Install-SIUpdaterJob
Create or update the updater job (container install, Pro)
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Creates or updates caj-si-updater, the nightly job that keeps a container-hosted SecurityInsight Pro on the version its update ring approves, from Invardia's update platform: builds the updater image, ensures the updater's identity and creates or updates the job.
When to run it
Once per container install (normally through Upgrade-SIToPro); again to change the ring, the schedule or the sign-in.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor | the resource group and the container registry | to build the image, create the identity and create or update the job |
| azureRbac | User Access Administrator (or Owner) -- with -GrantSpnRoles | the resource group, the registry and the Key Vault | to grant the updater its roles |
| sql | the SQL server's Entra admin -- with -GrantSql | the Pro database | to give the updater its database rights (Grant-SIUpdaterDatabase) |
| entraRole | Privileged Role Administrator (or Global Administrator) -- optional | the tenant | to give the updater's identity Directory.Read.All; without it the setup says so in one line and goes on |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure Container Registry | create | the image si-updater:v<version> | the job runs it | delete the repository si-updater in the registry | ||
| Azure | create | the user-assigned identity uami-si-updater (when missing) | the job pulls its image and reads its Key Vault references with it | delete the identity | ||
| Azure RBAC | grant | uami-si-updater | Key Vault Secrets User, AcrPull | the Key Vault and the registry | to read the Key Vault references and pull the image | remove the role assignments |
| Azure RBAC | grant | the updater's identity (only with -GrantSpnRoles) | Contributor, Key Vault Secrets Officer, Key Vault Crypto Officer | the registry, the resource group and the Key Vault | to build in the registry, update the jobs, keep the licence and update state in the vault, and store the secrets the web app hands over (its hand-over key stays in the vault) | remove the role assignments |
| Azure RBAC | remove | the Pro web app's identity (only with -GrantSpnRoles) | Key Vault Secrets Officer | exactly the Key Vault (an inherited assignment is never touched) | the web app no longer writes secrets: it hands them to the updater, which stores them | not needed -- the web app has no use for the right |
| Entra application permissions | grant | the updater's identity (uami-si-updater), through Grant-SIIdentity -Only (only what is missing, read back) | Directory.Read.All (application, read-only) | the tenant | the updater reads the tenant's size (users, groups, devices, service principals) to size the jobs; without it the jobs are sized for a large tenant and the setup goes on | remove the app role assignment from the identity's service principal |
| Azure Container Apps | create | the job caj-si-updater (or an update of it): schedule, image, environment settings; legacy GitHub-token and feed settings removed | the nightly update | delete the job caj-si-updater | ||
| Azure SQL (Pro) | grant | the updater's identity (only with -GrantSql) | db_datareader, db_datawriter, db_ddladmin, db_securityadmin | the Pro database | an update applies the release's schema and grants first | drop the database user |
What it only reads
- the registry, the identity, the Key Vault and the existing job
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | ||
| -ResourceGroupName | yes | ||
| -AcrName | yes | ||
| -EnvName | yes | ||
| -KeyVaultName | yes | ||
| -CertSecretName | no | ||
| -SourceUrlSecretName | no | RETIRED (2026-10-06): SI's own update feed. Kept only to refuse it clearly -- Pro updates come only from Invardia. | |
| -Source | no | 'invardia' | #240: where releases come from -- invardia (Pro) or community (#750 (b): the signed Community channel; the Community edition's default, chosen by itself when this copy has no Invardia client). 'feed' is refused: the feed is retired. |
| -SpnClientId | no | ||
| -TenantId | yes | ||
| -Schedule | no | '' | 18:30 in the LOCAL time of the install's Azure region (owner 2026-10-21), as the zone's UTC ticks -- e.g. westeurope '30 16,17 * * *' (summer + winter), westus '30 1,2 * * *'; the updater ends the tick that is not 18:30 there (setup/_shared/SI-NightlySchedule.ps1). Not given: computed from -Region, else from the location of the Container Apps environment (-EnvName), else of the resource group; a region not known = Danish time, said in one line. The job records the zone (tags si-nightly-schedule + si-nightly-region + si-nightly-1900), so the update's one-time steps have nothing to move. A -Schedule given is a timer of your own (no tags). The daily pipeline starts after it, 19:00 in the same zone. |
| -Region | no | '' | |
| -UpdateRing | no | -1 | #350 / UPDATE-1.7: the update ring this environment pulls for (SI_UPDATER_RING, 0-3) -- daily, like every ring. -1 = not set: the updater uses the ring recorded for the install (cfg.InstallState 'Ring'); none = no pull. |
| -ProSqlServer | no | Pro: the settings database the updater reads the customer's switches from and records its state in (the header shows it) | |
| -ProSqlDatabase | no | ||
| -Block | no | '' | |
| -JobName | no | 'caj-si-updater' | |
| -IdentityName | no | 'uami-si-updater' | |
| -WebAppName | no | 'ca-si-management' | the Pro web app (its old Key Vault right is removed with -GrantSpnRoles: it hands secrets to the updater now) |
| -McpAppName | no | 'ca-si-mcp' | the Pro MCP server (CR5 step 1: recorded on the job with the web app's and the job's own name, SI_UPDATER_MCP_APP) |
| -UseManagedIdentity | no | #350 / #222: the job signs in as its own user-assigned identity (uami-si-updater) -- no certificate in the vault, as PIM's ca-pim-update. -GrantSpnRoles then grants the IDENTITY what the SPN would get. | |
| -GrantSpnRoles | no | ||
| -GrantSql | no | #352: give the updater's identity its database rights on the Pro database (as the caller -- the server's Entra admin) | |
| -Image | no | an EXISTING job keeps the image it runs (it rolls itself to the version its ring approves); -Image sets one on purpose (a full reference, or a tag of si-updater in the registry). A new job gets the image this setup builds. | |
| -Apply | no |
Preview with -WhatIf
Prints the plan; no image is built, no identity, role or job is created or changed.
Undo
Delete the job caj-si-updater and the identity uami-si-updater; remove the role assignments.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight