) | Microsoft Graph application permissions -- the engine set (role, group and PIM-for-Groups assignment, role-assignable groups, administrative units, Temporary Access Passes, access reviews, Defender and Intune roles; RoleManagement.ReadWrite.Directory, AppRoleAssignment.ReadWrite.All, ...) and the read-only set; never a tenant-wide Mail.Send | tenant | The engine applies the access you define; the Manager only reads. | Remove the app role assignments of the identities (Enterprise applications > Permissions). |
| Azure RBAC | grant | the managed identities | AcrPull (registry), Reader (subscription; tenant root management group for the engine), Contributor (the updater, on the resource group) | registry / subscription / tenant root / resource group | Image pull without passwords, Azure discovery, the nightly update. | Remove the role assignments. |
| Azure RBAC | grant | the Manager's managed identity (verified and repaired by the end-of-install check) | Reader | the PIM resource group only | The Environment report reads the installation's own architecture (apps, jobs, registry, SQL, Key Vault, network). | Remove the role assignment (the Environment report then shows the architecture as not readable). |
| Entra ID | create | group grp-pim-sql-admins (role-assignable) as the SQL server's Entra admin; you (the person installing) are added as a member | The store steps connect to Azure SQL as you; the group is the one admin of the store. | Remove yourself from the group; set another admin and delete it. | ||
| Azure SQL | grant | database users (CREATE USER from each identity's application id) | one least-privilege role per component: pim_web (the Manager), pim_engine (the engine job), pim_updater + db_ddladmin (the updater) -- no db_datareader / db_datawriter | the PIM database | Each container reads and writes only what its job needs; only the updater applies the schema. | DROP USER [<name>]. |
| Azure SQL | create | the least-privilege access model: a signed access procedure (pim.usp_ApplyAccess) with an in-database certificate (expires 2099, private key removed) and the component roles | the updater may only EXECUTE the procedure | the PIM database | Every later update applies its grants through the procedure alone -- nothing routine needs a SQL administrator again. | none needed (it holds no secret and grants only the component roles). |
| Microsoft Entra ID | remove | the signed-in installer's membership of the SQL admin group | group membership | the SQL admin group | The installer is a SQL administrator only for the length of the install; the standing member is the Invardia Support app (when named). | a Privileged Role Administrator adds a member again (Microsoft Entra admin center). |
| Entra ID | create | the Manager's sign-in app registration with delegated sign-in consent, assignment required; the portal users from the answers assigned (appRoleAssignedTo), or a members-only group | Only the people you named sign in to the Manager. | Delete the app registration and the group. | ||
| Azure SQL | update | pim.Settings: ManagerAccess (the superAdmins, or you), feature gates, alert recipients; for a Trial or Pro installation also InstallEdition (the edition it was installed as) | A new installation has an administrator and working alerts from the start; a Trial or Pro installation asks Invardia for its licence by itself. | Change them in the Manager's Settings. | ||
| Azure SQL | grant | the Invardia Support app (only when -SupportAppId names one; Grant-PimSupportAccess.ps1), every level | its own database user, created from its client id, in the read role pim_support_read only (SELECT on the product schemas) + the time-limited support access module with -SupportAccess as the consent: troubleshoot / asbuilt = read only, setup = admin rights only inside an open support session of at most 8 hours | the PIM database | Invardia support can read the store to help you; admin rights for a repair exist only for the length of a support session. The Support app is not made a member of the SQL admin group, a database owner or an owner of PIM's app registrations or groups. | Grant-PimSupportAccess.ps1 -Remove (drops the user; its rights go with it). |
| Exchange Online | create | the shared sender mailbox + an Exchange RBAC send right (Application Mail.Send) scoped to that one mailbox for the Manager and tick identities (only with Exchange Administrator) | Notification mail is sent by the solution's own identities from one mailbox only. | Remove the management role assignment and scope, then the mailbox. | ||
| Local machine | create | the installation's own state file state.json (the completed steps and a note that this installation opened the SQL firewall rule AllowSetupHost -- never a key or a token) and verify-install.json in the state folder (clouddrive/invardia/<install id> in Cloud Shell, else your home folder) | -Resume with the same parameters continues where a run stopped. | Delete the state folder. | ||
| Azure | create | the installation's own Key Vault (-KeyVaultName, else kv-pim-<token>; Standard, Azure RBAC, soft delete 90 days, purge protection) with an RSA key signin-front (wrap / unwrap only) | The sign-in front's data-protection keys are wrapped by it, so a restart or a second replica keeps everyone signed in. | Delete the Key Vault with the resource group (purge protection keeps it 90 days). | ||
| Azure RBAC | grant | the Manager's web identity | Key Vault Crypto Service Encryption User | the key signin-front only | The sign-in front wraps and unwraps its keys with it -- nothing else in the vault. | Remove the role assignment on the key. |
| Azure SQL | grant | a database user for the Manager's web identity | owner of the schema signin + CREATE TABLE -- no role | the PIM database | The sign-in front keeps its sessions, token cache and key ring in two tables of its own there. | DROP the schema signin and the user. |
| Entra ID | update | the Manager's sign-in app registration: identifierUri api://<client id>, the delegated scope user_impersonation and its organisation-wide consent, a federated credential for the web identity (no secret), redirect URIs | The sign-in front signs people in without a client secret and passes the PIM Manager an access token for itself. | Remove them from the app registration (the Manager then needs Easy Auth again). | ||
| Azure | update | the Manager app: the sign-in front container (signin-front:<pinned version>, built in the installation's registry) in front of the Manager; Easy Auth switched OFF only once the front answers (rolled back to Easy Auth otherwise) | Every new installation signs people in through the sign-in front. | Set-PimManagerSigninFront.ps1 -Rollback -StateFile <the state folder>/signin-front-rollback.json |
What it only reads
- Checks: az account show / get-access-token (who you are, tenant, subscription), your Azure role assignments on the subscription, your directory roles (transitiveMemberOf: Global Administrator, Privileged Role Administrator, Application Administrator), the resource providers, the resource group, the SQL server and registry names, and the chosen region (any Azure region): the subscription's regions, where every service PIM Manager creates is offered (Container Apps, Azure SQL, Container Registry, Key Vault, Storage, Log Analytics, managed identities) and Azure SQL's capabilities there (Standard S0) -- names what is missing and the nearest region that has everything.
- After the deploy: the tick job's identity, the Manager's address, the SQL server and Log Analytics ids for the outputs; the end-of-install check reads every result back (SuperAdmins, updater, licence, mail sender, alerts, engine rights, sign-in, the SQL window) and repairs what it can -- a required line that would fail stops the install with its fix.
- Database role db_owner is only checked, never granted.
- -PrivateNetwork only, before anything is created (step 'preflight-network'): the -VnetId network (region, subnets), the -HubVnetId network's range and the zones in -PrivateDnsZonesResourceGroupId -- read only.
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | The Microsoft Entra tenant PIM Manager manages. | |
| -SubscriptionId | yes | The Azure subscription that hosts PIM Manager. | |
| -Location | no | swedencentral | Any Azure region; the checks confirm every service PIM Manager needs is offered there before anything is created. |
| -ResourceGroup | no | rg-pim | Created when it does not exist; an existing one is reused. |
| -SuperAdmins | no | you (the person installing) | The PIM Manager administrators (sign-in names). |
| -AlertRecipients | no | the administrators' mailboxes | Who gets the alerts. |
| -MailSender | no | The mailbox PIM Manager sends from (set up by the install when you hold an active Exchange Administrator role). | |
| -PortalUsers | no | the administrators | Who may sign in to PIM Manager (sign-in names). |
| -AllowAllMembers | no | false | Every member account of the tenant may sign in to PIM Manager; guests never. |
| -VnetAddressPrefix | no | 10.220.0.0/22 | The virtual network range. |
| -SubnetAddressPrefix | no | 10.220.0.0/23 | The old name of -AppsSubnetPrefix, kept for one release (a -Resume command printed by an earlier run may carry it). |
| -Exposure | no | external | The old switch of the network shape, kept for one release: internal = -PrivateNetwork, external = the public install. |
| -PrivateNetwork | no | false | Install the private shape: the Container Apps environment has no public address, the database is reached over a private endpoint, the registry is Premium. Without it: the public shape, behind Microsoft Entra sign-in. |
| -VnetId | no | A private install: use this existing virtual network instead of making one. It must be in the installation's subscription (any resource group) and in the chosen region; a missing subnet is created, an existing one is used as it is. | |
| -VnetName | no | vnet-pim | The name of the virtual network the installation makes. |
| -AppsSubnetName | no | snet-pim-aca | The Container Apps subnet's name. |
