Set-SISigninFront
Put the SecurityInsight Pro web app behind the shared sign-in front -- or take it back
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Purpose
Moves ONE existing Pro install's web app behind the sign-in front that SecurityInsight and PIM share (code flow with PKCE, an 8-hour session, the security headers; the web app's managed identity as a federated credential, so no secret and no certificate). In order, each step read back before the next: the sign-in permissions the front asks for (openid profile offline_access User.Read) consented for the organisation; the web app's identity as a federated credential on its app registration; the front's store (a Key Vault key, the identity's right on that key only, its database user, schema and table); the web app's own API for the front (the identifier URI api://<client id>, the delegated scope user_impersonation and the app's organisation-wide consent to it); the front's image built in the install's own registry from the release's source; a new revision of the web app with the front in front of it; Easy Auth off; and ONLY THEN the app registration's client secrets deleted (-KeepClientSecrets keeps them). -Off is the way back. Plan by default; -Apply changes.
When to run it
When the product update names this script as a customer action (the sign-in front's store, its sign-in consent, its federated credential, or the scope user_impersonation that the update read as missing and may not add), or to move an install behind the front (or back with -Off) on purpose. Run it first without -Apply to see its plan. A second run changes nothing that is already in place.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Cloud Application Administrator (or Application Administrator); Privileged Role Administrator for the organisation-wide consent | the web app's app registration and its enterprise application | to add the federated credential, the identifier URI and the scope user_impersonation, to grant the organisation-wide consent (DelegatedPermissionGrant.ReadWrite.All) and to delete the client secrets |
| azureRbac | Contributor and User Access Administrator (or Owner) | the install's resource group | to build the front's image in the install's registry, change the web app's revision, make the Key Vault key and give the web identity its right on that key |
| sql | the Pro SQL server's Entra admin (a member of the SQL admin group) | the Pro database | to make the web identity's database user, its schema signin and its CREATE TABLE right for the front's store |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Entra enterprise application | grant | the organisation-wide consent to the sign-in permissions the front asks for (openid profile offline_access User.Read) -- only what is missing | the web app's enterprise application | without it a tenant that does not let users consent shows Approval required at sign-in | remove the consent on the enterprise application's Permissions page | |
| Entra app registration | create | a federated credential for the web app's user-assigned managed identity | the web app's app registration | the front signs in with the managed identity -- no secret, no certificate | delete the federated credential on the app registration (Set up mail uses it too) | |
| Entra app registration | update | the identifier URI api://<client id> and the delegated scope user_impersonation (admin consent), added beside what the app has | the web app's app registration | the front asks an access token for the web app's own API instead of handing it the ID token | remove the scope and the URI on the app registration's Expose an API page | |
| Entra enterprise application | grant | the app's organisation-wide consent to its own scope user_impersonation | the web app's enterprise application, to itself | so nobody is asked to consent to the access token for the web app's own API | remove the consent on the enterprise application's Permissions page | |
| Key Vault | create | the key signin-front-dp and the web identity's Key Vault Crypto Service Encryption User right on that key only | the install's Key Vault | the front wraps its session keys with it | delete the key and the role assignment (a front from 1.3.0 on then does not start) | |
| Pro SQL database | create | the web identity's database user, its schema signin and its CREATE TABLE right | the Pro database | the front keeps its sessions and keys there | drop the user and the schema signin | |
| Container registry | create | the sign-in front's image, built in the install's own registry from the source the release carries | the install's container registry | installs build their own images from the signed source -- never a prebuilt image | delete the image tag in the registry | |
| Container app | update | a new revision of the web app: the front as its second container and the ingress on the front, the web app on 127.0.0.1; Easy Auth off. On any failure the revision that ran before is put back | the Pro web app | the front is the only one the ingress reaches | Set-SISigninFront -Off -Apply (the web app signs users in itself again) | |
| Entra app registration | remove | the app registration's client secrets -- only after the front reads back, and never with -KeepClientSecrets | the web app's app registration | none is needed any more: the front's client assertion is the managed identity | add a new client secret on the app registration (only an app that does not use the front needs one) |
What it only reads
- the release's pin of the sign-in front and its source
- the web app, its identity, its settings and its revision
- the app registration, its enterprise application, its consents and federated credentials
- the install's Key Vault and registry
- the Pro database's users and schemas
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | yes | ||
| -ResourceGroup | yes | ||
| -RegistryName | yes | ||
| -TenantId | yes | ||
| -SignInClientId | yes | the web app's app registration (its client id): the front signs users in with it, the web app checks it as audience | |
| -AppName | no | 'ca-si-management' | |
| -IdentityName | no | 'uami-si-management' | |
| -Off | no | ||
| -KeepClientSecrets | no | ||
| -KeyVaultName | no | '' | #852: the install's Key Vault for the front's key (default: the only Key Vault in the resource group) |
| -Apply | no |
Preview with -WhatIf
The plan: every step and what it would change; nothing is changed (same as without -Apply).
Undo
Set-SISigninFront -Off -Apply takes the front away and the web app signs users in itself again (read back); the update then keeps that choice. Deleted client secrets are not restored -- add a new one on the app registration if the web app needs one again.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
How it runs
Part of the SecurityInsight release - not a standalone download; it runs via the product's own install command or the updater.
Release 3.0.79
Every script, identity and permission for your security review: SecurityInsight