Update-PimCommunity
Update an installation by hand (signed release)
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Updates a PIM Manager installation by hand: it reads Invardia's signed release for this edition and ring, verifies it exactly as the in-cloud updater does, and only with -Apply downloads the release, checks its size and SHA-256, and deploys it with the parameters the last successful deploy saved.
When to run it
When you keep the in-cloud updater off (deployed with -SkipUpdater) and update on your own schedule -- Community or Pro. The in-cloud updater is the default and checks the same signed release at night. Run it from the folder of the release you installed (.\tools\setup\Update-PimCommunity.ps1), as the person who ran the original deploy.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | The same rights as the original deploy (Invoke-PimDeployAll.ps1): Owner of the PIM resource group or subscription, signed in through the browser (no Azure CLI) | the PIM resource group and subscription | The update runs the release's deploy with the saved parameters; every step that is already current is skipped, so in practice it rolls the new version and upgrades the schema. The deploy's own page lists each right. |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| This computer | create | a new folder PIM4EntraPS-<version> next to the current one, holding the verified release -- only with -Apply and when a newer release is approved for the ring | this computer | The release is unpacked from the archive whose size and SHA-256 match the signed manifest, never from an unchecked download. | Delete the folder; the previous release folder is untouched. | |
| PIM resource group (via Invoke-PimDeployAll.ps1) | update | the PIM Manager / engine containers, the database schema (additive) and any step the deploy finds out of date -- only with -Apply | this installation | Rolls the new version. The schema is upgraded additively before the new version starts, and a failed health check rolls the Manager back. | Run the previous release folder's Update-PimCommunity.ps1 -SkipPull -Apply; the deploy rolls that version back in. |
What it only reads
- the saved deploy profile (%LOCALAPPDATA%\pim\deploy-profiles\<tenant>-*.json, or -ProfilePath) and the applied-release record next to it
- Invardia's signed release for the edition and ring (read-only), to report from -> to
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | no | Which saved deploy profile to use when there is more than one on this machine. | |
| -ProfilePath | no | A saved deploy profile to use directly (written by a successful Invoke-PimDeployAll.ps1 -Apply). | |
| -SkipPull | no | false | Re-run the deploy on the code you already have (no release is read or downloaded). |
| -Apply | no | false | Download the verified release and deploy it. Without it nothing changes: the target version is reported and the deploy plan printed. |
| -AcceptBaselineChange | no | false | Accept a new version that changes the policy baseline. The update refuses such a version and names this switch; give it for that one run when the change is intended. It is never saved into the profile. |
| -Edition | no | Community | Community (Invardia's anonymous Community channel) or Pro (the licence feed: needs -InstallKey and -LicencePath). |
| -Ring | no | 3 | The release ring to follow; 3 is the public release (the Community channel serves rings 2 and 3). |
| -InstallKey | no | Pro only: this installation's Invardia install key (Settings > Licence). | |
| -LicencePath | no | Pro only: the Invardia-issued licence file. | |
| -BaseUrl | no | https://invardia.com | Invardia's address. |
| -AllowMajor | no | false | Take a MAJOR version jump on purpose; refused otherwise. |
| -DeployArgs | no | Extra parameters for the release's deploy (a hashtable), for a parameter a newer release added. Never saved. |
Preview with -WhatIf
Reads the saved profile and reports the version; with -SkipPull reads nothing else ('no pull -- -SkipPull'); runs the deploy as a -WhatIf plan ('DEPLOY-ALL PLAN (WHATIF ...', 'WHATIF / PLAN-ONLY -- no changes made'). -WhatIf wins over -Apply: nothing is downloaded. Nothing is changed.
Undo
Run the previous release folder's Update-PimCommunity.ps1 -SkipPull -Apply; the deploy rolls that version back in.
Network
It connects to: invardia.com (the signed release: GET /api/updates/pim-manager/community/<ring>, anonymous; Pro: the licence feed), github.com (the release archive the signed manifest names -- only with -Apply), login.microsoftonline.com, management.azure.com, graph.microsoft.com and the PIM resources (the deploy; see Invoke-PimDeployAll)
How it runs
Part of the PIM Manager release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.70
Every script, identity and permission for your security review: PIM Manager