Support · Pro customers
Remote support access
When you ask us for help with deploying or troubleshooting PIM Manager or SecurityInsight, we connect to your tenant with an Invardia Support app that you create, own and control. We never connect unless you ask.
The Invardia Support app is only for easy troubleshooting and support.
You stay in control
- Your app, in your tenant. You create it (the script below does it in one go), you see every permission it has, and you can delete it at any time. Its name is the same in every tenant, so it is easy to spot in your sign-in logs: Invardia Support (an app created before October 2026 had a longer name; the next run of the script renames it).
- Access to the product's database. When you install or upgrade PIM Manager or SecurityInsight Pro, the product's setup can give the support app access to its own Azure SQL database (an Entra user or the SQL admin group) - only if you name the support app during setup.
- You decide how long the secret lives. By default it is valid 90 days. In the portal (Environments, the environment, Support app) you choose its lifetime and how it is renewed: Approval required (the default - you get an email weekly from 30 days before it ends and daily from 14 days; only if you approve do we replace it - if you do nothing, it is not replaced and our access simply ends), Automatic (we replace it ourselves 7 days before it ends, test the new one and only then remove the old one) or Off (never replaced; a notice 14 and 3 days before). A secret that lives under 7 days is never renewed. You choose how long the secret is valid with
-SecretDays: 1 to 730 days, 90 by default - for a one-off setup,-SecretDays 1. - Off when not needed. Disable the app (Microsoft Entra admin center > Enterprise applications > Invardia Support > Properties > Enabled for users to sign in = No, or
-Action Disable) and every grant is kept for next time, but nobody can sign in with it. - Only from our support IP. A Conditional Access policy blocks the app everywhere except Invardia's support host,
172.205.146.248. - Two access levels. Troubleshoot is read-only. Setup adds everything the products' setup scripts need to install, repair and upgrade without manual steps: Contributor and User Access Administrator on the subscription(s) you name, and - if you choose - User Access Administrator at your tenant root. That is owner-level access to those subscriptions, so keep the secret only in the portal and use the IP lock.
- Handed over securely. You store the secret in the customer portal. It goes straight to our Key Vault, is never shown again and never sent by email. You can replace or remove it, or delete the whole environment, at any time - and you get an email whenever Invardia changes anything.
- Audited on both sides. Every sign-in by the app is in your Microsoft Entra sign-in logs (Service principal sign-ins). Every use of the secret on our side is logged in our Key Vault.
Step by step
- Download the setup script New-InvardiaSupportApp.ps1 (the products' own setup and repair scripts are on Setup scripts) and read it; its SHA-256 is in SHA256SUMS.txt. What does this script do? lists every permission and change, -WhatIf and undo. Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt. It runs in PowerShell 7 (install it from https://aka.ms/powershell; Windows PowerShell 5.1 is refused) with nothing else to install: no modules. It opens the normal Microsoft sign-in page in your browser (MFA as usual) and then talks to Microsoft Graph and Azure directly.
- Run it as an administrator who can grant admin consent for Microsoft Graph application permissions (Privileged Role Administrator or Global Administrator) and, for the Azure roles, Owner or User Access Administrator on the subscription (and on the tenant root for
-TenantRoot):Invoke-WebRequest https://invardia.com/support/New-InvardiaSupportApp.ps1 -OutFile New-InvardiaSupportApp.ps1 .\New-InvardiaSupportApp.ps1 -TenantId <your tenant id> -Products PimManager,SecurityInsight -Access Setup -SubscriptionIds <subscription id> -TenantRoot -WhatIf
The first line downloads the script, the second previews what it would do (-WhatIfchanges nothing); then run the second line again without-WhatIf.-TenantRootgrants Reader at the tenant root, plus User Access Administrator there only when your organisation approves it (it is recorded in the Invardia portal).-Action RemoveTenantRootkeeps Reader and removes the User Access Administrator again, for example when your organisation withdraws the approval (nothing else changes). Run it again with-Access Troubleshoot(and without-SubscriptionIds) when you want read-only access: it removes what is no longer needed. Automation can run it unattended with-ClientIdand-CertificateThumbprint. - Store the details in the portal: portal.invardia.com > Remote support. Add one environment per tenant (for example Production and Test), paste the client id and secret, and add where each product lives (subscription, resource group, key vault ...).
- Open a support ticket and tell us which environment to look at. We connect only to that environment, from
172.205.146.248. - When we are done: remove the secret in the portal (or decline its renewal and let it expire), and disable the app until next time if you like.
Permissions: Troubleshoot (read only)
Microsoft Graph application permissions - what the products themselves read, so we see what they see:
| Permission | Needed for |
|---|---|
| Directory.Read.All | PIM Manager and SecurityInsight |
| Application.Read.All | PIM Manager and SecurityInsight |
| User.Read.All | PIM Manager and SecurityInsight |
| Group.Read.All | PIM Manager and SecurityInsight |
| RoleManagement.Read.All | PIM Manager and SecurityInsight |
| RoleManagementPolicy.Read.Directory | PIM Manager and SecurityInsight |
| RoleEligibilitySchedule.Read.Directory | PIM Manager and SecurityInsight |
| RoleAssignmentSchedule.Read.Directory | PIM Manager and SecurityInsight |
| PrivilegedAccess.Read.AzureADGroup | PIM Manager and SecurityInsight |
| Domain.Read.All | PIM Manager |
| AdministrativeUnit.Read.All | PIM Manager |
| AccessReview.Read.All | PIM Manager |
| RoleManagementPolicy.Read.AzureADGroup | PIM Manager |
| PrivilegedEligibilitySchedule.Read.AzureADGroup | PIM Manager |
| PrivilegedAssignmentSchedule.Read.AzureADGroup | PIM Manager |
| Device.Read.All | SecurityInsight |
| AuditLog.Read.All | SecurityInsight |
| Policy.Read.All | SecurityInsight |
| IdentityRiskyUser.Read.All | SecurityInsight |
| IdentityRiskEvent.Read.All | SecurityInsight |
| IdentityRiskyServicePrincipal.Read.All | SecurityInsight |
| ThreatHunting.Read.All | SecurityInsight |
| AdvancedHunting.Read.All | SecurityInsight (Microsoft Threat Protection API) |
| Machine.Read.All | SecurityInsight (WindowsDefenderATP API) - read only |
| Vulnerability.Read.All | SecurityInsight (WindowsDefenderATP API) - read only |
| Software.Read.All | SecurityInsight (WindowsDefenderATP API) - read only |
| SecurityRecommendation.Read.All | SecurityInsight (WindowsDefenderATP API) - read only |
Azure: Reader and Log Analytics Reader on the product's resource group(s); Key Vault Reader on the product's key vault (metadata only - no secret values).
Permissions: Setup (deploy, repair, upgrade)
Everything in Troubleshoot, plus:
| Microsoft Graph permission | Why | Product |
|---|---|---|
| Application.ReadWrite.All | Create and update the product's app registrations (sign-in, API and management apps) and rotate their credentials - also ones an earlier install created, which the support app does not own. | Both |
| AppRoleAssignment.ReadWrite.All | Give the product's managed identities their API permissions (admin consent). Microsoft has no narrower permission for this. | Both |
| DelegatedPermissionGrant.ReadWrite.All | Consent the product's user sign-in scopes for your tenant, so your admins can open the product. | Both |
| Group.Create | Create the security groups a product's setup needs (for example PIM Manager's SQL admin group). | Both |
| GroupMember.ReadWrite.All | Add and remove members of security groups during setup (for example a product's managed identities into the group a prerequisite names). This covers the members of any group that is not role-assignable - Microsoft has no narrower application permission. | Both |
| RoleManagement.ReadWrite.Directory | PIM Manager's SQL admin group is role-assignable (so only privileged admins can change who administers the database). Creating such a group and adding its members needs this permission - nothing narrower works for role-assignable groups. | PIM Manager |
| Azure role | Scope | Why |
|---|---|---|
| Contributor | the subscription(s) you name (-SubscriptionIds) | Create the product's own resource groups, register resource providers, and create, update and delete what the product deploys: network, container registry, Container Apps and jobs, SQL, storage, key vault, Log Analytics, managed identities. |
| User Access Administrator | the subscription(s) you name | Give the product's identities their roles (e.g. Reader on the subscription for its engine). |
| Reader | your tenant root management group - only with -TenantRoot | Read your Azure resources across the tenant for support. Kept by -Action RemoveTenantRoot. |
| User Access Administrator | your tenant root management group - only with -TenantRoot, and only when your organisation approves it (recorded in the Invardia portal) | Give SecurityInsight's engine Reader at the tenant root, when it collects from your whole tenant. -Action RemoveTenantRoot removes it again (Reader stays). |
| Contributor + Role Based Access Control Administrator with a condition | resource groups you name (-ResourceGroupIds, optional) | For a deployment limited to existing resource groups. The condition allows only the roles below, and only to service principals. |
| Key Vault Secrets Officer | the product's key vault | The product's licence, connector keys and its own credentials. |
| Key Vault Crypto Officer | PIM Manager Pro MSP managing tenant's key vault only | Create the baseline signing key once. |
| Network Contributor | the hub VNet only | Only if PIM Manager is peered to a hub VNet. |
Roles the condition allows: AcrPull, Reader, Log Analytics Reader, Monitoring Metrics Publisher, Contributor, Container Apps Jobs Operator, Storage Blob Data Contributor, Storage Queue Data Contributor, Storage Table Data Contributor, Key Vault Secrets User, Key Vault Reader, Cognitive Services OpenAI User.
Please be aware: AppRoleAssignment.ReadWrite.All lets an app grant API permissions, including to itself, and RoleManagement.ReadWrite.Directory (PIM Manager only) lets it assign Microsoft Entra roles. Both are tier 0 - as powerful as a privileged administrator. Microsoft has no narrower permissions for these steps, and deploying a product that manages privileged access needs them. With User Access Administrator on your subscriptions, Setup is owner-level access to them. That is why the IP lock, the short secret and the on/off switch matter.
How the products run day to day
The client secret above is only for the Invardia Support app, for setup and support. PIM Manager and SecurityInsight themselves run on a managed identity - on Azure Container Apps (preferred) or on a virtual machine - or, as an alternative, on a service principal with a certificate. Never on a client secret. Record which one in the portal (Remote support > product details > Runtime identity).
SecurityInsight reports a missing permission
SecurityInsight collects with its own managed identity (in the SecurityInsight resource group), which only reads. When one of its permissions is missing, the run log names it - [permissions] SecurityInsight's collection identity (<client id>) is missing <API> <permission> - and the data that permission feeds is incomplete until it is granted. All of them are read-only:
| API | Permissions | What SecurityInsight reads with them |
|---|---|---|
| Microsoft Graph | User.Read.All, Group.Read.All, Directory.Read.All, Device.Read.All, Application.Read.All, AuditLog.Read.All, Policy.Read.All, RoleManagement.Read.All, RoleManagement.Read.Directory, RoleManagementPolicy.Read.Directory, RoleEligibilitySchedule.Read.Directory, RoleAssignmentSchedule.Read.Directory, PrivilegedAccess.Read.AzureADGroup | Users, groups, devices, apps, sign-ins, Conditional Access, directory and PIM roles |
| Microsoft Graph | IdentityRiskyUser.Read.All, IdentityRiskEvent.Read.All, IdentityRiskyServicePrincipal.Read.All | Identity Protection risk |
| Microsoft Graph | ThreatHunting.Read.All | Advanced hunting |
| Microsoft Graph | UserAuthenticationMethod.Read.All | MFA and passwordless methods |
| Microsoft Graph | DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All | Intune devices and policies |
| Microsoft Graph | AccessReview.Read.All | Access reviews |
| Microsoft Graph | SecurityAlert.Read.All | Alerts |
| Microsoft Graph | SecurityEvents.Read.All | Secure Score and its controls |
| Microsoft Threat Protection | AdvancedHunting.Read.All | Advanced hunting in Defender |
| Defender for Endpoint | Machine.Read.All | Devices |
| Defender for Endpoint | Vulnerability.Read.All | CVEs per device |
| Defender for Endpoint | SecurityRecommendation.Read.All | Recommendations |
| Defender for Endpoint | Score.Read.All | Exposure score and secure score |
How it is fixed. With the Setup level, Invardia support runs SecurityInsight's own Grant-SIIdentity.ps1 for you: first a plan that lists what is present and what is missing and changes nothing, then it grants only what is missing from SecurityInsight's list - nothing else - and reads it back. Every step appears in your audit log in the customer portal. The next run uses the new permission; nothing needs a restart. To do it yourself instead (as a Privileged Role Administrator or Global Administrator):
Invoke-WebRequest https://invardia.com/support/si/Grant-SIIdentity.ps1 -OutFile Grant-SIIdentity.ps1
.\Grant-SIIdentity.ps1 -PrincipalId <the collection identity's object id> -SubscriptionId <its subscription id> -OnlyAppPermissions
.\Grant-SIIdentity.ps1 -PrincipalId <the collection identity's object id> -SubscriptionId <its subscription id> -OnlyAppPermissions -ApplyThe first line downloads the script, the second shows the plan, the third grants what is missing. Run the second line again afterwards: no line says MISSING.
Two database rights in SecurityInsight's Pro database. SecurityInsight's setup grants both, and an update adds them to an existing installation; Invardia support can also grant them through the Support app's database access:
| Identity | Right | What it is for | Run log when it is missing |
|---|---|---|---|
| The asset-tagging identity | INSERT on cfg.AuditEvent | Asset tagging writes its settings audit rows. | The INSERT permission was denied on the object 'AuditEvent' |
| The collection identity | VIEW DATABASE PERFORMANCE STATE | The engine reads the database's load to pace its writes and size its parallel workers. Without it nothing is lost; the work is slower. | VIEW DATABASE PERFORMANCE STATE permission denied |
What we never ask for
- Global Administrator or any other standing Microsoft Entra directory role.
- Owner, or any Azure role outside Setup; at the Setup level only the roles listed above, on the scopes you name.
Directory.ReadWrite.AllorMail.Send;Application.ReadWrite.AllandRoleManagement.ReadWrite.Directoryonly at the Setup level.Machine.ReadWrite.All(only if you want SecurityInsight's asset tagging, and then for the product itself, not for us).
What you do yourself (once)
With the Setup level the products' setup scripts do almost everything themselves (resource groups, resource providers, their identities' roles on your subscriptions and, with -TenantRoot, Reader at the tenant root). What is left for you (or your administrator), once:
- Run the setup script itself, which also grants admin consent for the support app (as a Privileged Role Administrator or Global Administrator).
- SecurityInsight: Log Analytics Reader for its engine on a Defender / Sentinel workspace in a subscription you did not name.
- Make the support app an owner of product app registrations and groups that already exist, and a member of the product's SQL server Entra admin group (Pro editions with Azure SQL).
- PIM Manager's mail sender: an Exchange administrator sets up the mailbox and its scoped send permission.
- Remove a resource lock, if one blocks a change.
Conditional Access: only from 172.205.146.248
With -ConditionalAccess the script creates a named location Invardia support IP (172.205.146.248/32) and a policy Invardia Support - only from Invardia support IP that blocks the app from everywhere else. To do it by hand: Microsoft Entra admin center > Protection > Conditional Access > New policy > Assignments: Workload identities = the Invardia Support app; Target resources = All resources; Conditions > Locations = Any location, exclude Invardia support IP; Grant = Block access.
Conditional Access for workload identities requires Microsoft Entra Workload ID Premium licences. Without them, keep the secret short-lived and disable the app between support cases.
Questions
Open a ticket in the customer portal or email support@invardia.com.