New-SIManagementAppRegistration
Create or update the web app's sign-in application
Purpose
Creates or updates the Entra app registration the SecurityInsight Pro web app signs in with (and the MCP server validates tokens for): its app roles, its service principal with "assignment required" switched off (SecurityInsight decides who sees what), the role of the people it is given, and optionally the web app's federated credential. Plans by default; -Apply makes the changes.
When to run it
During setup (the guided install runs it), or when an update says people added on the Access page cannot sign in because Microsoft Entra still requires an assignment on the enterprise application: run it once with -TenantId and -AppId (the web app's client id) and -Apply.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Application.ReadWrite.OwnedBy (an owner of the app) or Application.ReadWrite.All, and AppRoleAssignment.ReadWrite.All | the tenant | to create or change the app registration and its service principal, and assign its app roles; Directory.ReadWrite.All is never needed |
| entraRole | User.ReadBasic.All (only when a person is named by user principal name) and DelegatedPermissionGrant.ReadWrite.All (the organisation-wide consent of the sign-in scope User.Read and the API scope Estate.Read) | the tenant | to look up the people it assigns and to consent the sign-in permissions for the organisation |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Microsoft Entra ID | update | the app registration 'SecurityInsight Management': app roles, sign-in and API settings, redirect URLs | the tenant | the web app and the MCP server sign in with it | change the registration in the Entra admin center; re-running restores the product's settings | |
| Microsoft Entra ID | update | its enterprise application: "assignment required" switched off | the tenant | a person a SuperAdmin adds on the Access page can sign in; the web app shows nothing to a person it gives no role | switch "assignment required" on again on the enterprise application (people added on the Access page then cannot sign in) | |
| Microsoft Entra ID | grant | an app role assignment for each person given (-SuperAdminUser / -AdminUser / -ViewerUser / -WallboardUser / -DepartmentUser), and the organisation-wide consent of the sign-in permissions | the tenant | the first SuperAdmin of the web app, and a sign-in without an approval prompt | remove the assignment on the enterprise application | |
| Microsoft Entra ID | create | with -WebIdentityPrincipalId: a federated credential for the web app's managed identity (no secret, no certificate) | the app registration | the web app's mail setup by a click | remove the federated credential on the app registration |
What it only reads
- the app registration and its service principal (found by -AppId, else by name)
- the people named, by user principal name
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -TenantId | yes | ||
| -DisplayName | no | '' | ONE product-level name, identical in every environment (operator 2026-10-04: no release ring in names -- the name is what a user sees on the consent screen). Several installs in one tenant share the name, so name an existing app by -AppId (the deploy records it as SI_Management_AppId); a name that matches two apps is refused. -DisplayName wins. |
| -Ring | no | 'prod' | kept for callers of earlier releases; it is no longer part of the name |
| -AppId | no | '' | an EXISTING app by its appId (client id) instead of by display name -- use it when the caller holds only Application.ReadWrite.OwnedBy, which lists only the apps the caller owns |
| -Fqdn | no | '' | the web app's host name (no scheme); adds https://<fqdn>/signin-oidc + the logout URL |
| -SuperAdminUser | no | @() | the web app's top role (roles + scopes, licence, updates, template releases): setup passes the person who runs it |
| -AdminUser | no | @() | |
| -ViewerUser | no | @() | |
| -WallboardUser | no | @() | the kiosk account(s) of a big screen: the Wallboard role sees only /Wallboard |
| -DepartmentUser | no | @() | #258: a person of a department who signs in with Entra and holds no other role -- an external advisor invited as a B2B guest, or an owner. The role only lets them sign in; the web app scopes them to the departments that list them. |
| -WebIdentityPrincipalId | no | '' | #443 (a): the web app's user-assigned managed identity (its OBJECT / principal id). Given: the app trusts that identity through a FEDERATED credential (no secret, no certificate), so the web app can redeem a sign-in for the admin's delegated Exchange token -- the "Set up mail" click flow. Several installs in one tenant share the app: each adds its own credential (named after its identity); nothing another install added is touched. |
| -Apply | no |
Preview with -WhatIf
The plan: what it would create or change; nothing is changed (same as without -Apply).
Undo
Re-running restores the product's settings; a change you want gone is undone in the Entra admin center.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/New-SIManagementAppRegistration.ps1 -OutFile New-SIManagementAppRegistration.ps1
.\New-SIManagementAppRegistration.ps1 -TenantId <TenantId>To check the download first, compare its SHA-256 with the published one:
SHA-256 7d027ab9917951e4bffd6bcdf1eebbb0783801c7ec6420a809e84acfc6670f70
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\New-SIManagementAppRegistration.ps1 -Full · Source: New-SIManagementAppRegistration.ps1
Every script, identity and permission for your security review: SecurityInsight