Invoke-PimDeployAll
Deploy or update PIM Manager (deploy everything)
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Deploy or update the whole of PIM Manager in your own Azure subscription in one run: the hosting resources, the container image, the containers and their identities, the database schema, the mail sender, sign-in, the code, the nightly updater and the first administrators -- then verify it. Without -Apply it only prints the plan.
When to run it
To install PIM Manager into a subscription from the downloaded package, or to bring an existing installation up to date with the same parameters. The guided install (Install-PimManager.ps1) runs it for you; run it directly when you deploy by hand or from your own pipeline. Run it with -WhatIf (or without -Apply) first.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Owner | the target subscription | It creates the resource group and every resource in it and assigns Azure roles to the identities it creates (Contributor + User Access Administrator is the equivalent). |
| azureRbac | User Access Administrator | the target subscription (with Contributor, instead of Owner) | Azure role assignments for the managed identities (AcrPull, Reader, Contributor for the updater). |
| azureRbac | Owner or User Access Administrator at the tenant root management group | tenant root management group (optional) | Only for the engine's Reader at the tenant root, so it can see every subscription. Without it the step warns and prints the command for the person who has it (Grant-PimEnginePermissions.ps1). |
| entraRole | Privileged Role Administrator | tenant | Grants the Microsoft Graph application permissions to the engine and Manager identities and adds members to the role-assignable SQL admin group. Global Administrator also works. |
| entraRole | Application Administrator | tenant | Creates the engine app registration and the Manager's sign-in app registration and consents the sign-in scopes. Cloud Application Administrator works for the registrations, not for the consent of Graph application permissions. |
| entraRole | Groups Administrator | tenant | Creates the SQL admin group and the Manager's members-only sign-in group. |
| exchange | Exchange Administrator | Exchange Online (optional) | Only for the mail sender step (shared mailbox + scoped send right). Without it the step is skipped with a warning and the command for the right person. |
| other | Signed in as yourself (browser sign-in or the Invardia Support app session; no Azure CLI), or a certificate deploy identity | the target tenant + subscription | Every call is pinned to -TenantId / -SubscriptionId; a signed-in run (-UseSignedInAccount) refuses a service principal, another tenant and another subscription. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Invardia | create | enrollment of this tenant (only with -EnrollmentKey) | Links the installation to your Invardia account: Invardia creates the environment, signs the licence and issues an install key. | Ask Invardia support to remove the environment. | ||
| Entra ID | create | deploy identity app registration with a certificate (only when no -AdminAppId and not -UseSignedInAccount; New-PimDeployIdentity.ps1) | A one-shot deploy needs an identity that can create the hosting resources unattended. | Delete the app registration 'pim-deploy' and its certificate (Cert:\CurrentUser\My, subject CN=pim-deploy-<tenant>). | ||
| Azure RBAC | grant | deploy identity | Owner (Network Contributor on the hub virtual network when a hub is named) | the target subscription (the hub virtual network) | It builds the resource group and assigns roles inside it; peering needs rights on the hub. | Remove the role assignments of the deploy identity. |
| Microsoft Graph | grant | deploy identity (only with New-PimDeployIdentity -GrantGraph) | Application.ReadWrite.All, Group.Create, GroupMember.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All (application) | tenant | Lets an unattended deploy identity create the sign-in app, converge the SQL admin group and consent the sign-in scopes. | Remove the app role assignments from the deploy identity's service principal (Enterprise applications > Permissions). |
| Entra ID | create | engine app registration + service principal with a certificate credential (step appreg; not with -SkipAppReg) | The identity the engine uses outside the containers (and the managing tenant cross-tenant). | Delete the app registration; remove the certificate CN=PIM4EntraPS-Engine from the machine store. | ||
| Exchange Online | grant | engine app service principal (Install-PimEngineAppRegistration -IncludeExchange only; this deploy does NOT pass it) | Exchange.ManageAsApp (application) + Exchange Administrator activated time-bound through PIM | tenant | Only for an engine that manages Exchange; documented because the installer the step runs can do it. | Remove the app role assignment; the PIM activation expires by itself. |
| Microsoft Graph | grant | engine app service principal and the tick job's managed identity (the engine set) | Directory.Read.All, User.ReadWrite.All, Group.ReadWrite.All, RoleEligibilitySchedule.ReadWrite.Directory, RoleEligibilitySchedule.Remove.Directory, RoleAssignmentSchedule.ReadWrite.Directory, RoleAssignmentSchedule.Remove.Directory, RoleManagement.Read.All, RoleManagement.ReadWrite.Directory, RoleManagementPolicy.Read.Directory, RoleManagementPolicy.ReadWrite.Directory, RoleManagementPolicy.Read.AzureADGroup, RoleManagementPolicy.ReadWrite.AzureADGroup, PrivilegedAccess.ReadWrite.AzureADGroup, PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup, PrivilegedEligibilitySchedule.Remove.AzureADGroup, PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup, PrivilegedAssignmentSchedule.Remove.AzureADGroup, AppRoleAssignment.ReadWrite.All, Application.Read.All, RoleManagement.ReadWrite.Defender, DeviceManagementRBAC.ReadWrite.All, AccessReview.Read.All, AccessReview.ReadWrite.All, AdministrativeUnit.ReadWrite.All, UserAuthenticationMethod.ReadWrite.All, Domain.Read.All, Policy.Read.All (application permissions, admin consent) | tenant | What the engine needs to apply the access you define: role and group assignments (eligible and active), role-assignable groups, administrative units, Temporary Access Passes, Defender and Intune roles, access reviews. Mail.Send is never granted tenant-wide. | Remove the app role assignments (Enterprise applications > the identity > Permissions), or delete the identity. |
| Microsoft Graph | grant | the Manager's managed identity (the picker set) | User.ReadBasic.All, GroupMember.Read.All (application) | tenant | The web app reads only for the people and group pickers; the engine reads everything else and applies every change. | Remove the app role assignments of the Manager identity. |
| Azure | create | resource group, virtual network + subnet (delegated to Container Apps), container registry, Log Analytics workspace, user-assigned pull identity, Azure SQL server + database (step prereq; New-PimHostingPrerequisites.ps1) | Everything PIM Manager runs on, in your own subscription. | Delete the resource group (this deletes the database: export it first). | ||
| Azure RBAC | grant | the pull identity, the containers and the jobs | AcrPull | the container registry | The containers pull their image without registry passwords. | Remove the AcrPull role assignments on the registry. |
| Entra ID | create | group grp-pim-sql-admins (role-assignable) as the SQL server's Entra admin, with the environment identities and the Invardia Support app (when named) as members | One admin group for the store; role-assignable so a Groups Administrator or User Administrator cannot add themselves to it. | Set another Entra admin on the SQL server, then delete the group. | ||
| Entra ID | grant | the person running a signed-in deploy | member of grp-pim-sql-admins | the SQL admin group | The store steps connect to SQL as that person; Azure SQL is Entra-only. | Remove the person from the group. |
| Azure SQL | create | firewall rule AllowSetupHost for this machine's public IP (read from api.ipify.org unless -SetupHostIp) | The schema, settings and access steps connect from this machine. | Removed by the run at its end; otherwise: az sql server firewall-rule delete -n AllowSetupHost. | ||
| Azure | create | container image pim-manager:<version> built in your registry (step image; az acr build from the package's source) | The image is built from the code you downloaded, in your own registry. | Delete the repository in the registry. | ||
