Set-PimManagerAccess
Set who may use PIM Manager
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Sets who may use PIM Manager and at what level (Reader, Admin, SuperAdmin or Delegated) by writing the ManagerAccess setting in the environment's store: it merges with what is stored, refuses a model with no SuperAdmin, and reads the result back.
When to run it
To give the first SuperAdmin access to a new environment, or to add, change or (with -Replace) remove Manager users when the Manager itself cannot be used for it. PIM Manager names this script when nobody has access yet.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | Member of the environment's SQL admin group (grp-pim-sql-admins), signed in through the browser or the Invardia Support app session (no Azure CLI) | the environment's SQL database | The access model lives in pim.Settings; only the SQL admin group may write it. With -UseSignedInAccount the signed-in az user is used (asserted to be a user in -TenantId). Alternatively the admin application's certificate (-AdminAppId + -AdminCertThumbprint). |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Environment SQL database | update | pim.Settings row 'ManagerAccess' (the list of identity = role entries: Reader, Admin, SuperAdmin, Delegated) | this environment's PIM Manager | Decides who may use PIM Manager and at what level. Merged with what is stored, keyed on identity; -Replace drops entries that are not in the input. A model with no SuperAdmin is refused unless -AllowNoSuperAdmin. | Run the script again with the previous entries (and -Replace to drop what was added). | |
| Local file (only with -OutFile) | create | the result file named by -OutFile (ok, reason, installed / replaced / removed identities) | this computer | For a caller that runs the script unattended and reads the outcome. | Delete the file. |
What it only reads
- pim.Settings 'ManagerAccess' (the stored model; a read failure stops the script)
- pim.Settings 'License' (only when a NEW Delegated user is added -- scoped Manager users need a Pro licence)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | The environment's tenant id. | |
| -SqlServerFqdn | yes | The environment's SQL server (<name>.database.windows.net). | |
| -SqlDatabase | no | PimPlatform | The environment's database. |
| -UseSignedInAccount | no | false | Reach the store as the signed-in az user (a member of the SQL admin group). The recommended way. |
| -AdminAppId | no | Automation: the admin application's client id (with -AdminCertThumbprint) instead of -UseSignedInAccount. | |
| -AdminCertThumbprint | no | Automation: the thumbprint of the admin application's certificate in the local machine store. | |
| -AdminSecret | no | Legacy automation only: a client secret for -AdminAppId. Not for customer use; prefer -UseSignedInAccount. | |
| -AccessJson | yes | A JSON file path or raw JSON: { "managerAccess": [ { "identity": "<UPN, object id or group>", "role": "Reader|Admin|SuperAdmin|Delegated" } ] }. | |
| -Replace | no | false | Replace the stored list instead of merging; the entries it drops are listed first. |
| -AllowNoSuperAdmin | no | false | Allow a model with no SuperAdmin (only when the container settings still carry one). |
| -OutFile | no | Write the outcome as JSON to this file. |
Preview with -WhatIf
Validates the input, reads the stored model, prints the resulting model (entries, SuperAdmin count, what -Replace would remove) and 'What if: Performing the operation "write N entr(y/ies): <identity>=<role>, ..." on target "pim.Settings['ManagerAccess'] in <server>/<database>"', then stops: nothing is written.
Undo
Run the script again with the previous list and -Replace. The previous list is printed as 'already stored' at the start of every run.
Network
It connects to: login.microsoftonline.com (sign-in / token for Azure SQL), <server>.database.windows.net:1433
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager