Remove-PimContainerStack
Remove the Container Apps part of a PIM Manager environment (keep the data)
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Removes the Container Apps part of one PIM Manager environment (every Container Apps job and app and the Container Apps environment in the resource group, plus the Azure role assignments held by their system identities) so the environment can be deployed again with a different exposure. Data is kept: the SQL database, the registry, Key Vault, storage, the VNet, the user-assigned identities and Log Analytics. It only lists what it would remove unless -Apply is given.
When to run it
Before redeploying an environment with the other exposure (for example public to private, the 'remove and redeploy' route), or to remove the Container Apps part while keeping the data. It is part of the PIM Manager release package (it loads the engine's REST libraries next to it): run it from the package folder that Install-Invardia or the guided install downloaded (signed), or, for Community, from the public repository at the release tag. Then run Invoke-PimDeployAll.ps1 with the new exposure.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Owner, or Contributor + User Access Administrator | the PIM resource group (role assignments: the subscription) | Deletes the Container Apps jobs, apps and environment, and the Azure role assignments of their system identities. Signed in through the browser or the Invardia Support app session (no Azure CLI, no modules). |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure (the PIM resource group) | remove | every Microsoft.App/jobs and Microsoft.App/containerApps resource, then the Microsoft.App/managedEnvironments resource (all listed first) | the resource group given | The internal/external setting of a Container Apps environment cannot be changed; the stack is rebuilt by the next deploy. | Run Invoke-PimDeployAll.ps1 with the install's parameters (the saved deploy profile): it recreates the environment, the PIM Manager and the jobs and grants the new identities again. | |
| Azure (the subscription) | remove | the Azure role assignments whose principal is one of those apps' or jobs' system identities | assignments inside the subscription | They would be orphaned once the identities are deleted. | The next deploy grants the new identities their Azure roles again. |
What it only reads
- the resources in the resource group (Microsoft.App/* only are acted on)
- each job's and app's system identity
- the Azure role assignments of those identities
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | The PIM subscription. Every call names it explicitly; a sign-in that cannot see it is refused. | |
| -ResourceGroup | yes | The PIM resource group whose Container Apps stack is removed. | |
| -Apply | no | false | Delete. Without it (and always with -WhatIf) the script only lists the jobs, apps, environment and role assignments it would remove. |
Preview with -WhatIf
Lists every Container Apps job, app and environment in the resource group with its system identity, and the role assignments of those identities, then prints 'PLAN ONLY: <n> job(s), <n> app(s), <n> environment(s), <n> role assignment(s)'. -WhatIf wins over -Apply ('-WhatIf: plan only -- -Apply is ignored'). Nothing is deleted.
Undo
Run Invoke-PimDeployAll.ps1 with the install's parameters: it recreates the Container Apps environment, the PIM Manager and the jobs on the kept SQL database, registry and VNet, and grants the new identities again.
Network
It connects to: login.microsoftonline.com (sign-in), management.azure.com (Azure Resource Manager)
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager