Grant-SISupportAppDatabase
The Invardia Support app holds both parts of its database access: the database admin group and its own database user (one time per install)
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
ONE TIME per install: ENSURES both parts of the Invardia Support app's access to SecurityInsight's product databases (framework section 4.1b) -- it is a member of the database admin group (and the server's administrator is that group, recorded as a group), and it has its own database user, with the owner role, in each product database. Only what is missing is added; nothing is ever removed. So SecurityInsight's setup scripts can be run for you through a recorded support session after the install.
When to run it
Once on a SecurityInsight Pro install made before new installs did this themselves, or when the install's Health check (or the status report to Invardia) says a part is missing. A second run changes nothing.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | the Pro SQL server's Entra admin (a member of the SQL admin group), or the Invardia Support app in a support session | the Pro database, the identity ledger and the data database where there is one | to make the Support app's own database user (from its client id, WITH SID, TYPE = E) and add it to db_owner |
| entraRole | Privileged Role Administrator (the admin group is role-assignable) | the SecurityInsight SQL admin group | to add the Support app as a member |
| azureRbac | Contributor | the Pro SQL server (only when the server does not record the admin group as a group) | to record the server's Entra admin -- the admin group -- as a group |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Entra group | update | the SecurityInsight SQL admin group: the Support app as a member | the group only | part (a) of the Support app's database access; the membership stays after the install | Grant-SISupportAccess -AppId <id> -Remove | |
| Pro SQL server | update | the server's Entra admin: the admin group, recorded as a group -- only when the server names the group under another kind, or the Support app itself is still the admin | the Pro SQL server | Azure SQL lets the members of the admin group in only when the server records its admin as a group | set another Entra admin on the server (Set-SISqlAdminGroup sets the group again) | |
| Pro SQL databases | create | the Invardia Support app's own database user (CREATE USER ... WITH SID = <its client id as bytes>, TYPE = E -- no directory lookup) and its membership of db_owner -- only where it is not there | the Pro database, the identity ledger and the data database where there is one | part (b) of the Support app's database access: its own way in, which does not depend on the directory | Grant-SISupportAccess -AppId <id> -Remove (the customer's switch-off) | |
| Pro SQL database | update | the install's record of the Support app's client id | the Pro database | the install knows which application its support access belongs to | none needed (a record only) |
What it only reads
- the install configuration (the SQL server and database names)
- the Support app's service principal, its membership of the admin group (asked from its own side), the SQL server's Entra admin and the admin group
- the Support app's database user in each product database
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -AppId | no | '' | The Support app's client id. Not needed in a support session: the session's own application is used. |
| -ConfigPath | no | The install's configuration. Default: config\SecurityInsight.custom.ps1 of this copy. | |
| -SqlServer | no | ||
| -Databases | no | @() | |
| -SubscriptionId | no | ||
| -ResourceGroupName | no | ||
| -GroupName | no | 'grp-si-sql-admins' | The admin group's name, used only when the server's administrator is not a group at that moment. |
| -Apply | no | ||
| -PassThru | no |
Preview with -WhatIf
The plan: what is there and what would be changed; nothing is changed and no database connection is opened (same as without -Apply).
Undo
Grant-SISupportAccess -AppId <id> -Remove removes the group membership and the Support app's own database users -- the customer's switch-off; nothing else removes them.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight