Invoke-SIContainerUpdate
Bring a container install up to the code just synced
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Detects the container hosting of the install and, with -Apply, builds the new image in the customer's registry and rolls the engine jobs to it (with a roll back on failure); for Pro also installs or keeps current the default templates.
When to run it
After an update of the install folder (Update-SecurityInsight runs it), or by hand to roll the containers.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor | the install's resource group and container registry | to build the image and update the jobs |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure Container Registry | create | the new engine image | the jobs run it | roll back to the previous image (the script keeps it) | ||
| Azure Container Apps | update | the SecurityInsight engine jobs: moved to the new image | run the new code | roll back: the previous image stays in the registry | ||
| Azure Storage | update | the install's customisation files shared with the jobs (VM-folder installs without the Pro database) | the jobs read them at run time | upload the previous files again | ||
| Azure SQL (Pro) | update | the default templates (template pack) | the Pro engines read them | roll back the template pack in the web app | ||
| the install folder | update | config\SecurityInsight.custom.ps1: the container hosting (only with -Save) | so every later sync finds these containers | remove the saved SI_Bootstrap_* lines |
What it only reads
- config\SecurityInsight.custom.ps1
- the registry and the jobs (which image each runs)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Apply | no | ||
| -DetectOnly | no | ||
| -ResourceGroupName | no | ||
| -AcrName | no | ||
| -SubscriptionId | no | ||
| -Save | no | ||
| -Force | no | Roll by hand even though an updater job owns this install's rollout (Upgrade-SIToPro.ps1). The job will move the containers back to the version your ring approves on its next run. | |
| -BuildTimeoutMinutes | no | 90 | 90 (was 30): a private install builds on its agent pool inside its network, slower than the shared builders -- seen live 2026-11-05, the build of the release image was still going after 30 minutes and the update gave up ("Timeout") |
| -InstallTemplatesDirect | no | #405: RING 1 (internal) -- the templates shipped with this tree installed DIRECTLY (Publish-SITemplates -InstallCurrent): no pack number, no gate, no pack recorded as a release. The ring 1 deploy passes it. | |
| -SizingOnly | no | #756: the code is current -- only the sizes the customer's settings set (steps 7, 8, 8d); nothing built or rolled. The updater passes it on a run with no new code to install. |
Preview with -WhatIf
Detects and prints the plan (which jobs would move to which image); nothing is built, rolled or saved.
Undo
Run it again from the previous release, or roll the jobs back to the previous image.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight