Grant-SITaggingDatabase
Let asset tagging read its settings (Pro, once)
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Gives asset tagging's own identity (uami-securityinsight-tagging) a database user with db_datareader on the Pro database, so it can read its settings at run start. Nothing more.
When to run it
Once, on a Pro install made before this step existed (its asset-tagging run stops at the settings check).
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| sql | the SQL server's Entra admin (or a member of its admin group) | the Pro database | to create the database user and grant db_datareader |
| azureRbac | Reader | the resource group of the identity | to find the identity by name (az identity show) |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure SQL (Pro) | grant | a database user for asset tagging's identity | db_datareader | the Pro database | asset tagging reads its settings from the Pro database | DROP USER <the user> in the Pro database |
What it only reads
- the identity's client id (az identity show)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | ||
| -SqlServer | yes | ||
| -SqlDatabase | yes | ||
| -ResourceGroupName | no | ||
| -IdentityName | no | 'uami-securityinsight-tagging' | |
| -ClientId | no | ||
| -UserName | no | ||
| -Apply | no |
Preview with -WhatIf
Prints the T-SQL it would run; nothing is run.
Undo
Drop the database user in the Pro database.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight