Start-PimManagerInstall
Install PIM Manager (one command)
Purpose
Install PIM Manager with one command: download the public PIM Manager release into a new folder, check the download, and run its guided installer (Install-PimManager) with the parameters you give.
When to run it
Once, to install PIM Manager into your own Azure subscription with only -TenantId and -SubscriptionId. The file decides the edition: the copy from the public GitHub release installs Community; the copy Invardia gives Pro and trial customers installs Pro with the same command (no licence in the command: the installation asks Invardia for its licence by itself). Download it (line 1), then run it with your values (line 2). Run it with -WhatIf first to see the plan; run the same command with -Resume after fixing a stopped step.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Owner | the target subscription | The installer it runs (Install-PimManager) creates the resource group and its resources and assigns Azure roles to the identities it creates (Contributor + User Access Administrator is the equivalent); its check stops before anything is created without it. |
| entraRole | Privileged Role Administrator | tenant | For the installer: Microsoft Graph application permissions for PIM Manager's identities and the SQL admin group. Without it the installation continues and ends with the command for the right person. |
| entraRole | Application Administrator | tenant | For the installer: the Manager's sign-in app registration (the same as Install-PimManager). |
| exchange | Exchange Administrator (optional) | Exchange Online | For the installer: only for the mail sender (a shared mailbox and its scoped send right). Without it the step is a warning with the command for an Exchange Administrator. |
| other | Signed in in the browser as yourself (no command-line tool, no PowerShell module, no secret, no certificate) | the tenant and subscription you name | The installer signs you in in the browser when it first needs Azure or Microsoft Graph. The Community copy itself reads only public release data and needs no sign-in; the Pro copy signs you in in the browser first (an administrator of -TenantId) to download the PIM Manager Pro package from Invardia for that tenant, and hands that sign-in to the installer. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Local machine | create | a new folder in the temp folder (pim-manager-release-<version>-<random>) with the downloaded release zip and its unpacked files, and a small note (pim-manager-install-<id>.json in the temp folder) with that folder's path so -Resume uses it again | The installer runs from the release it was downloaded with; -Resume needs no new download. | Delete the folder and the note. | ||
| Azure, Microsoft Entra ID, Azure SQL | create | the PIM Manager installation, made by Install-PimManager from the downloaded release (every object, permission and scope is listed on its page: https://invardia.com/docs/pim/scripts/Install-PimManager/) | This launcher only fetches the release and starts the installer with your parameters. | As described for Install-PimManager (delete the resource group after exporting the database, and the Entra objects it created). |
What it only reads
- The public release metadata of the PIM Manager release on GitHub (latest, or -Version) and the release files it names; this file and the release zip are checked against the release before anything runs.
- The Pro copy instead: the PIM Manager Pro package of your update ring for your tenant from Invardia (after your browser sign-in) -- Invardia's sealed manifest and the zip it names; that Invardia issued it, the size and the SHA-256 are checked before anything runs. It never falls back to GitHub.
- The note in the temp folder that names the release folder of a previous run (-Resume).
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | The Microsoft Entra tenant PIM Manager manages (passed to Install-PimManager). | |
| -SubscriptionId | yes | The Azure subscription that hosts PIM Manager (passed to Install-PimManager). | |
| -Location | no | swedencentral | Any Azure region (passed through). |
| -ResourceGroup | no | rg-pim | The resource group (passed through). |
| -SuperAdmins | no | you (the person installing) | The PIM Manager administrators (passed through). |
| -AlertRecipients | no | the administrators' mailboxes | Who gets the alerts (passed through). |
| -MailSender | no | The mailbox PIM Manager sends from (passed through). | |
| -PortalUsers | no | the administrators | Who may sign in to PIM Manager (passed through). |
| -AllowAllMembers | no | false | Every member account of the tenant may sign in; guests never (passed through). |
| -VnetAddressPrefix | no | 10.220.0.0/22 | The virtual network range (passed through). |
| -SubnetAddressPrefix | no | 10.220.0.0/23 | The old name of -AppsSubnetPrefix, kept for one release (passed through). |
| -Exposure | no | external | The old switch of the network shape, kept for one release: internal = -PrivateNetwork (passed through). |
| -PrivateNetwork | no | false | Install the private shape: no public address (passed through; Install-PimManager's help has the details). |
