Set-SIInstallTenant
Record the tenant's name for the web app's header
Purpose
Reads the tenant's own name and onmicrosoft.com domain from Entra ID (Microsoft Graph) and records them in the Pro database, so the web app's header shows the tenant by name.
When to run it
Normally never: setup runs it when SecurityInsight is installed. Run it for an install built another way, or after the tenant was renamed.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | any signed-in account of the tenant (an application needs Directory.Read.All or Organization.Read.All) | the tenant | to read the organization's name |
| other | the install identity (service principal + certificate) | the Pro database | to write cfg.InstallState |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Pro SQL database | update | cfg.InstallState: Tenant (name, domain, set by) | the Pro database | the web app's header shows the tenant by name | run it again, or set "Tenant name (override)" on the Settings page |
What it only reads
- Microsoft Graph: the organization (name, verified domains)
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -Name | no | The tenant's name to record without asking Microsoft Graph. | |
| -InitialDomain | no | The tenant's onmicrosoft.com domain to record without asking Microsoft Graph. | |
| -GraphToken | no | A Microsoft Graph access token to read the organization with (default: the guided install's sign-in, else setup's own sign-in). | |
| -SetBy | no | 'setup' | Who records it (shown in the web app's tooltip). |
| -Server | no | [string]$global:SI_ProSqlServer | |
| -Database | no | [string]$global:SI_ProSqlDatabase | |
| -AppId | no | [string]$global:SI_SPN_AppId | |
| -TenantId | no | [string]$global:SI_SPN_TenantId | |
| -CertThumbprint | no | [string]$global:SI_SPN_CertThumbprint | |
| -Store | no | The database, already open (New-SIProSettingsStore -Invoke ...): a test's fake, or a caller's store. | |
| -GraphGet | no | Returns the GET /organization response: a test's fake (no Graph call is made then). | |
| -PassThru | no |
Preview with -WhatIf
Says what would be read and where it would be recorded; neither Microsoft Graph nor the database is opened.
Undo
Run it again, or set "Tenant name (override)" on the Settings page.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Set-SIInstallTenant.ps1 -OutFile Set-SIInstallTenant.ps1
.\Set-SIInstallTenant.ps1To check the download first, compare its SHA-256 with the published one:
SHA-256 00d3eb62e9e5a28c0e64450892f207362b48c588ad0bcfbd55f003d8e888a862
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Set-SIInstallTenant.ps1 -Full · Source: Set-SIInstallTenant.ps1
Every script, identity and permission for your security review: SecurityInsight