Grant-SISupportAccess
Give or remove the Invardia Support app's access to SecurityInsight
Purpose
Gives the customer's Invardia Support app the access only SecurityInsight can grant, with NO standing admin: read the SecurityInsight Key Vault, the just-in-time support grant in each product database (its signed procedures, the Support app's own database user in a read-only role -- never db_owner, never the SQL admin group -- and the customer's consent at the chosen level) and the two Azure roles the support grant uses -- or takes all of it away again with -Remove (the customer's switch-off). The earlier standing model (db_owner, SQL admin group membership, app ownership) only with -LegacyStandingAccess, which is off.
When to run it
When the customer agrees that Invardia support may help with SecurityInsight (Level troubleshoot = read, setup = also repair), and again with -Remove when support access ends.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Owner or User Access Administrator | the SecurityInsight Key Vault and the install's resource group | to add / remove the Key Vault role assignment and the support grant's two roles (the request queue, the support grant job) |
| other | Entra admin of the Pro SQL server (member of the SQL admin group) | the product databases | to install the support grant (tables, signed procedures), the Support app's own read-only database user and the consent -- and, with -Remove only, to drop that user and the consent |
| entraRole | Privileged Role Administrator | the SecurityInsight SQL admin group (role-assignable) -- only with -Remove or -LegacyStandingAccess | to remove (or, legacy only, add) the Support app as a member; a role-assignable group's members are changed only by this role |
| entraRole | Application Administrator or owner of the app | the SecurityInsight app registrations -- only with -Remove or -LegacyStandingAccess | to remove (or, legacy only, add) the Support app as an owner |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure RBAC | grant | the Support app's service principal | Key Vault Reader (troubleshoot) / Key Vault Secrets Officer (setup) | the SecurityInsight Key Vault | support reads the install's configuration pointers; setup level may repair secrets | Grant-SISupportAccess -Remove |
| Pro SQL database | create | the just-in-time support grant: its tables and four signed procedures, the Support app's own database user from its client id (WITH SID, TYPE = E) in the read-only role si_support_read (metadata and health, no data), and the consent at this level -- never db_owner; with -Remove: the user and the consent are dropped | each product database | support gets admin only while a support session is open, at most at the consented level, for at most 8 hours | Grant-SISupportAccess -Remove | |
| Azure RBAC | grant | the Support app's service principal | Storage Queue Data Message Sender | the queue si-support-requests | a support session asks for its just-in-time grant; the queue starts the support grant job, so the Support app holds no right on any job | Grant-SISupportAccess -Remove |
| Azure RBAC | remove | the Support app's service principal | Container Apps Jobs Operator (given by an earlier release) | the job caj-si-support-grant | a right to start a job also lets its holder change what the job runs; the queue starts the job instead (removed only once the job is started by its queue) | none needed: support asks through its queue |
| Entra group | update | LEGACY ONLY (-LegacyStandingAccess, off): the Support app as a standing member of the SQL admin group; -Remove takes a membership away | the group only | the earlier standing model | Grant-SISupportAccess -Remove | |
| Entra app registration | update | LEGACY ONLY (-LegacyStandingAccess, off): the Support app as an owner of SecurityInsight's app registrations; -Remove takes an ownership away | Application.ReadWrite.OwnedBy | those app registrations only | the earlier standing model | Grant-SISupportAccess -Remove |
What it only reads
- the install configuration (Key Vault, SQL server, group and app names)
- whether the Support app is still a standing member of the SQL admin group or an owner of an app registration (said, never added again by default)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -AppId | yes | ||
| -Level | no | 'troubleshoot' | |
| -Remove | no | ||
| -LegacyStandingAccess | no | the earlier model: ALSO standing db_owner + SQL admin group membership + app ownership. OFF; only on Invardia's word. | |
| -ConfigPath | no | ||
| -ManagementAppId | no | '' |
Preview with -WhatIf
Prints every grant, database step, membership and ownership it would add or remove; adds or removes nothing.
Undo
Run the same command with -Remove: the roles, the database user, the consent, a membership and an ownership are taken away.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, database.windows.net, graph.microsoft.com, invardia.com, login.microsoftonline.com, management.azure.com, monitor.azure.com, outlook.office.com, outlook.office365.com, storage.azure.com, vault.azure.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Grant-SISupportAccess.ps1 -OutFile Grant-SISupportAccess.ps1
.\Grant-SISupportAccess.ps1 -AppId <AppId>To check the download first, compare its SHA-256 with the published one:
SHA-256 583a312bd49990ff9973c890ef3a817d03e6be6884f5f433ec889aad11786586
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Grant-SISupportAccess.ps1 -Full · Source: Grant-SISupportAccess.ps1
Every script, identity and permission for your security review: SecurityInsight