| -VnetId | no | A private install: use this existing virtual network (any resource group of the installation's subscription) instead of making one (passed through). | |
| -VnetName | no | vnet-pim | The name of the virtual network the installation makes (passed through). |
| -AppsSubnetName | no | snet-pim-aca | The Container Apps subnet's name (passed through). |
| -AppsSubnetPrefix | no | 10.220.0.0/23 | The Container Apps subnet's range, a /23 or larger inside the network (passed through). |
| -EndpointsSubnetName | no | pim-endpoints | A private install: the private endpoints subnet's name (passed through). |
| -EndpointsSubnetPrefix | no | the /26 after the apps subnet | A private install: the private endpoints subnet's range, a /28 or larger (passed through). |
| -PrivateDnsZonesResourceGroupId | no | A private install: your central privatelink zones (a resource group id) -- used, never created or written (passed through). | |
| -HubVnetId | no | A private install: your hub network, for the peering and the zone link (passed through). | |
| -LinkZonesToHub | no | false | A private install: link PIM Manager's own private zone to the hub (passed through). |
| -PeerToHub | no | false | A private install: peer the PIM network with the hub, both sides (passed through). |
| -InternalRanges | no | [] | A private install behind a hub firewall: the ranges your users connect from, for the app subnet's return route (passed through, with -FirewallIp). |
| -FirewallIp | no | A private install: your hub firewall's private IP, the return route's next hop (passed through, with -InternalRanges). | |
| -WebAppAccess | no | external (internal with -PrivateNetwork) | How the PIM Manager is reached; internal only with -PrivateNetwork, and a private install is always internal (passed through). |
| -UpdateRing | no | 3 | Pro: the update ring, 2 (design partners) or 3 (broad, the default) (passed through). |
| -KeyVaultName | no | kv-pim-<token> | The installation's own Key Vault name (passed through). |
| -EngineAzureRootUserAccessAdmin | no | false | Also give the PIM engine User Access Administrator at the tenant root (passed through). |
| -InstallId | no | derived from tenant, subscription and resource group | The installation id (passed through). |
| -SupportAppId | no | The Invardia Support app's client id -- only when you want Invardia support to have access (passed through). The Support app is named by its id, never found by name; nothing is granted without it. | |
| -SupportAccess | no | troubleshoot | The Support app's level: troubleshoot, setup or asbuilt, used only with -SupportAppId (passed through). |
| -Reporter | no | Callback that receives every step event (passed through). | |
| -StatePath | no | clouddrive/invardia/<install id> (Cloud Shell) or ~/invardia/<install id> | The installer's resume state folder (passed through). |
| -Resume | no | false | Continue a stopped installation: the release downloaded before is used again when it is the same edition and version this copy installs now; otherwise it is downloaded afresh (one line says so). The installation continues from its own saved progress (passed through). |
| -PreflightOnly | no | false | Run only the installer's checks (passed through). |
| -ViaSupportApp | no | false | Run the installation as the Invardia Support app (passed through). It needs a Connect-InvardiaSupport session for the same tenant in this PowerShell window; without one it stops before anything is downloaded. |
| -Version | no | the latest public release | The PIM Manager release to install, for example 3.0.5. |
| -ReleasePath | no | A folder that already holds the unpacked release: nothing is downloaded. |
Preview with -WhatIf
Downloads and unpacks the release into a new folder in the temp folder (the plan is read from it), then runs Install-PimManager -WhatIf from it: its checks (reads only) and every step it would take. No note is written and nothing in Azure, Microsoft Entra ID or the database is changed.
Undo
Delete the release folder and the note in the temp folder; the installation itself is undone as described for Install-PimManager.
Network
It connects to: api.github.com (the release metadata), github.com, objects.githubusercontent.com and release-assets.githubusercontent.com (the release files), the Pro copy instead: login.microsoftonline.com (the browser sign-in) and invardia.com (the Pro package and the short-lived download link it names), and everything Install-PimManager reaches (management.azure.com, graph.microsoft.com, login.microsoftonline.com, the database it creates <server>.database.windows.net:1433, the registry it creates <registry>.azurecr.io, outlook.office365.com for the mail sender)
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/pim/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1
.\Start-PimManagerInstall.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>To check the download first, compare its SHA-256 with the published one:
SHA-256 f2d532d36411bb5cfecef829c97913c55b267bfbebb330f5a39e2572dff47c94
Checksums: SHA256SUMS.txt · Version 3.0.70
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Start-PimManagerInstall.ps1 -Full · Source: Start-PimManagerInstall.ps1
Every script, identity and permission for your security review: PIM Manager