Set-SIDisplayNames
Give an existing install's applications and SQL admin group the names people read
Purpose
Renames, only from SecurityInsight's earlier default name, the engine application (SecurityInsight -> SecurityInsight Engine), the web app's sign-in application (SecurityInsight Management -> SecurityInsight) and the SQL admin group's display name (grp-si-sql-admins -> SecurityInsight SQL admins). Each is found by its id, read back, and put back on failure. Azure resources keep their names.
When to run it
Once on an install made before the naming convention, when the update says its identity may not rename them. A new install already has these names.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Application Administrator or Cloud Application Administrator (or an owner of each application) | the two applications | to change an application's display name |
| entraRole | Privileged Role Administrator (or Global Administrator) | the tenant | the SQL admin group is role-assignable |
| azureRbac | Reader | the install's resource group | to read the web app's sign-in client id and the SQL server's Entra admin |
| other | Microsoft Graph Application.ReadWrite.All, Group.ReadWrite.All with RoleManagement.ReadWrite.Directory (when an app runs it instead of a person) | the tenant | to rename the applications and the role-assignable group without a person's admin role |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Entra application | update | display name of the engine application and its enterprise application: SecurityInsight -> SecurityInsight Engine | the application | the full name where people read; the sign-in application takes the name SecurityInsight | rename it back in the Entra admin center (App registrations > the app > Branding & properties) | |
| Entra application | update | display name of the web app's sign-in application and its enterprise application: SecurityInsight Management -> SecurityInsight | the application | the product's name on the sign-in and consent screens | rename it back in the Entra admin center (App registrations > the app > Branding & properties) | |
| Entra group | update | display name of the SQL admin group: grp-si-sql-admins -> SecurityInsight SQL admins (its mailNickname is kept) | the group | the full name where people read | rename it back in the Entra admin center (Groups > the group > Properties) |
What it only reads
- the web app's sign-in client id
- the SQL server's Entra admin
- the applications and the group by their ids
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -ResourceGroupName | yes | ||
| -SubscriptionId | no | ||
| -WebAppId | no | '' | the web app's sign-in application (client id); empty = read from the web app in the resource group |
| -EngineAppId | no | '' | SecurityInsight's engine application (client id, SI_SPN_AppId in the install's config); empty = not renamed |
| -SqlServerName | no | '' | the Pro SQL server; empty = the only sql-si-* server in the resource group |
| -Apply | no |
Preview with -WhatIf
Prints one line per rename it would make; changes nothing.
Undo
Rename each object back in the Entra admin center. SecurityInsight finds them by id under either name.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, graph.microsoft.com, invardia.com, login.microsoftonline.com, management.azure.com, monitor.azure.com, outlook.office.com, outlook.office365.com, storage.azure.com, vault.azure.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Set-SIDisplayNames.ps1 -OutFile Set-SIDisplayNames.ps1
.\Set-SIDisplayNames.ps1 -ResourceGroupName <ResourceGroupName>To check the download first, compare its SHA-256 with the published one:
SHA-256 c2aef19176138d533120e8a61a31fc7f074c1f223d0aef5425bca4a1e3efa412
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Set-SIDisplayNames.ps1 -Full · Source: Set-SIDisplayNames.ps1
Every script, identity and permission for your security review: SecurityInsight