| -AppsSubnetPrefix | no | 10.220.0.0/23 | The Container Apps subnet's range: a /23 or larger, inside the virtual network range. |
| -EndpointsSubnetName | no | pim-endpoints | A private install: the subnet for the private endpoints (not delegated). |
| -EndpointsSubnetPrefix | no | the /26 right after the apps subnet | A private install: the private endpoints subnet's range, a /28 or larger, not overlapping the apps subnet. |
| -PrivateDnsZonesResourceGroupId | no | A private install: the resource group id of your central privatelink zones. They are used, never created or written; a zone that is not there stops the checks before anything is created. | |
| -HubVnetId | no | A private install: your hub network. Its range is checked for overlap; the peering and the zone link are made only with -PeerToHub / -LinkZonesToHub, else they are on the network hand-off. | |
| -LinkZonesToHub | no | false | A private install with -HubVnetId: link PIM Manager's own private zone (the Container Apps environment's domain) to the hub. |
| -PeerToHub | no | false | A private install with -HubVnetId: peer the PIM network with the hub, both sides. |
| -InternalRanges | no | [] | A private install behind a hub firewall, with -FirewallIp: the ranges your users connect from. The app subnet gets a return route for each (route table rt-pim, next hop your firewall, BGP route propagation off) in a network the installation makes; with -VnetId the route is on the network hand-off. |
| -FirewallIp | no | A private install, with -InternalRanges: your hub firewall's private IP, the next hop (VirtualAppliance) of the return route. | |
| -WebAppAccess | no | external (internal with -PrivateNetwork) | How the PIM Manager is reached. internal needs -PrivateNetwork, and a private install is always internal (the whole Container Apps environment has no public address). |
| -Edition | no | Community | Community (free, the Core features, Community updates), Trial or Pro (the same installation with the Pro updater, deployed without a licence: afterwards you add your licence in PIM Manager > Settings > Licence). Several tenants (MSP) are set up with the managing-tenant build. |
| -UpdateRing | no | 3 | Trial / Pro: the update ring, 2 (design partners) or 3 (broad). |
| -KeyVaultName | no | kv-pim-<token> | The installation's own Key Vault name (3-24 letters, digits and dashes). |
| -EngineAzureRootUserAccessAdmin | no | false | Also give the PIM engine User Access Administrator at the tenant root management group (off by default: the engine always gets Reader there). |
| -InstallId | no | derived from tenant, subscription and resource group | The installation id: the resource names and the state folder come from it, so the same answers give the same ones (that is how -Resume finds them). |
| -SupportAppId | no | The Invardia Support app's client id -- only when you want Invardia support to have access. The Support app is named by its id, never found by name; nothing is granted without it. | |
| -SupportAccess | no | troubleshoot | The Support app's level, recorded as its support consent: troubleshoot (read only), setup (read only, and admin rights only inside an open support session of at most 8 hours) or asbuilt (read only + the as-built document). Used only with -SupportAppId. |
| -Reporter | no | Callback that receives every step event (Invardia's installer uses it to report progress). | |
| -StatePath | no | clouddrive/invardia/<install id> (Cloud Shell) or ~/invardia/<install id> | Folder for the resume state. |
| -Resume | no | false | Continue a stopped installation with the same parameters; completed checks and steps are skipped. |
| -PreflightOnly | no | false | Run only the checks. |
| -ViaSupportApp | no | false | Run the installation as the Invardia Support app. It needs a Connect-InvardiaSupport session for the same tenant in this PowerShell window; without one the installation stops before anything is read or changed. |
Preview with -WhatIf
Runs the checks (reads only) and then prints what the installation would do, step by step, including the deploy's own plan with every object, permission and scope -- and stops before the first change: no Azure / Entra ID / SQL / Exchange change, no state file. The end-of-install check repairs, so it is named but not run.
Undo
Delete the resource group (export the database first), the Entra objects the deploy created (the Manager's sign-in app, grp-pim-sql-admins, the members group), the Reader assignment at the tenant root management group, the Exchange scoped send right and mailbox; Grant-PimSupportAccess.ps1 -Remove takes back the Invardia Support app's access.
Network
It connects to: management.azure.com, graph.microsoft.com, login.microsoftonline.com, <server>.database.windows.net (TCP 1433), <registry>.azurecr.io, outlook.office365.com (Exchange Online admin API, mail sender), the Azure CLI extension index (azcliextensionsync.blob.core.windows.net): az installs its 'containerapp' extension once when missing -- az's own download, checked against the index's sha256
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager