Set-PimHybridWorkerPeering
PIM for Active Directory: show, cut or restore the hybrid worker's network reach
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Shows, cuts or restores the hybrid worker's network reach by turning its VNet peerings off and on, without deleting anything.
When to run it
-State Show to check the Azure VM worker's peerings after the build; -State Disconnected to stop the worker acting at once (its AD jobs then fail visibly); -State Connected to restore. Not used for an Azure Arc worker (its network is yours).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Network Contributor | the worker VNet and every VNet it is peered with | updates allowVirtualNetworkAccess on both sides of each peering. -State Show needs only Reader. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| VNet peerings of the worker VNet (both sides) | update | allowVirtualNetworkAccess = false (Disconnected) or true (Connected); the peerings stay | an isolation switch that keeps the topology | run it again with the other -State | ||
| the worker-side peering to the hub (-UseRemoteGateways / -AllowForwardedTraffic) | update | useRemoteGateways = true / allowForwardedTraffic = true; allowGatewayTransit = true on the hub side ONLY when PIM created that peering ('<hub>-to-pimhybridwrk') -- otherwise the hub owner's step is printed and useRemoteGateways stays off | domain controllers reached through the hub's VPN / ExpressRoute gateway | set the flags back on the peerings in the portal, or Remove-PimHybridWorker.ps1 |
What it only reads
- the subscription's tenant
- the peerings of the worker VNet and of each remote VNet
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | The worker's subscription. | |
| -TenantId | yes | The tenant; the script refuses a subscription in another one. | |
| -State | yes | Show, Disconnected or Connected. | |
| -ResourceGroup | no | rg-pimhybridwrk | The worker's resource group. |
| -VnetName | no | vnet-pimhybridwrk | The worker VNet. |
| -UseRemoteGateways | no | false | With -State Connected: the worker-side peering to -GatewayVnetId uses the hub's VPN / ExpressRoute gateway. Checked first: the hub has a gateway; the hub side allows gateway transit (set by PIM only on a hub-side peering PIM created, otherwise printed for the hub owner). |
| -AllowForwardedTraffic | no | false | With -State Connected: the worker-side peering(s) accept traffic the hub forwards (to -GatewayVnetId only when given). |
| -GatewayVnetId | no | The hub VNet with the gateway (required with -UseRemoteGateways). |
Preview with -WhatIf
Prints each peering and the access change it would make; changes nothing. -State Show is read-only by itself.
Undo
Run it again with the other -State; nothing is ever deleted.
Network
It connects to: management.azure.com (ARM REST) and login.microsoftonline.com -- browser sign-in or an Invardia support session; no Azure CLI, no PowerShell module
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager