Set-PimBreakGlassAccounts
Set the break-glass accounts (operator route)
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Replaces the list of break-glass (emergency) accounts that PIM Manager never disables, revokes or offboards, writing it straight to the environment's store with a justification; for when the normal two-person route in PIM Manager cannot be used.
When to run it
Only when the Manager's own route (one SuperAdmin requests, a second approves) cannot work: an environment with a single SuperAdmin, or a Manager that is down while an emergency account must be protected now. PIM Manager points the only SuperAdmin to this script.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | Member of the environment's SQL admin group (grp-pim-sql-admins), signed in through the browser or the Invardia Support app session (no Azure CLI) | the environment's SQL database | The list lives in pim.Settings and every write is audited; only the SQL admin group may write it. With -UseSignedInAccount the signed-in az user is used. Alternatively the admin application's certificate (-AdminAppId + -AdminCertThumbprint), or a ready -ConnectionString to a local SQL Server. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Environment SQL database | update | pim.Settings row 'BreakGlassAccounts' (the complete list of UPNs / object ids) | this environment: PIM Manager and its engine | Accounts on the list are exempt from every disable, revoke and offboard PIM does. Written compare-and-set against the list just read, then read back. | Run the script again with the previous list (it is printed as 'stored now' at the start of every run). | |
| Environment SQL database | create | pim.AuditEvents event 'breakglass.accounts.set' (actor, ActorSource 'setup', justification, added and removed accounts) | this environment's audit trail | Every change to the emergency list is audited with who and why. | None -- the audit trail is append-only by design. | |
| Local file (only with -OutFile) | create | the result file named by -OutFile | this computer | For a caller that reads the outcome. | Delete the file. |
What it only reads
- pim.Settings 'BreakGlassAccounts' (the stored list and its snapshot hash; a store that cannot be read is not written)
- the PIM Manager's open break-glass change request, if any (reported: it will be refused as stale after this write)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Accounts | yes | The COMPLETE new list (UPNs and/or object ids). It replaces the stored list. | |
| -Justification | yes | Why -- recorded on the audit event. | |
| -ConfirmEmpty | no | false | Required to store an EMPTY list (it removes the protection from every emergency account). |
| -ConnectionString | no | A ready connection string to the store (e.g. a local SQL Server with Integrated security) instead of -SqlServer. | |
| -SqlServer | no | The store's server (alias -SqlServerFqdn). An Azure SQL FQDN connects with a token. | |
| -Database | no | PimPlatform | The database (alias -SqlDatabase). |
| -TenantId | no | The tenant id; required for an Azure SQL store. | |
| -UseSignedInAccount | no | false | Reach the store as the signed-in az user (a member of the SQL admin group). The recommended way. |
| -AdminAppId | no | Automation: the admin application's client id (with -AdminCertThumbprint). | |
| -AdminCertThumbprint | no | Automation: the thumbprint of the admin application's certificate in the local machine store. | |
| -OutFile | no | Write the outcome as JSON to this file. |
Preview with -WhatIf
Validates the entries, reads the stored list, prints what would be added and removed, 'What if: Performing the operation "replace the break-glass account list with: <accounts> (audited as 'breakglass.accounts.set')" on target "pim.Settings['BreakGlassAccounts'] in <server>/<database>"' and 'What if: would store N account(s) ...'. Nothing is written and no audit event is recorded.
Undo
Run the script again with the list it printed as 'stored now' and a justification. The audit events stay.
Network
It connects to: login.microsoftonline.com (sign-in / token for Azure SQL), <server>.database.windows.net:1433 (or the SQL Server in -ConnectionString)
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager