Grant-SIUpdaterDatabase
Let the product updater apply database changes (one time)
Purpose
ONE TIME: lets the product updater (caj-si-updater) apply a release's database schema and grants.
When to run it
Once per Pro install, when the updater reports it cannot apply the schema.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | the Pro SQL server's Entra admin (member of the SQL admin group) | the Pro database | to create the user and add roles |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Pro SQL database | create | a database user for the updater's managed identity | db_datareader, db_datawriter, db_ddladmin | the Pro database | the updater applies the release's schema (additive only) and grants | DROP USER |
What it only reads
- the updater identity
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | ||
| -SqlServer | yes | ||
| -SqlDatabase | yes | ||
| -ResourceGroupName | no | ||
| -IdentityName | no | 'uami-si-updater' | |
| -ClientId | no | an SPN instead of a managed identity: its app (client) id; -UserName names a NEW database user (default: the identity name) | |
| -UserName | no | ||
| -Apply | no |
Preview with -WhatIf
The plan: the user and roles it would create; nothing is granted (same as without -Apply).
Undo
DROP USER for the updater's identity.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Grant-SIUpdaterDatabase.ps1 -OutFile Grant-SIUpdaterDatabase.ps1
.\Grant-SIUpdaterDatabase.ps1 -SubscriptionId <SubscriptionId> -SqlServer <SqlServer> -SqlDatabase <SqlDatabase>To check the download first, compare its SHA-256 with the published one:
SHA-256 0582875258567ed5887cd8ddc79430a2c38b4fc58301586e55cfbc6e37476f7e
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Grant-SIUpdaterDatabase.ps1 -Full · Source: Grant-SIUpdaterDatabase.ps1
Every script, identity and permission for your security review: SecurityInsight