| Azure | create | Container Apps environment, the Manager app ca-pim-manager, the tick job ca-pim-tick, the bootstrap job ca-pim-dbinit, their system / user-assigned managed identities (step infra; Setup-PimContainers.ps1) | The runtime: the Manager (GUI) and the engine, on a schedule. | Delete the apps, the jobs and the environment (or the resource group). | ||
| Azure RBAC | grant | the tick job's managed identity (the Manager gets Reader only) | Reader (the -AzureRbacRoles list) | the subscription, or -AzureRbacManagementGroupId | So the engine can see the Azure resources whose roles you manage. | Remove the role assignment. |
| Azure RBAC | grant | the Manager's managed identity (step infra; Setup-PimContainers.ps1; verified and repaired by the end-of-install check) | Reader | the PIM resource group only | The Environment report reads the installation's own architecture (apps, jobs, registry, SQL, Key Vault, network). | Remove the role assignment (the Environment report then shows the architecture as not readable). |
| Azure RBAC | grant | the tick job's managed identity | Reader (+ User Access Administrator only with -EngineAzureRootUserAccessAdmin) | tenant root management group | Discovery across every subscription; User Access Administrator only when the engine must assign the Azure roles you delegate. | Remove the role assignment at the tenant root management group. |
| Azure SQL | grant | database users (CREATE USER from each identity's application id) for ca-pim-manager, ca-pim-tick, the updater and the support user | one least-privilege role per component (ALTER ROLE ... ADD MEMBER): pim_web, pim_engine, pim_updater + db_ddladmin; the declared support user keeps db_datareader, db_datawriter, db_ddladmin | the PIM database | Each container reads and writes only what its job needs; only the updater applies the schema. | DROP USER [<name>] in the database. |
| Azure SQL | create | the least-privilege access model: a signed access procedure (pim.usp_ApplyAccess) with an in-database certificate (expires 2099, private key removed) and the component roles; skipped on an existing install that the security cut-over has not reached | the updater may only EXECUTE the procedure | the PIM database | Every later update applies its grants through the procedure alone -- nothing routine needs a SQL administrator again. | none needed (it holds no secret and grants only the component roles). |
| Microsoft Entra ID | remove | the deploy identity's membership of the SQL admin group (at the end of the run; not with -KeepSetupIdentityInSqlAdminGroup) | group membership | the SQL admin group | A setup identity is a SQL administrator only for the length of an install; it is made a member again by the next run. | a Privileged Role Administrator adds the member again. |
| Azure | update | subnet service endpoint Microsoft.Sql + a virtual network rule on the SQL server (step sqlaccess; Set-PimSqlNetworkAccess.ps1) | The containers reach SQL from their own subnet. | Remove the virtual network rule and the service endpoint. | ||
| Azure SQL | update | the PIM schema (step schema; idempotent, never destructive) | Tables and columns the version needs. | Restore the database from its point-in-time backup. | ||
| Exchange Online | create | shared sender mailbox, an Exchange service principal per sending identity (New-ServicePrincipal), a management scope for that one mailbox (New-ManagementScope), the scoped role assignment 'Application Mail.Send' (New-ManagementRoleAssignment), a shared mailbox (New-Mailbox) when absent (step mailsender; Initialize-PimMailSender.ps1) | Notification mail is sent by the solution's own identities, from one mailbox only. | Remove-ManagementRoleAssignment, Remove-ManagementScope, then remove the mailbox. | ||
| Exchange Online | grant | the Manager and tick identities | Application Mail.Send (Exchange RBAC) | the sender mailbox only (management scope) | They can send only as that mailbox; a tenant-wide Mail.Send found on them is revoked. | Remove-ManagementRoleAssignment for the identity. |
| Microsoft Graph | remove | a tenant-wide Mail.Send application permission on the sending identities, if one exists | A tenant-wide Mail.Send would bypass the mailbox scope. | Grant it again (not recommended). | ||
| Azure SQL | update | pim.Settings feature gates scheduler.jobs, alerting.email, msp.downlink ON (step features) | A deployed engine with its gates off does nothing. | Turn the gates off in Settings or with Set-PimFeatureBaseline.ps1. | ||
| Entra ID | create | the Manager's sign-in app registration ('PIM4EntraPS Manager'), its client secret (stored only as a secret of the container app), and a members-only dynamic group when every member account may sign in (step easyauth; Set-PimManagerEasyAuth.ps1) | Sign-in in front of the Manager; nobody reaches it without an Entra sign-in. | Remove Easy Auth from the container app and delete the app registration and the group. | ||
| Microsoft Graph | grant | the Manager's sign-in app | openid, profile, email, User.Read (delegated, admin consent via oauth2PermissionGrants) | tenant (all users) | So people can sign in without a consent prompt. | Remove the consent (Enterprise applications > the app > Permissions). |
| Entra ID | grant | the people / groups in -EasyAuthAllowedPrincipals (or the members-only group) | app role assignment on the sign-in app (appRoleAssignedTo), assignment required | the Manager's sign-in app | Only the named people may sign in. | Remove the assignments, or set assignment required off. |
| Azure | update | the Manager app and the jobs rolled to the new image (step code) | The new version runs. | Roll back to the previous revision (the deploy does this itself when verify fails). | ||
| Azure | create | nightly updater job ca-pim-update with its managed identity (step updater; Deploy-PimUpdateJob.ps1) | The installation keeps itself up to date on its ring. | Delete the job (Enable-PimSelfUpdate / -SkipUpdater on a re-run). | ||
| Azure RBAC | grant | the updater job's managed identity | Contributor (+ AcrPull on the registry, Contributor on the registry when it lives in another resource group) | the PIM resource group (and the registry) | It rolls the container apps and builds the image of an approved version. | Remove the role assignments; delete the job. |
| Entra ID | grant | the updater job's managed identity | member of grp-pim-sql-admins | the SQL admin group | It applies the schema of the version it rolls to. | Remove it from the group. |
| Microsoft Graph | grant | the updater job's managed identity (step updater; Deploy-PimUpdateJob.ps1) | PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup, PrivilegedAssignmentSchedule.Read.AzureADGroup, RoleManagementPolicy.Read.AzureADGroup, GroupMember.Read.All, Application.Read.All (application; the last two read only) | tenant; used on the SQL admin group only | The updater keeps the database job's own identity an active member of the SQL admin group through PIM for Groups (permanent where the group policy allows), reads it back before the database job starts and renews a time-limited membership before it ends (owner decision 2026-11-05). | Remove the app role assignments from the updater's managed identity (Enterprise applications > Managed identities > the identity > Permissions). |
| Entra ID | grant | the database job's identity (before its first start; Setup-PimContainers.ps1) | active member of grp-pim-sql-admins (a direct add, else an active PIM-for-Groups member assignment, permanent first; read back before the job starts) | the SQL admin group | The in-network database job creates the database users and applies the schema as a member of the SQL admin group; it is not started unless the membership is read back. | Remove the membership (Groups > grp-pim-sql-admins > Members, or Privileged Identity Management > Groups > Assignments). |
| Azure | create | the as-built job caj-pim-asbuilt (manual trigger) with its managed identity, the PIM storage account (no shared key, no anonymous access), its private container 'asbuilt' and the lifecycle rule that deletes the PDFs after 1 day (step updater; Deploy-PimAsBuiltJob.ps1, best effort) | The as-built PDF can be produced inside the environment on request (PIM REQUIREMENTS 100.61). | Delete the job, the container (or the storage account) and the lifecycle rule. | ||
| Azure RBAC | grant | the as-built job's managed identity | Storage Blob Data Contributor (+ AcrPull on the registry when there is no registry identity to inherit) | the container 'asbuilt' only (and the registry) | It writes the as-built PDF. | Remove the role assignment; delete the job. |
| Azure RBAC | create | the custom role 'PIM Manager as-built runner (<resource group>)': Microsoft.App/jobs/start/action + Microsoft.App/jobs/executions/read, assignable in the PIM resource group (nobody is assigned here) | Grant-PimSupportAccess.ps1 assigns it to the Invardia Support app on the as-built job only, with the customer's consent. | Delete the role definition (after its assignments). | ||
| Azure SQL | grant | the view pim.vw_AsBuiltSettings and a contained user for the as-built job (from its app id as a SID); pim.Settings AsBuiltInstallFacts (region, network, resource group) | SELECT on pim.vw_AsBuiltSettings only (people and secrets reduced to counts in SQL) | the PIM database | The job reads only what the as-built document needs. | DROP USER [caj-pim-asbuilt]; DROP VIEW pim.vw_AsBuiltSettings. |
| Azure SQL | update | pim.Settings ManagerAccess: the -ManagerSuperAdmins as SuperAdmin (step access; Set-PimManagerAccess.ps1) | A new environment needs someone who can administer it. | Change the access in Settings > Access. | ||
| Azure SQL | update | pim.Settings Alerting recipients when empty (step alerting; Set-PimAlertRecipients.ps1) | Someone receives the alerts from day one. | Edit them in Settings. | ||
| Azure SQL | update | pim.Settings License + InvardiaInstallKey (step licence, only with an enrollment; Set-PimLicense.ps1) | Registers the licence the enrollment returned. | Remove the licence in Settings > Licence. | ||
| Local machine | create | the deploy profile (parameters of a successful -Apply, never a secret) for Update-PimCommunity.ps1, in your profile folder | So a later update can re-run exactly this deploy. | Delete the profile file printed at the end. |
What it only reads
- Plan-only facts: the app registration, resource group, registry, pull identity and its AcrPull, SQL server and its Entra admin, Container Apps environment, apps, jobs, their Graph app role assignments (application permission reads), Azure role assignments, peering state, image tags.
- The signed-in account (az account show) and its token, checked for tenant and user-ness; directory role checks name Global Administrator, Privileged Role Administrator, Application Administrator, Cloud Application Administrator, Groups Administrator, User Administrator, Exchange Administrator only to report what is missing.
- The deployed database columns (schema drift detect) and the running image's content hash.
- Database role memberships it checks against (db_owner, db_securityadmin, db_accessadmin, db_backupoperator, db_denydatareader, db_denydatawriter are never granted by the deploy).
- Exchange (read): Get-Mailbox, Get-ManagementScope, Get-ManagementRoleAssignment, Get-ServicePrincipal; Organization.Read.All for the mail check; User.Read.All (delegated, the signed-in administrator) to find the sender mailbox.
- SQL GRANT SELECT / GRANT INSERT, UPDATE on single tables for special-purpose users (the publish and support readers) are only made by the managing-tenant build steps, not by this deploy.
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Source | no | sync-automateit | sync-automateit = hosted (Container Apps + Azure SQL); git-pull = a VM / local install. |
| -Scenario | no | Deployment scenario (S1 single, S2, S3 managing tenant, S5/S6 managed tenant); decides the topology. | |
| -Descriptor | no | Path of an environment deployment descriptor (AutomateIT framework only). | |
| -Apply | no | false | Run the plan. Without it (or with -WhatIf) only the plan is printed. |
| -ValidateOnly | no | false | Run only the verification (hosted smoke + deploy-validation tests) against a deployed environment. |
| -TenantId | yes | Your tenant id. | |
| -SubscriptionId | yes | The subscription to deploy into. | |
| -ResourceGroup | yes | The resource group for PIM Manager. | |
| -VnetName | no | vnet-pim-<token> | The virtual network (derived from -PrereqToken when empty). |
| -VnetResourceGroup | no | the -ResourceGroup | Resource group of the virtual network. |
| -AcrName | yes | The container registry name. | |
| -WorkerMode | no | cron | cron (one scheduled engine job, the approved shape) or always-on worker apps. |
| -ManagerMinReplicas | no | 0 | Minimum Manager replicas (0 = scale to zero). |
| -TickCron | no | */5 * * * * | Schedule of the engine job (UTC). |
| -TickJobName | no | ca-pim-tick | Name of the engine job. |
| -TenantObjectCounts | no | counted by the install (Microsoft Graph $count) | @{ Users; Groups; ServicePrincipals } already counted by the caller; the engine job is sized for that count instead of counting again. |
| -MailSender | no | Address of the shared sender mailbox. | |
| -EnvName | no | cae-pim | Container Apps environment name. |
| -Location | no | westeurope | Azure region. |
| -ImageRepo | no | pim-manager | Image repository in the registry. |
| -Apps | no | discovered | The container apps to roll (empty = discover). |
| -ManagerApp | no | ca-pim-manager | Name of the Manager app. |
| -NewInstallNames | no | off (also $env:PIM_Setup_NewInstallNames) | A NEW install takes the new resource names (ca-pim-web, ca-pim-engine, caj-pim-updater) and "PIM Manager" display names. Azure cannot rename: a resource group that already runs PIM Manager keeps its names. Only names you did not pass change. |
| -ImageTag | no | the package VERSION | Image tag to build and deploy. |
| -AcceptBaselineChange | no | false | Accept an image that changes the policy baseline, for this one run. The code step refuses such an image and names this switch; give it when the change is intended. |
| -SqlServerFqdn | no | The Azure SQL server (<name>.database.windows.net). | |
| -SqlDatabase | no | PimPlatform | The database. |
| -SqlConnectionString | no | Connection string used to detect schema drift. | |
| -SqlAdminClientId | no | Certificate mode: the SQL Entra admin application. | |
| -SqlAdminClientSecret | no | Legacy: a client secret for the SQL admin application (use the certificate or the signed-in account). | |
| -SqlAdminCertThumbprint | no | Certificate mode: the SQL admin application's certificate thumbprint. | |
| -SupportDbAppId | no | $env:PIM_SUPPORT_DB_APPID | Application id that gets a support database user. |
| -SupportDbUserName | no | PIM4EntraPS-Deploy | Name of that database user. |
| -AdminAppId | no | Certificate mode: the deploy identity's application id (created when absent). | |
| -AdminSecret | no | Legacy: a client secret for the deploy identity (use the certificate or the signed-in account). | |
| -AdminCertPem | no | Certificate mode: PEM file of the deploy identity for az. | |
| -PrereqToken | no | Short environment token the prerequisite names are derived from. | |
| -PrereqIndex | no | -1 | Address-plan index (<base>.<index*8>.0/21) when no explicit prefixes are given. |
| -PrereqAddressBase | no | 10.220 | Address base for -PrereqIndex. |
| -PrereqSubnetName | no | Subnet name for the containers. | |
| -PrereqVnetAddressPrefix | no | Your own virtual network range. | |
| -PrereqSubnetAddressPrefix | no | Your own subnet range. | |
| -PrereqIdentityName | no | id-pim-<token> | Name of the registry pull identity. |
| -PrereqSkipSql | no | false | Do not create a SQL server (central store). |
| -SqlConnectionPolicy | no | Default | SQL connection policy (Proxy for a firewalled network). |
| -AcrSku | no | Basic (external) / Premium (internal) | Registry SKU. |
| -AcrPublicAccess | no | Default | Registry public network access. |
| -PrivateEndpointSubnetName | no | pim-endpoints | Subnet for private endpoints. |
| -PrivateEndpointSubnetAddressPrefix | no | Range of that subnet. | |
| -AcrAgentPoolName | no | Registry agent pool (a private registry). | |
| -SqlPrivateEndpoint | no | on for -Exposure internal | Give SQL a private endpoint. |
| -SkipHostedSmoke | no | false | Do not run the post-deploy GUI check (only when it cannot reach the Manager). |
| -FeatureGates | no | scheduler.jobs, alerting.email, msp.downlink | Feature gates turned on. |
| -FeatureGatesDisable | no | none | Feature gates turned off. |
| -NotHosted | no | false | A VM install (no Container Apps). |
| -RegistryIdentityResourceId | no | The registry pull identity's resource id. | |
| -LogAnalyticsWorkspaceName | no | Existing Log Analytics workspace to use. | |
| -LogAnalyticsResourceGroup | no | Its resource group. | |
| -Exposure | no | external | external or internal (VNet-internal) Container Apps environment. |
| -BaselineTrustedKeys | no | none | Managed tenant: the managing tenant's signing key ids the Manager pins. |
| -BaselineDocUrl | no | Managed tenant: where the managing tenant publishes the signed bundle. | |
| -HubVnetName | no | Your hub virtual network (for peering and DNS). | |
| -HubVnetResourceGroup | no | Its resource group. | |
| -HubVnetSubscriptionId | no | the -SubscriptionId | Its subscription. |
| -PrivateDnsResourceGroup | no | Resource group for the private DNS zone. | |
| -SkipPrivateDns | no | false | Do not create the private DNS zone. |
| -SkipPeering | no | false | Do not create the peering (you make it yourself). |
| -PrivateDnsZonesResourceGroupId | no | Your central privatelink zones (a resource group id, any subscription): used by the private endpoints, never created or written -- no zone and no link is made there. | |
| -SkipZoneLinkToHub | no | false | Link the Container Apps environment's private zone to the PIM network only, not to the hub (the guided install's -LinkZonesToHub off). |
| -SqlPublicAccessDisabled | no | false | With the SQL private endpoint: the SQL server is created with public network access disabled and no firewall rule is written (a private install stays private). |
| -LinkZonesToHub | no | false | Also link the installation's own privatelink zones to the hub (never your central zones). |
| -PeeringAllOrNothing | no | false | Check the peering rights on both VNets before any write, and never leave half a peering (a failed second side removes the first). |
| -InternalRanges | no | [] | With -FirewallIp (both or neither): your internal ranges. The prerequisites step gives the apps subnet a return route for each (route table rt-pim, next hop VirtualAppliance -> -FirewallIp, BGP route propagation off), read back. |
| -FirewallIp | no | With -InternalRanges: the hub firewall's private IP, the return route's next hop. | |
| -ReturnRouteHandOffOnly | no | false | The VNet is your own: the return route is not written to it, it is printed as a network hand-off line instead. |
| -SkipSqlNetworkAccess | no | false | Do not grant the subnet access to SQL (private endpoint stores). |
| -SqlSubscriptionId | no | Subscription of a central SQL server. | |
| -DnsServer | no | Your DNS server for the environment. | |
| -AzureRbacRoles | no | Reader | Azure roles for the engine identity. |
| -AzureRbacManagementGroupId | no | Management group scope for those roles (else the subscription). | |
| -SkipAzureRbac | no | false | Grant no Azure roles to the engine identity. |
| -RequireAzureRbac | no | false | Fail when the Azure roles cannot be granted. |
| -EngineAzureRootUserAccessAdmin | no | false | Also User Access Administrator at the tenant root for the engine (opt-in). |
| -SkipEngineAzureRootAccess | no | false | No Reader at the tenant root. |
| -ManagerSuperAdmins | no | $env:PIM_MANAGER_SUPERADMINS | Sign-in names that become SuperAdmin (comma-separated). |
| -EngineClientId | no | Engine application id (certificate mode / deploy validation). | |
| -EngineCertThumbprint | no | Engine certificate thumbprint. | |
| -EngineClientSecret | no | Legacy: an engine client secret (use the certificate). | |
| -LogAnalyticsWorkspaceId | no | $env:PIM_HOSTED_LA_WORKSPACE | Workspace the GUI check reads the boot log from. |
| -EasyAuthAudience | no | $env:PIM_HOSTED_EASYAUTH_AUD | Sign-in audience for the GUI check. |
| -EasyAuthClientId | no | Use an existing app registration for sign-in. | |
| -EasyAuthAllowedPrincipals | no | none | People / groups that may sign in (recommended). |
| -EasyAuthAllowAllTenantUsers | no | false | Every member account may sign in (no guests). |
| -KeepSetupHostRule | no | false | Keep the AllowSetupHost firewall rule (a caller that closes it later). |
| -KeepSetupIdentityInSqlAdminGroup | no | false | Keep the identity this run used for SQL in the SQL admin group at the end (a caller that still needs SQL afterwards and releases it itself). Without it, that identity leaves the group again at the end of the run and is made a member again by the next run. |
| -SetupHostIp | no | read from api.ipify.org | This machine's public IP. |
| -UpdateJobName | no | ca-pim-update | Name of the updater job. |
| -UpdateCron | no | 0 3 * * * | Updater schedule (UTC). |
| -UpdateSourceUrlTemplate | no | $env:PIM_UPDATE_SOURCE_URL | Where the updater fetches source ({version} template). |
| -UpdateRing | no | 2 | The update ring the updater follows. |
| -UpdateSource | no | unchanged | pim-src, Invardia (Pro: the signed licence feed) or InvardiaCommunity (Community: the signed Community channel). Empty: a Community install (S2) gets InvardiaCommunity, ring 3. |
| -OverrideRingGate | no | false | Roll a version the ring does not approve (audited; needs -Reason). |
| -Reason | no | Why the ring gate is overridden. | |
| -SkipUpdater | no | false | Install no updater. |
| -SkipMailSender | no | false | Create no sender mailbox and use no Exchange role. Your Exchange administrator sets up the mail sender afterwards (Get Started > Mail sender). |
| -DeployMarker | no | PIMCOREENGINE- | Marker for the deploy-validation test objects. |
| -EngineAppDisplayName | no | PIM4EntraPS Engine | Display name of the engine app registration. |
| -SkipVerify | no | false | Skip the verification (not recommended). |
| -SkipAppReg | no | false | The engine app registration exists already (created out of band). |
| -DbInitJobName | no | ca-pim-dbinit | Name of the bootstrap job (private SQL). |
| -SqlAdminGroupName | no | grp-pim-sql-admins | The SQL admin group. |
| -SupportAppId | no | The Invardia Support app's application id (added to the SQL admin group). | |
| -UseSignedInAccount | no | false | Deploy as the person signed in to az (no deploy identity, no certificate). |
| -EnvLabel | no | Label for a second environment in the same tenant. | |
| -OnStep | no | Callback per step event (used by the guided install). | |
| -AlertRecipients | no | the SuperAdmins' mailboxes | Alert recipients when none are stored. |
| -SkipInstallVerify | no | false | Skip the end-of-install check (a caller that runs its own). |
| -RunDevGates | no | false | Developer gates only: run the hosted smoke and the deploy-validation tests from the tests folder (needs the Azure CLI and Pester). Off for every customer install, which runs the built-in check instead. |
| -LicenceExpected | no | false | The licence line of the end-of-install check is required. |
| -InvardiaInstallToken | no | $env:INVARDIA_INSTALL_TOKEN | Tracked install: report each step to Invardia. |
| -InvardiaInstallEventsUrl | no | https://invardia.com/api/install/events | Where tracked steps are reported. |
| -EnrollmentKey | no | Invardia enrollment key (never printed or saved). | |
| -InvardiaBaseUrl | no | https://invardia.com | Invardia address for the enrollment. |
| -EnrollmentTimeoutSeconds | no | 900 | How long to wait for the signed licence. |
Preview with -WhatIf
Prints the ordered plan (every step: run, current, not applicable) and, under it, each change a step marked to run would make (object, permission, scope) -- for example '[infra] Microsoft Graph application permissions -> ca-pim-tick identity (the engine set) @ tenant'. Plan-only reads only; -WhatIf wins over -Apply: no Invardia claim, no deploy identity, no firewall window, no step runs.
Undo
Delete the resource group (export the database first), the Entra objects it created (engine app registration, the Manager's sign-in app, grp-pim-sql-admins, the members group), the role assignments at the tenant root management group, and the Exchange management role assignment, scope and mailbox. See each change's undo.
Network
It connects to: management.azure.com, graph.microsoft.com, login.microsoftonline.com, <server>.database.windows.net (TCP 1433), <registry>.azurecr.io, outlook.office365.com (Exchange Online admin API, mail sender step), api.ipify.org (this machine's public IP, unless -SetupHostIp), invardia.com (only with -EnrollmentKey or a tracked install), the Azure CLI extension index (azcliextensionsync.blob.core.windows.net): az installs its 'containerapp' extension once when it is missing (extension.use_dynamic_install, set by the prerequisite / container / image steps) -- az's own download, checked against the index's sha256, the update source URL (-UpdateSourceUrlTemplate), fetched by the updater job in Azure -- not by this script
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager