Validate-SIOpenAI
Create or check the Azure OpenAI account for the AI features
Purpose
Creates or checks the Azure OpenAI account and the model deployment SecurityInsight's AI features use.
When to run it
When the AI features are switched on, or to check the account and deployment.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Contributor (or Cognitive Services Contributor) | the resource group | to create the account and the deployment |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure resource | create | an Azure OpenAI (Cognitive Services) account | the resource group | the AI features need a model endpoint | delete the account | |
| Azure resource | create | a model deployment on that account | the account | the AI features call this deployment | delete the deployment |
What it only reads
- existing accounts, deployments, model availability and quotas
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -SubscriptionId | no | ||
| -ResourceGroupName | no | ||
| -Location | no | ||
| -AccountName | no | ||
| -DeploymentName | no | ||
| -ModelName | no | Optional: if not passed, script auto-selects a supported model for the account + region | |
| -ModelVersion | no | ||
| -Capacity | no | If omitted, PS 5.1 may treat it as 0 => we treat 0 as "not provided" | |
| -PublicNetworkAccess | no | ||
| -PrivateNetwork | no | #1102 (framework rule 11): the install is PRIVATE (its private-network answer). Without it the install's database server is read: public network access off = private. A private install never gets an account with public access. | |
| -InstallResourceGroupName | no | The install's resource group, where its database server is read (default: -ResourceGroupName). | |
| -WaitForAccountReady | no | ||
| -WaitIntervalSeconds | no | 5 | |
| -WaitTimeoutSeconds | no | 300 | |
| -DeploymentSkuOrder | no | Which deployment SKUs to try, in order. Keep Standard first to prefer on-demand / pay-per-use. | |
| -WriteModelDumps | no | If set, writes model dumps to disk when selection/deploy fails | |
| -ValidateOnly | no | When $true, no resources are created or modified -- the engine just verifies each resource exists and prints the same summary block you'd get after a real provisioning run. Useful for re-running Step3 as an ongoing "is my OpenAI still healthy?" check without making changes. |
Preview with -WhatIf
Check only (as -ValidateOnly): what exists and what would be created; nothing is created and no model dump files are written.
Undo
Delete the deployment and the account.
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net, www.powershellgallery.com
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Validate-SIOpenAI.ps1 -OutFile Validate-SIOpenAI.ps1
.\Validate-SIOpenAI.ps1To check the download first, compare its SHA-256 with the published one:
SHA-256 e1b9a106b815044a2f2191e7748b8c0d054891ef7a06a8f874ea132df96143f1
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Validate-SIOpenAI.ps1 -Full · Source: Validate-SIOpenAI.ps1
Every script, identity and permission for your security review: SecurityInsight