Set-SISqlAdminGroup
Make one role-assignable group the Pro SQL server's Entra admin
Purpose
Makes the role-assignable group grp-si-sql-admins (created if missing) the Entra admin of the Pro SQL server, with SecurityInsight's identities as its members.
When to run it
During or after the Pro install when the SQL server's Entra admin must be set or repaired.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| entraRole | Privileged Role Administrator (or Global Administrator) | the tenant | to create a role-assignable group |
| azureRbac | SQL Server Contributor (or Contributor / Owner) | the SQL server | to set its Entra admin |
| other | Microsoft Graph RoleManagement.ReadWrite.Directory with Group.ReadWrite.All (when an app runs it instead of a person) | the tenant | to create a role-assignable group without a person's admin role |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Entra group | create | grp-si-sql-admins (role-assignable security group) | the tenant | one named group, the same everywhere, holds the database admin right | delete the group (after setting another admin) | |
| Entra group | update | members: SecurityInsight's identities (-MemberObjectIds) | the group | the jobs and web app manage the database as admins | remove the members | |
| Azure SQL server | update | the Entra admin = grp-si-sql-admins, recorded by the server as a group | the Pro SQL server | the database is administered by the group, not by a person | set another Entra admin on the server |
What it only reads
- the current Entra admin of the SQL server
- existing groups and members
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SqlServerName | yes | ||
| -ResourceGroupName | yes | ||
| -SubscriptionId | no | ||
| -MemberObjectIds | no | @() | |
| -GroupName | no | 'grp-si-sql-admins' | |
| -DisplayName | no | '' | the display name a NEW group is created with (default: -GroupName). CR5: a new install passes 'SecurityInsight SQL admins'; the mailNickname always follows -GroupName, so every later run finds the group under either name. |
| -ReplaceCurrentAdminGroup | no | The server's current admin is ANOTHER group (for example the group this one replaces). A role-assignable group cannot contain it, so its members must be in -MemberObjectIds; this switch confirms that they are. |
Preview with -WhatIf
Prints the group it would create, the members it would add and the admin it would set; changes nothing.
Undo
Set another Entra admin on the SQL server; remove the members; delete the group.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, graph.microsoft.com, invardia.com, login.microsoftonline.com, management.azure.com, monitor.azure.com, outlook.office.com, outlook.office365.com, storage.azure.com, vault.azure.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Set-SISqlAdminGroup.ps1 -OutFile Set-SISqlAdminGroup.ps1
.\Set-SISqlAdminGroup.ps1 -SqlServerName <SqlServerName> -ResourceGroupName <ResourceGroupName>To check the download first, compare its SHA-256 with the published one:
SHA-256 09f7a8cfde9cf9962ad520c03256876dce8aa5f0350a11f5ccff8beb3e05f93b
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Set-SISqlAdminGroup.ps1 -Full · Source: Set-SISqlAdminGroup.ps1
Every script, identity and permission for your security review: SecurityInsight