Rename-PimJobs
Rename each PIM Manager job to its standard name
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Renames each PIM Manager job of one install to its standard name caj-pim-<purpose> by creating the new job with the same spec, proving it, switching to it and disabling the old job -- the old job is deleted only with -DeleteOld, after the proof and the switch.
When to run it
Once per install for the naming standard (jobs named caj-pim-<purpose>), after the identity move (every job runs as its own id-pim-<role>). First without -Apply (the plan, read-only, for the approval), then -Apply -Role <role> one role at a time. A role that reports 'waiting' (its old job was running) is finished by running the same command again.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor + User Access Administrator | the PIM resource group | Creates the new job, reads the old job's secrets (listSecrets) to copy them, copies the job-scoped role assignments to the new job, starts the proof run, switches the settings and sets the old job's trigger to Manual. |
| other | The Invardia Support app's audited SQL access (Invoke-InvardiaSupportSql) to the PIM database | pim.Settings of the install | Switches pim.Settings 'SchedulerTickJobId' and 'InstallNames' to the new job. |
| azureRbac | Log Analytics Reader | the Log Analytics workspace of the install's Container Apps environment (only with -SqlViaJob) | Reads the one-time job's result line (its console log) when the database is private and pim.Settings is reached through that job. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure Container Apps | create | the new job caj-pim-<purpose>: the old job's spec (image, command, variables, resources, registries, secrets, identity id-pim-<role>, environment, workload profile, timeouts), trigger Manual until the switch, tagged pim-renamed-from=<old job> | the PIM resource group | Azure cannot rename a job; the standard name needs a new one. | Delete the NEW job only (the command is in the run record); the old job is untouched until the switch. | |
| Azure | grant | each role assignment made on the old job itself (for example the Manager's Container Apps Jobs Operator on the engine job, a job's Reader on itself), given on the new job | the same Azure role for the same principal | the new job | The same rights on the new job before anything switches; nothing is removed from the old job. | Kept: harmless on the new job; no role assignment is ever deleted by this script. |
| Azure Container Apps | update | one run of the new job for the proof | the new job | Proves the new job works before anything switches; a failed proof switches nothing. | Nothing to undo: a normal run. | |
| Azure Container Apps | update | the new job gets the old job's schedule (same cron); every variable of the Manager app and of the other jobs that names the old job (PIM_TickJobId, PIM_TickJobName, PIM_ENGINE_JOB_NAME, PIM_UpdateJobName, PIM_JobId, ...) names the new one | the PIM apps and jobs of the resource group | Everything that starts, reads or records the job uses the new one. | The reverse switch per app / job (the command is in the run record). | |
| The PIM database | update | pim.Settings 'SchedulerTickJobId' (the engine) and 'InstallNames' (the install record) | the PIM database | The Manager and every reader find the job by its new name. | The previous value is in the run record with the command that writes it back. | |
| Azure Container Apps | update | the OLD job's trigger set to Manual (its schedule off); the job, its identity and its rights are kept | the old job | The old job no longer runs. | Set the old job's trigger back to its schedule (the command is in the run record). | |
| Azure Container Apps | remove | ONLY with -DeleteOld, after the proof and the switch read back: the OLD job (its system-assigned identity goes with it); its full spec and job-scoped role assignments are written to the rollback record first, then the delete is read back (404) | the old job | Owner decision 2026-11-09: the renamed install keeps no old job. | Re-create the job from the rollback record (PUT with the recorded spec and trigger, then its role assignments); secret values are re-entered, and a re-created job has a new system identity. | |
| Azure (the install's resource group) | remove | ONLY with -DeleteOld: old id-pim-* user-assigned identities that no container app, job, SQL server or storage account attaches any more and that are not a standard id-pim-<role> (re-checked at delete time; an attached identity is never deleted); each recorded first (name, client id, principal id, role assignments), read back 404 | the PIM resource group | No unused old identity left behind; its role assignments are not deleted. | Re-create the identity from the record (it gets a new principal: grant its recorded roles to it). | |
| Azure Container Apps | create | ONLY with -SqlViaJob (a private database): a one-time job caj-pim-renamesql in the install's own environment, with the identity, image and image-pull identity of the install's database job (caj-pim-dbinit, else ca-pim-dbinit), tagged pim-one-time-job=job-rename-sql; started once per read or write of pim.Settings, then removed and read back gone -- also after a failed step. No identity gets a new right | the PIM resource group | A private database cannot be reached from outside; the job reaches it over the install's own network, as its database job does. | Nothing to undo: the job is removed at the end of each run. A job a killed run left behind carries the tag and is removed by the next run (or delete caj-pim-renamesql in the Azure portal). |
What it only reads
- the container apps and jobs of the resource group (their spec, identity, trigger and variables)
- the role assignments made on each job (atScope)
- the executions of each job (a running one is waited for, never stopped)
- pim.Settings 'SchedulerTickJobId' and 'InstallNames'
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | The subscription of the PIM install. | |
| -ResourceGroup | yes | The resource group of the PIM install. | |
| -Apply | no | false | Rename the role in -Role. Without it the script only plans. |
| -Role | no | The ONE role to rename with -Apply: engine, updater, dbinit, publish, downlink, docs. | |
| -LogDir | no | the temp folder\pim-job-rename | Where the plan, the plan text and the per-role record are written. |
| -DeleteOld | no | false | After the proof and the switch read back, delete the old job and the old id-pim-* identities nothing attaches any more (rollback record first, 404 read back). Without it the old job is disabled and kept. |
| -SqlServer | no | PIM_SqlServer of the Manager app | The install's SQL server (for pim.Settings). |
| -SqlDatabase | no | PIM_SqlDatabase of the Manager app, else PimPlatform | The install's database. |
| -SqlViaJob | no | false | For an install whose database is private: read and write pim.Settings through a one-time job inside the install's network (the database job's identity), created, run once and removed each time; the result is read from its log lines. -WhatIf creates no job. |
Preview with -WhatIf
Without -Apply the script is read-only either way. With -Apply -WhatIf it reads everything, prints the plan and, for the role, one line for each step it would take (create, copy, prove, switch, disable) -- nothing is written.
Undo
Every run writes a record to -LogDir with each change in order and its exact undo command; a failed run prints them newest first. Without -DeleteOld nothing is deleted (the old job is kept, Manual); with it every delete is recorded before it happens. A failed proof leaves the old job untouched.
Network
It connects to: login.microsoftonline.com (token), management.azure.com, <server>.database.windows.net, api.loganalytics.io (only with -SqlViaJob: the one-time job's result lines)
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager