Set-PimSqlPublicAccess
Turn the PIM SQL server's public network access off or on
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Turns the public network access of the PIM Manager's Azure SQL server off (-Disable) or back on (-Enable), over Azure Resource Manager REST. -Disable is refused unless the server has at least one private endpoint connection in the state Approved, because without one the PIM Manager and the engine could no longer reach their database. It reads the server and its private endpoint connections, prints the plan, and changes nothing unless -Apply is given; after the change it reads the server back.
When to run it
Last, when an environment is made private: after the SQL private endpoint exists (New-PimHostingPrerequisites.ps1 -SqlPrivateEndpoint) and the PIM Manager is verified from inside the network (the guide convert-external-to-private.md, Step 7). Convert-PimToPrivate.ps1 -SqlPrivate runs it for you as its last step. Run it with -Enable to roll back. Run it from the PIM Manager release package folder (part of the package, not a standalone download).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | SQL Server Contributor (or Contributor / Owner) | the PIM SQL server (or its resource group) | Reads the server and its private endpoint connections and changes the server's publicNetworkAccess property. |
| other | One REST session: a calling script's session, the Invardia Support app session for -TenantId, or your own browser sign-in | the target tenant + subscription | A session of another tenant than -TenantId is refused. No Azure CLI, no PowerShell modules. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure (the PIM resource group) | update | the SQL server's public network access (properties.publicNetworkAccess = Disabled with -Disable, Enabled with -Enable), read back after the change | the one SQL server named by -ServerName | A private environment reaches its database through the private endpoint only; with public access off the server's firewall and VNet rules no longer apply. | Run the same command with -Enable instead of -Disable (or the reverse). |
What it only reads
- the subscription (visible, and in -TenantId when given)
- the SQL server (its publicNetworkAccess)
- the SQL server's private endpoint connections and their approval state
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | The subscription of the SQL server. | |
| -ResourceGroup | yes | The resource group of the SQL server. | |
| -ServerName | yes | The SQL server name or its FQDN (sql-x or sql-x.database.windows.net). | |
| -Disable | no | false | Turn public network access OFF. Refused unless the server has an Approved private endpoint connection. Give exactly one of -Disable or -Enable. |
| -Enable | no | false | Turn public network access back ON (the rollback). The existing firewall and VNet rules apply again. |
| -TenantId | no | The tenant. Pins the sign-in; a session or subscription of another tenant is refused. | |
| -Apply | no | false | Make the change. Without it (and always with -WhatIf) the script reads the server, prints the plan and changes nothing. |
Preview with -WhatIf
Reads the server and its private endpoint connections and prints the current public network access, the Approved and not-approved private endpoints, and 'PLAN ONLY -- would set public network access ... -> Disabled' (or the refusal when no private endpoint is Approved, or 'already Disabled -- nothing to do'). -WhatIf wins over -Apply; nothing is changed.
Undo
Run the same command with the other switch: -Enable turns public network access back on (the firewall and VNet rules apply again), -Disable turns it off again.
Network
It connects to: login.microsoftonline.com (sign-in), management.azure.com (Azure Resource Manager)
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager