#Requires -Version 7.0 # PIM Manager 3.0.70 -- Import-PimV1Data.ps1, standalone (built by tools/setup/Build-PimSupportScripts.ps1; helpers inlined: _pimscriptdoc.ps1) <# .SYNOPSIS Imports the data of a PIM version 1 installation (its CSV files and naming conventions) into an existing PIM Manager installation. By default it only checks and previews -- it writes nothing; -Apply adds the new rows by key, never deletes, and stops before writing anything when a row conflicts. .DESCRIPTION V1-IMPORT-PUBLISHED. The person-facing wrapper around PIM Manager's own importer (Migrate-PimToSql.ps1, which runs the pre-import check engine\_shared\PIM-CsvImportCheck.ps1 and writes through the store's Merge-PimSqlEntityRows). Nothing of that logic is repeated here; this script finds the installation, signs you in, makes the network path for the run, and turns the importer's result into a plain list. What it does, in order: 1. Signs you in through the browser (or uses the Invardia Support app's session open in this window), pinned to -TenantId and -SubscriptionId. 2. Finds the PIM store over Azure Resource Manager: the SQL server in the subscription (or in -ResourceGroup) that holds the database -Database (PimPlatform). More than one: it lists them and asks for -ResourceGroup. 3. Network: a server with public access off stops the run (run it from a machine inside the installation's network, or ask Invardia support). A server with public access but no firewall rule for this machine gets a TEMPORARY rule for this machine's address, removed again at the end of the run -- also when the run fails. 4. Signs in to the database as you and checks your access first (a member of the installation's SQL admin group, or a database user; -Apply needs the database owner role, which the SQL admin group gives). 5. Checks the files and previews the import: per file the rows to add, the rows already there (same), the CONFLICTS (same key, different content) and the problems the check found. Writes nothing. 6. Only with -Apply: adds the new rows by key (never deletes), then reads the store again to prove they are there. A conflicting row stops the run before anything is written, unless -OnKeyConflict KeepExisting or Overwrite is given. The importer also brings over the naming conventions file (the values you changed from the defaults; a value already changed in PIM Manager is kept) and, only into a setting that is still empty, the warning overrides, exemptions and workload exemptions files of the folder. Files read from -SourcePath: the PIM entity files (.custom.csv first, else .csv) and PIM4EntraPS.NamingConventions.custom.ps1. The engine's state files (*_Delta.csv, *_LastApplied.csv) and files that are not PIM data are skipped and listed. The files themselves are never changed. The naming conventions file is a PowerShell file, and the importer loads it (dot-sources it) to read its values -- that is how PIM version 1 read it too. Before anything is loaded, this script parses it and REFUSES a file that contains commands (anything other than values assigned to $global:PIM_NamingConventions), so no code from the folder runs. The output is one calm line per step. The full check report and the importer's own lines are in a details file next to the transcript ("More: "); the transcript path is printed at the start and at the end. -WhatIf: signs in and reads, but does not add the temporary firewall rule; when the database cannot be reached without one, it says so and reads no rows. Exit codes: 0 done (preview shown, or imported and read back); 1 stopped -- the reason and the next step are printed, nothing was written; 2 the temporary firewall rule could NOT be removed -- the rule name to delete by hand is printed. .PARAMETER SourcePath The PIM version 1 data folder (holds the *.custom.csv files and PIM4EntraPS.NamingConventions.custom.ps1). .PARAMETER TenantId The tenant of the PIM Manager installation. Every sign-in is pinned to it. .PARAMETER SubscriptionId The subscription of the PIM Manager installation. .PARAMETER ResourceGroup The installation's resource group. Needed only when the subscription holds more than one PIM store. .PARAMETER SqlServerName The installation's SQL server. Needed only when one resource group holds more than one PIM store. .PARAMETER Database The PIM database. Default PimPlatform. .PARAMETER Apply Write: add the new rows by key. Without it the run only checks and previews. .PARAMETER OnKeyConflict What -Apply does with a row whose key is already in PIM Manager with different content: Refuse (default -- nothing is written), KeepExisting (PIM Manager's row stays, the rest is imported), Overwrite (the file's row replaces it). .PARAMETER ForceLocal Imported rows stay on this tenant (Replicate=No; admins ManagementMode=local) unless the file sets the value. .PARAMETER MspMaster Give it when the installation is an MSP managing tenant: the check then also shows what each row would send to the managed tenants. Without it the installation is treated as a single tenant. .PARAMETER NotMspMaster Not needed any more (single tenant is the default); still accepted so older command lines keep working. .PARAMETER DefaultDomain The tenant's default sign-in domain, for admin rows that have a user name but no user principal name. .PARAMETER AllowValidationErrors Import even though the check found errors in the files (they are listed). Without it -Apply refuses such files. .PARAMETER ClientIp This machine's public address for the temporary firewall rule. Without it the address is read from api.ipify.org. .EXAMPLE .\Import-PimV1Data.ps1 -SourcePath C:\PIM\config -TenantId -SubscriptionId Checks the files and previews the import. Nothing is written. .EXAMPLE .\Import-PimV1Data.ps1 -SourcePath C:\PIM\config -TenantId -SubscriptionId -Apply Imports: adds the new rows by key, never deletes. Stops before writing anything when a row conflicts. .NOTES Requirements: PowerShell: 7.0 or later (pwsh). Windows PowerShell 5.1 is not supported. Role: a member of the installation's SQL admin group (grp-pim-sql-admins) or a database user in the PIM database (-Apply: the database owner role, which the SQL admin group gives); Reader on the installation's subscription or resource group to find it; SQL Server Contributor (or Contributor) on the SQL server only when a temporary firewall rule is needed. Hosts: login.microsoftonline.com, management.azure.com, *.database.windows.net (port 1433), api.ipify.org (this machine's public address, unless -ClientIp is given) PERMISSIONS AND CHANGES (from Import-PimV1Data.ps1 manifest, PIM Manager 3.0.70; full page: https://invardia.com/docs/pim/scripts/Import-PimV1Data/) The person running it needs: - A member of the installation's SQL admin group (grp-pim-sql-admins), or a database user in the PIM database [other, the PIM database] -- Reads what PIM Manager already holds (the preview) and, with -Apply, adds the rows. -Apply needs the database owner role (db_owner), which the SQL admin group gives. The run checks this first and says plainly what is missing; a Privileged Role Administrator can add you to the group (it is role-assignable). - Reader [azureRbac, the installation's subscription or resource group] -- Finds the installation: the SQL server that holds the PIM database, its network setting, its administrator and its firewall rules. - SQL Server Contributor (or Contributor / Owner) [azureRbac, the PIM SQL server (or its resource group) -- only when this machine is not allowed through its firewall] -- Adds the temporary firewall rule for this machine's public address and removes it at the end of the run. - Your own browser sign-in, or the Invardia Support app's session in this window [other, the target tenant and subscription] -- A session of another tenant or subscription is refused. No Azure CLI, no PowerShell modules, no secret on the command line. What it creates, changes or grants: - create the rows of the version 1 files that PIM Manager does not have yet (pim.Rows, added by their natural key, one transaction per file) -- only with -Apply (The PIM database) @ the one PIM database (-Database, default PimPlatform) -- That is the import. A row whose key is already there with the same content is left alone; nothing is ever deleted. Undo: Delete the added rows in PIM Manager (each imported row shows there like any other), or restore the database from its point-in-time backup to before the run. - update a row whose key is already in PIM Manager with different content -- only with -Apply -OnKeyConflict Overwrite; without it a conflict stops the run before anything is written (KeepExisting keeps PIM Manager's row). Manager super admins and break-glass admins are never overwritten. (The PIM database) @ the one PIM database -- Lets you choose the file's version of a conflicting row explicitly, after the preview has listed every conflict. Undo: Restore the database from its point-in-time backup to before the run, or edit the rows back in PIM Manager. - create settings from the version 1 folder, each only when PIM Manager does not have it yet: the naming conventions you changed from the defaults (a value already changed in PIM Manager is kept), warning overrides, exemptions and workload exemptions -- only with -Apply; the PIM tables are made sure to exist first (an existing table is not changed) (The PIM database) @ the one PIM database (pim.Settings) -- The naming conventions are part of the version 1 data: the names your existing groups were built with. Undo: Change the settings back in PIM Manager (Settings). - create a temporary firewall rule 'PimV1Import-