Set-PimHybridWorkerEgress
PIM for Active Directory: NAT gateway egress for the hybrid worker VM (no public IP)
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Puts the hybrid worker VM's outbound traffic behind a NAT gateway and makes sure the VM itself has no public IP address.
When to run it
Run for you by New-PimHybridWorkerInfra.ps1 (-Egress NatGateway). Run it yourself to migrate a worker built with a public IP on its VM, or to verify the egress. Azure VM worker only.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Network Contributor | the worker's resource group | creates the NAT gateway and its public IP, detaches a public IP from the VM's NIC, updates the subnet |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| the worker's resource group | create | NAT gateway natgw-<vm> (Standard) and, when no address can be reused, the Standard static public IP pip-<vm> as its outbound address | outbound only; nothing can connect in | detach it from the subnet, then delete the NAT gateway and its public IP | ||
| the VM's network interface | update | a public IP on it is DETACHED (the address is kept and becomes the NAT gateway's) | the worker is Tier 0: never a public IP of its own | none intended | ||
| the worker subnet | update | natGateway = the NAT gateway; defaultOutboundAccess = false | outbound through the NAT gateway only | remove the NAT gateway from the subnet |
What it only reads
- the subscription's tenant
- the subnet, the VM and its NICs, the NAT gateway and public IP (read-before-write), and at the end a verification that no public IP is left on the VM
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | The worker's subscription. | |
| -TenantId | yes | The tenant; the script refuses a subscription in another one. | |
| -ResourceGroup | no | rg-pimhybridwrk | The worker's resource group. |
| -Location | no | the VNet's region | Region for the NAT gateway and its IP. |
| -VmName | no | PIMHYBRIDWRK | The worker VM. |
| -VnetName | no | vnet-pimhybridwrk | The worker VNet. |
| -SubnetName | no | snet-worker | The worker subnet. |
| -NatGatewayName | no | natgw-<vm> | The NAT gateway name. |
| -PublicIpName | no | pip-<vm> | The NAT gateway's public IP name (when none is reused). |
Preview with -WhatIf
Prints the NAT gateway, the detach and the subnet change it would make; changes nothing (and, before the subnet exists, says so instead of failing).
Undo
Remove the NAT gateway from the subnet, delete the NAT gateway and its public IP. A detached public IP is not re-attached to the VM (by design).
Network
It connects to: management.azure.com (ARM REST) and login.microsoftonline.com -- browser sign-in or an Invardia support session; no Azure CLI, no PowerShell module
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager