Publish-PimActivatorRemediation
PIM Activator: upload the Intune Remediation
Purpose
Builds the PIM Activator Intune Remediation (Detect + Remediate) for your tenant and uploads it to Intune -- creates it, or updates it in place when a Remediation with the same name exists -- and assigns it to the one group you name (nobody otherwise).
When to run it
On Intune-managed devices, after the PIM Activator app registration exists (Deploy-PimActivatorBackend.ps1): PIM Manager > Operations > PIM Activator > Intune remediation shows the command with your settings. Run it again after changing the settings, or to assign the Remediation to a group.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Intune Administrator | tenant | creates / updates a Remediation (device health script) and assigns it. Global Administrator also works. |
| other | Delegated sign-in: DeviceManagementScripts.ReadWrite.All | Microsoft Graph, for the first-party app Microsoft Graph Command Line Tools | the browser sign-in asks for this one delegated permission only; it acts within your Intune role. Automation: -AccessToken with the same permission. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| this computer | create | Detect-PimActivator.ps1 and Remediate-PimActivator.ps1 in -OutDir (default: next to the script), built from the parameters | the pair that is uploaded, kept so you can read exactly what the devices run | delete the two files | ||
| Microsoft Intune | create | Remediation (deviceHealthScript) -Name, default 'PIM Activator settings (PROD)' / '(TEST)': the Detect + Remediate scripts, run as SYSTEM, 64-bit PowerShell, no signature check; updated in place when one with that exact name exists | it writes the PIM Activator browser policies (force-install + tenant catalog + settings) on the devices it is assigned to, every day | Intune admin center > Devices > Scripts and remediations > the Remediation > Delete | ||
| Remediation -Name | grant | assignment to group -AssignToGroupId (user or device group); REPLACES the Remediation's assignments | Remediation assignment: runs on the group's devices daily at -DailyTime, or every -EveryHours hours | only that group -- never all users or all devices; without -AssignToGroupId nothing is assigned | who gets the PIM Activator settings | Intune > the Remediation > Properties > Assignments > remove the group |
What it only reads
- the tenant's Remediations (to find one with the same name)
- the Remediation after the upload (read back: same scripts, SYSTEM, 64-bit) and its assignments
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | organizations | Your tenant id: the sign-in tenant and the tenant written into the extension's catalog (required unless you upload your own pair). |
| -Channel | no | Released | Released (PROD) or Test: which extension the Remediation configures. |
| -ClientId | yes | Application (client) id of the PIM Activator app registration of that channel (required unless you upload your own pair). | |
| -CatalogName | no | PIM | The tenant name the users see in the extension. |
| -DefaultJustification | no | Change in infrastructure | The justification the extension pre-fills. |
| -DefaultDurationHours | no | 8 | The activation length the extension pre-fills (1-24 hours). |
| -Prefix | no | Optional group-name prefix filter. | |
| -EntraPrefix | no | Optional prefix of the groups that carry Entra roles. | |
| -AzurePrefix | no | Optional prefix of the groups that carry Azure roles. | |
| -AutoActivateMaxGroups | no | -1 | Optional per-device cap on auto-activation (0 = off). -1 = not set. |
| -BulkActivateConfirmThreshold | no | -1 | Optional: ask for confirmation above this many groups. -1 = not set. |
| -ActivationEndTime | no | Optional end-of-day time 'HH:MM' (device local time): every activation ends no later than this today. Empty = not set. | |
| -Browsers | no | Edge, Chrome | Which browsers the Remediation configures. |
| -AdditionalTenantsJson | no | Optional: more tenants for the extension's tenant switcher (JSON array of name, tenantId, clientId). | |
| -Name | no | PIM Activator settings (PROD) / (TEST) | The Remediation's name in Intune (an existing one with exactly this name is updated). |
| -DetectScript | no | Override: upload this detection script instead of building it (with -RemediateScript). | |
| -RemediateScript | no | Override: upload this remediation script instead of building it (with -DetectScript). | |
| -OutDir | no | the script's folder | Where the built pair is written. |
| -AccessToken | no | Automation: a Microsoft Graph token with DeviceManagementScripts.ReadWrite.All; skips the browser sign-in. | |
| -Description | no | uploaded by Publish-PimActivatorRemediation.ps1 <date> | The Remediation's description in Intune. |
| -AssignToGroupId | no | Object id of the group that gets the Remediation (replaces its assignments). Not given: nothing is assigned. | |
| -DailyTime | no | 09:00 | With an assignment: the daily run time (device local time). |
| -EveryHours | no | With an assignment: run every N hours (1-23) instead of daily. |
Preview with -WhatIf
Signs in, reads Intune, builds the pair in the temp folder (so you can read it) and prints a 'What if:' line for the Remediation it would create or update (with the scripts' checksums) and the group assignment it would make. Nothing is uploaded, assigned or written next to the script.
Undo
Delete the Remediation in the Intune admin center (Devices > Scripts and remediations). Devices keep the policies it already wrote until you remove them (Deploy-PimActivatorClient.ps1 -Uninstall on a device, or a Remediation that removes them).
Network
It connects to: login.microsoftonline.com, graph.microsoft.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/pim/Publish-PimActivatorRemediation.ps1 -OutFile Publish-PimActivatorRemediation.ps1
.\Publish-PimActivatorRemediation.ps1 -TenantId <TenantId> -ClientId <ClientId>To check the download first, compare its SHA-256 with the published one:
SHA-256 575832f63a8c3011704b0c6362a181d9da2b0b39506eecf10f6fe53b39494207
Checksums: SHA256SUMS.txt · Version 3.0.70
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Publish-PimActivatorRemediation.ps1 -Full · Source: Publish-PimActivatorRemediation.ps1
Every script, identity and permission for your security review: PIM Manager