Support

Setup scripts

Every script you run to set up, configure or repair PIM Manager or SecurityInsight. Each is one self-contained file that runs in any PowerShell (7, or Windows PowerShell 5.1) with nothing to install - no modules. Run the two lines shown: the first downloads the script, the second runs it. Each script has a documentation page: what it does, the rights it needs and every change it makes. Its SHA-256 is listed with it and in SHA256SUMS.txt.

Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.

All script documentation: PIM Manager · SecurityInsight ·Invardia. The Invardia Support app itself: remote support access(What does this script do?).

PIM Manager

• Deploy-PimActivatorBackend.ps1

  Creates or updates the PIM Activator app registration in your tenant (the sign-in app of the PIM Activator browser extension): its SPA redirect URIs, its delegated Microsoft Graph and Azure permissions, and tenant-wide admin consent for them. Every user of the tenant can sign in to the app ("Assignment required" is off); what a person can activate is decided by their PIM eligibility, not by this app.

  Documentation (purpose, who may run it, every change and permission, -WhatIf, undo): https://invardia.com/docs/pim/scripts/Deploy-PimActivatorBackend/ -WhatIf signs in, reads the tenant and prints every change it would make; it changes nothing.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Deploy-PimActivatorBackend.ps1 -OutFile Deploy-PimActivatorBackend.ps1
  .\Deploy-PimActivatorBackend.ps1 -TenantId <tenant-id> -Channel Released -DisplayName 'PIM Activator'

  Every parameter: Get-Help .\Deploy-PimActivatorBackend.ps1 -Full

  SHA-256 0b105a62f44d33a5ca6443c942c6c54727276e215560fd55672440f26996f9c3

• Deploy-PimActivatorClient.ps1

  Installs the PIM Activator browser extension on this machine (Edge, Chrome or both) through local Chromium enterprise policy in the registry -- force-install, install source, extension settings and the tenant catalog -- for servers and machines without Intune; -Uninstall removes only what it wrote.

  Documentation (purpose, who may run it, every change and permission, -WhatIf, undo): https://invardia.com/docs/pim/scripts/Deploy-PimActivatorClient/ -WhatIf reads the machine's current policies (and signs in only when the tenant catalog is auto-discovered) and prints every registry value it would set or remove; it writes nothing.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Deploy-PimActivatorClient.ps1 -OutFile Deploy-PimActivatorClient.ps1
  .\Deploy-PimActivatorClient.ps1

  Every parameter: Get-Help .\Deploy-PimActivatorClient.ps1 -Full

  SHA-256 094dab2d43e03c05292b03efd63bfb2f13864be9eb0dc187c1d6f334f038b903

• Deploy-PimHybridWorker.ps1

  PIM Manager hybrid worker (PIM for Active Directory): deploy it end to end with one command -- in Azure (a new Azure VM) or on your own on-premises Windows server that is Azure Arc-enabled.

  Deploys the PIM for Active Directory hybrid worker in the right order, step by step, and remembers where it got to so it can stop for the Active Directory step and continue later. It runs the worker's own scripts (tools\pim-hybrid-worker) in this order:

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Deploy-PimHybridWorker.ps1 -OutFile Deploy-PimHybridWorker.ps1
  .\Deploy-PimHybridWorker.ps1 -Target <Target> -SubscriptionId <SubscriptionId> -TenantId <TenantId> -SqlServerId <SqlServerId> -SourceContainerId <SourceContainerId> -AdDomain <AdDomain> -ComputerOu <ComputerOu> -GmsaOu <GmsaOu> -GroupsOu <GroupsOu>

  Every parameter: Get-Help .\Deploy-PimHybridWorker.ps1 -Full

  SHA-256 0af9f1e2f40032dc5db98114ca974c68588b8bac90bf82e4de4b124ee2e73c30

• Grant-PimEnginePermissions.ps1

  Give the PIM Manager engine identity the Microsoft Graph (and other API) application permissions and Azure role assignments it is missing. Run once, as a Global Administrator (or Privileged Role Administrator for the application permissions; Owner / User Access Administrator at the scope for an Azure role). -WhatIf shows every grant first and changes nothing.

  PIM Manager shows this command with your environment's exact values (Overview > permission check, and the Get Started step "Engine permissions"): the page itself is read-only on purpose -- an identity that can grant permissions could give itself anything.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Grant-PimEnginePermissions.ps1 -OutFile Grant-PimEnginePermissions.ps1
  .\Grant-PimEnginePermissions.ps1 -TenantId '<tenant id>' -EngineObjectId '<object id>' -GraphPermissions 'Group.ReadWrite.All','User.ReadWrite.All'

  Every parameter: Get-Help .\Grant-PimEnginePermissions.ps1 -Full

  SHA-256 8d3832e924b73355d63e6cd0a19c40460c0158be1909ef8f2be2b689ec4a430f

• Grant-PimSupportSqlAccess.ps1

  Gives the Invardia Support app its read-only access to the database of an existing PIM Manager installation: its own database user (created from the application's client id) in the read role pim_support_read, and the support access step that gives admin rights only inside an open support session. Run once per installation; -WhatIf shows it first.

  PIM REQUIREMENTS 100.116 (framework 4.1b, SECAUDIT-1a). A new installation does this by itself when a Support app is named. This script brings an EXISTING installation to the same state. It changes nothing else, and it leaves the SQL server's administrator and its firewall exactly as it found them.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Grant-PimSupportSqlAccess.ps1 -OutFile Grant-PimSupportSqlAccess.ps1
  .\Grant-PimSupportSqlAccess.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -ResourceGroup rg-pim -SqlServerName sql-pim-contoso -SupportAppId <Invardia Support app client id> -WhatIf

  Every parameter: Get-Help .\Grant-PimSupportSqlAccess.ps1 -Full

  SHA-256 c174e1f10afca8d8d7e1d08ce0e61f361719dc3d7b4683f931103636cd29ac63

• Import-PimV1Data.ps1

  Imports the data of a PIM version 1 installation (its CSV files and naming conventions) into an existing PIM Manager installation. By default it only checks and previews -- it writes nothing; -Apply adds the new rows by key, never deletes, and stops before writing anything when a row conflicts.

  V1-IMPORT-PUBLISHED. The person-facing wrapper around PIM Manager's own importer (Migrate-PimToSql.ps1, which runs the pre-import check engine\_shared\PIM-CsvImportCheck.ps1 and writes through the store's Merge-PimSqlEntityRows). Nothing of that logic is repeated here; this script finds the installation, signs you in, makes the network path for the run, and turns the importer's result into a plain list.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Import-PimV1Data.ps1 -OutFile Import-PimV1Data.ps1
  .\Import-PimV1Data.ps1 -SourcePath C:\PIM\config -TenantId <tenant id> -SubscriptionId <subscription id>

  Every parameter: Get-Help .\Import-PimV1Data.ps1 -Full

  SHA-256 5e88f699e1340eedede3937c87ffc28fee7fe4996769155e0c7acd41a672b424

• Initialize-PimHybridWorkerAd.ps1

  §80.2 PIMHYBRIDWRK -- the Active Directory half of the hybrid worker: its gMSA identities, the rights they need, the servers GPO, and (optionally) an offline domain-join blob for the worker VM.

  Prepares Active Directory for the PIM for Active Directory hybrid worker: its group managed service accounts, their least-privilege rights, the servers GPO and, for an Azure VM, the offline domain-join blob.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Initialize-PimHybridWorkerAd.ps1 -OutFile Initialize-PimHybridWorkerAd.ps1
  .\Initialize-PimHybridWorkerAd.ps1 -WorkerComputerName <WorkerComputerName> -ComputerOu <ComputerOu> -GmsaOu <GmsaOu> -GroupsOu <GroupsOu>

  Every parameter: Get-Help .\Initialize-PimHybridWorkerAd.ps1 -Full

  SHA-256 bf9d009f1fcf1d22c60dd6c0ee38cc2663f3b8d5f48a736c31d6f355d341e525

• Initialize-PimMailSender.ps1

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Initialize-PimMailSender.ps1 -OutFile Initialize-PimMailSender.ps1
  .\Initialize-PimMailSender.ps1 -TenantId <TenantId>

  Every parameter: Get-Help .\Initialize-PimMailSender.ps1 -Full

  SHA-256 7e8d17a5b1f0737584ef7c149664c8ced97ec5c9da7ed4d9beeeca94ee7bdef1

• Initialize-PimSqlAdminGroup.ps1

  Make a role-assignable security group (default grp-pim-sql-admins) the Microsoft Entra admin of a PIM Manager environment's Azure SQL server, with the environment's managed identities and the nightly updater as its members. The Invardia Support app is never added. One command, idempotent, every change read back; -WhatIf shows every change first. Signs in in the browser as the person running it (or, inside an Invardia support session, as the Invardia Support app), or uses a certificate identity from the repository -- never a client secret, no other tools or modules.

  Makes a security group (default 'grp-pim-sql-admins') the SQL server's Microsoft Entra admin, with these members: * the environment's user-assigned identity (id-pim-<token>; found in the resource group, or named) * the SQL identity id-pim-sql-<token>, when the environment has one (private SQL) * the nightly updater's system-assigned identity (ca-pim-update), when the job exists * the application a build runs as (-SetupIdentityAppId), for the length of that build * any -ExtraMemberObjectIds * the CURRENT admin, so converging never takes access away from whoever has it now The Invardia Support app is NOT a member: its one standing database right is its read-only database user (Grant-PimSupportAccess.ps1); admin rights only inside an open support session. Named with -SupportAppId or -SupportObjectId, it is not added and the run says so. A membership an earlier version gave is left as found. Entra-only authentication is left as it is and verified afterwards. Existing contained database users are not touched. Every change is read back; a second run reports no changes.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Initialize-PimSqlAdminGroup.ps1 -OutFile Initialize-PimSqlAdminGroup.ps1
  .\Initialize-PimSqlAdminGroup.ps1 -SubscriptionId <SubscriptionId> -ResourceGroup <ResourceGroup> -SqlServerName <SqlServerName>

  Every parameter: Get-Help .\Initialize-PimSqlAdminGroup.ps1 -Full

  SHA-256 440410cb3be56bc5e61151ddba7988a1db7fab917fe5b3ec8499cc84a1557ba7

• Initialize-PimWorkloadPrereqs.ps1

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Initialize-PimWorkloadPrereqs.ps1 -OutFile Initialize-PimWorkloadPrereqs.ps1
  .\Initialize-PimWorkloadPrereqs.ps1 -Workload <Workload> -TenantId <TenantId>

  Every parameter: Get-Help .\Initialize-PimWorkloadPrereqs.ps1 -Full

  SHA-256 e3df9140b17c2274a42fe74cb3a557a1d54fcd54b5760cb11bd76a4a872cd696

• Install-PimHybridWorker.ps1

  §80.2 PIMHYBRIDWRK -- configure the worker machine itself: an Azure VM, or (§100.63(b)) the customer's own on-premises Windows server that is Azure Arc-enabled. Run ON the worker, elevated (run-command runs it as SYSTEM on both).

  Installs and configures the PIM for Active Directory hybrid worker on the worker machine itself (an Azure VM or an Azure Arc-enabled on-premises server): the gMSAs, the PIM code for its update ring and the scheduled tasks.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Install-PimHybridWorker.ps1 -OutFile Install-PimHybridWorker.ps1
  .\Install-PimHybridWorker.ps1 -Phase Join -OdjBlob <base64>

  Every parameter: Get-Help .\Install-PimHybridWorker.ps1 -Full

  SHA-256 056ad3124e6c82876424222679fa49fc05b0b1c34a2c59b176e69bc5e2292a6c

• Invoke-PimSupportSqlAccessJob.ps1

  Gives the Invardia Support app its read-only database user on a PIM Manager installation whose database is private (public network access off), from inside: a one-time job in the installation's own environment runs the support access step (the user from the application's client id, in the read role pim_support_read only), the result is read back, and the job is removed. Nothing is opened; -WhatIf shows it first. With -SupportHours the database owner role is given for that many hours only (never above the level you consented to): the job stays, takes the role back at the end by itself, and the read-only access stays.

  PIM REQUIREMENTS 100.116 (framework 4.1b). On an installation with a public database, Grant-PimSupportSqlAccess.ps1 does this from the machine it runs on. A PRIVATE database has no route from outside, and none is made for this: no firewall rule, no public access, no jump host. The grant runs inside the installation's own network instead, and you -- the customer -- start it.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Invoke-PimSupportSqlAccessJob.ps1 -OutFile Invoke-PimSupportSqlAccessJob.ps1
  .\Invoke-PimSupportSqlAccessJob.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -ResourceGroup rg-pim -SupportAppId <Invardia Support app client id> -WhatIf

  Every parameter: Get-Help .\Invoke-PimSupportSqlAccessJob.ps1 -Full

  SHA-256 d1b58b76afa6869d7f202705883652fb444589eeca4f9892b32c4542c7920765

• New-PimHubPrepareScript.ps1

  Writes the script the hub network owner runs before (or during) a private PIM Manager installation: the hub side of the peering with exactly the name PIM setup looks for, optionally the rights for the deploy identity, and a check of both sides. It only writes a file; nothing in Azure is touched.

  Use it when the hub VNet belongs to another team or another subscription. Hand the written file to the hub owner; they run it with PowerShell 7 on any machine, with a browser sign-in as the hub owner -- no Azure CLI, no PowerShell modules, nothing to install, no other file; then continue the PIM install. Setup writes the same script by itself when it cannot create the hub side of the peering. The written file (prepare-hub-<name>.ps1) is ONE self-contained script that needs PowerShell 7; its help lists what the hub owner needs (the roles on the hub, the sign-in and Azure hosts it calls). Run without -Apply it only prints its plan; with -Apply it signs in (browser, the hub's tenant; a sign-in to another tenant is refused) and calls Azure Resource Manager directly: it creates the hub-side peering, and -- only when -DeployPrincipalObjectId is given -- grants that identity Network Contributor on the hub VNet (and Private DNS Zone Contributor on -DnsResourceGroup when that is given), and links the hub VNet to each zone in -PrivateDnsZoneName. It never deletes anything and is safe to run twice. -HubSubscriptionId is optional: empty = the hub is in the same subscription as the PIM network (-SpokeSubscriptionId). -TenantId is optional: empty = the written script finds the hub subscription's tenant when it runs.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/New-PimHubPrepareScript.ps1 -OutFile New-PimHubPrepareScript.ps1
  .\New-PimHubPrepareScript.ps1 -SpokeSubscriptionId <SpokeSubscriptionId> -SpokeResourceGroup <SpokeResourceGroup> -SpokeVnetName <SpokeVnetName> -HubResourceGroup <HubResourceGroup> -HubVnetName <HubVnetName>

  Every parameter: Get-Help .\New-PimHubPrepareScript.ps1 -Full

  SHA-256 fb69f87006f2059cb43884402d03415d7a422bc87d13f67a870dffb639fcf272

• Publish-PimActivatorRemediation.ps1

  Builds the PIM Activator Intune Remediation (Detect + Remediate) for your tenant and uploads it to Intune -- creates it, or updates it in place when a Remediation with the same name exists -- and assigns it to the one group you name (nobody otherwise).

  Documentation (purpose, who may run it, every change and permission, -WhatIf, undo): https://invardia.com/docs/pim/scripts/Publish-PimActivatorRemediation/ -WhatIf signs in, reads Intune and prints every change it would make; it uploads, assigns and writes nothing (the pair it would upload is built in the temp folder so you can read it).

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Publish-PimActivatorRemediation.ps1 -OutFile Publish-PimActivatorRemediation.ps1
  .\Publish-PimActivatorRemediation.ps1 -TenantId <TenantId> -ClientId <ClientId>

  Every parameter: Get-Help .\Publish-PimActivatorRemediation.ps1 -Full

  SHA-256 575832f63a8c3011704b0c6362a181d9da2b0b39506eecf10f6fe53b39494207

• Set-PimLicense.ps1

  Registers an issued PIM Manager licence in the environment's store: it verifies the signed licence document first, stores it as the License setting, reads it back and verifies it again; optionally stores the Invardia install key or queues its claim.

  IMP-42 -- import an issued PIM Manager licence into the store (pim.Settings['License']).

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Set-PimLicense.ps1 -OutFile Set-PimLicense.ps1
  .\Set-PimLicense.ps1 -LicensePath .\licence.pimlicense -SqlServer <server>.database.windows.net -TenantId <tenant id> -UseSignedInAccount -WhatIf

  Every parameter: Get-Help .\Set-PimLicense.ps1 -Full

  SHA-256 436ee1d75fd9e5af2df3533e8effcbe6d1b153c3a969b9d1c47d3ed023210daf

• Set-PimSigninFrontSqlState.ps1

  Give the sign-in front its place in a private PIM database.

  Gives the PIM Manager's sign-in front exactly what it needs in the PIM database: a database user for the front's managed identity, the schema 'signin' owned by it, and the right to create tables there. It never adds a role. -WhatIf shows it first; running it again changes nothing.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Set-PimSigninFrontSqlState.ps1 -OutFile Set-PimSigninFrontSqlState.ps1
  .\Set-PimSigninFrontSqlState.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> -SqlServerName sql-pim-contoso -IdentityName id-pim-contoso -IdentityClientId <client id> -WhatIf

  Every parameter: Get-Help .\Set-PimSigninFrontSqlState.ps1 -Full

  SHA-256 89f6f395eb7636babcb480286617a1614f19b7bd8ef1598c9878fadb0ae89660

• Set-PimSmtpRelayPassword.ps1

  Put the SMTP relay password of a PIM Manager environment into its Key Vault, and let the environment's managed identities read that one secret. -WhatIf shows every change first and asks for no password.

  Owner 2026-10-08: "remember i need to have 2 options: shared mailbox or smtp relay solution" / "we dont use certificates here, either interactive login or secret". In SMTP relay mode PIM Manager sends through System.Net.Mail with a user name and a password. 🔒 The password is NEVER in SQL, in the page or in a log: it is a secret in the environment's own Key Vault, read at send time by the environment's managed identities. PIM Manager's Settings > Mail & alerting writes it itself when its identity may; otherwise this script does, as a person who may (or as the Invardia Support app):

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Set-PimSmtpRelayPassword.ps1 -OutFile Set-PimSmtpRelayPassword.ps1
  .\Set-PimSmtpRelayPassword.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -VaultName <VaultName>

  Every parameter: Get-Help .\Set-PimSmtpRelayPassword.ps1 -Full

  SHA-256 d4c3cf438d00af14d53f7f95af08299e7609c4f5789415f09a14fe3a86aba6b2

• Set-PimSqlTier.ps1

  Set the PIM Manager SQL database to the right Standard tier with a 250 GB maximum size, and optionally pin its tier. -WhatIf shows the change first.

  Set the PIM Manager SQL database to the right Standard tier with a 250 GB maximum size, and optionally pin its tier so updates never change it.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Set-PimSqlTier.ps1 -OutFile Set-PimSqlTier.ps1
  .\Set-PimSqlTier.ps1 -SubscriptionId <subscription id> -ResourceGroup <resource group> -Server <sql server> -TenantId <tenant id> -WhatIf

  Every parameter: Get-Help .\Set-PimSqlTier.ps1 -Full

  SHA-256 0d43d2757d5c66b56765780f9a95dbb58fe4e42227c9c8fbc0616a1c16f39812

• Start-PimManagerInstall.ps1

  Install PIM Manager with one command: download the public PIM Manager release into a new folder, check the download, and run its guided installer (Install-PimManager) with the parameters you give. Two short lines: line 1 downloads this file from the public release, line 2 runs the install with your values.

  The ONE file a person downloads to install PIM Manager. It is a file of the public PIM Manager release on GitHub: line 1 downloads it, line 2 runs it with your values (see the examples). It: 1. checks that this file is the one published with its release -- a difference stops here, nothing is installed; 2. reads the public release from GitHub (the latest, or -Version), and downloads its zip into a NEW, empty folder in the temp folder; 3. checks the download against the release -- a difference stops here, the folder is removed and nothing is installed; 4. unpacks it and runs tools/setup/Install-PimManager.ps1 FROM that folder with exactly the parameters you gave (the same parameters as Install-PimManager; its help has the details), and ends with its exit code; 5. prints where the files are. -Resume uses that folder again (no new download) only when it holds the SAME edition and the same version this copy installs now; the folder is remembered per tenant and subscription in the temp folder. When it is gone (a new Cloud Shell session), or holds another edition or version, -Resume says so in one line and downloads the release again -- the installation's own progress is kept in its state folder, so it still continues where it stopped. -ReleasePath <folder> runs the installer from a release you already have (nothing is downloaded). The copy Invardia gives Pro and trial customers does steps 2-3 with Invardia instead of GitHub: you sign in in the browser (an administrator of -TenantId), it asks Invardia for the PIM Manager Pro package of your update ring for that tenant, checks that Invardia sealed it (its signed manifest) and the download's size and SHA-256 against it, and then runs the installer from it the same way. If Invardia cannot be reached or refuses, it says so in one line and installs nothing -- it never falls back to GitHub.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/pim/Start-PimManagerInstall.ps1 -OutFile Start-PimManagerInstall.ps1
  .\Start-PimManagerInstall.ps1 -TenantId '<tenant id>' -SubscriptionId '<subscription id>'

  Every parameter: Get-Help .\Start-PimManagerInstall.ps1 -Full

  SHA-256 f2d532d36411bb5cfecef829c97913c55b267bfbebb330f5a39e2572dff47c94

Checksums: SHA256SUMS.txt

SecurityInsight

• Clear-SIGuardEvents.ps1 · Pro

  Acknowledge every open guard event (safety check) in the Pro database: a fresh start. Previewed without -Apply.

  Operator 2026-10-07: "cna you clear the safety checks in my internal or close all/acknowledge all so i can start a fresh". This is the setup-script twin of Operations > Guards (safety checks) > "Acknowledge all": every OPEN guard event (one no acknowledgement covers -- its own, or one of exactly the same event: the same guard key and detail) is acknowledged with the SAME statement the web app's Acknowledge runs (cfg.GuardAck, one row per event; later repeats of exactly it are covered too), by 'setup: <reason>', and the run is written to the audit trail (guard.event.acknowledge, actor source 'setup').

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Clear-SIGuardEvents.ps1 -OutFile Clear-SIGuardEvents.ps1
  .\Clear-SIGuardEvents.ps1 -Reason <Reason>

  Sign-in: service principal + certificate (the install identity)

  Every parameter: Get-Help .\Clear-SIGuardEvents.ps1 -Full

  SHA-256 a96f87d07a7ef6cdfe089e9aaed2d2af2ae3f298dee9441d4e4ec74a157a7d5e

• Grant-SIIdentity.ps1 · Community

  Grant a managed identity (VM, Arc server or user-assigned), or an app registration by its client id, everything SecurityInsight reads with; prints present/missing, changes nothing without -Apply.

  Managed identity is the default sign-in (SI_AuthMethod = 'ManagedIdentity'). Container setup grants the job identity itself (Bootstrap-ContainerAppJob.ps1 -GrantIdentityRoles); this script does the same for the identity a VM or an Arc server runs as -- the SAME plan (container\_shared\SI-ContainerConfig.ps1, Get-SIContainerIdentityGrantPlan): * Reader on the collection scope(s) (default: the SI subscription) * Monitoring Metrics Publisher on the DCR resource group, Log Analytics Reader on the workspace(s) * the storage data roles on SI's own storage account * Key Vault Secrets User on the vault holding the Azure OpenAI / Shodan / SMTP secrets (-KeyVaultName) * the read-only application permissions (Microsoft Graph, Defender XDR, Defender for Endpoint) -AllowSchemaCreate also grants Monitoring Contributor on the DCR resource group and Log Analytics Contributor on the workspace, so the first run can create its own tables and data collection rules.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Grant-SIIdentity.ps1 -OutFile Grant-SIIdentity.ps1
  .\Grant-SIIdentity.ps1 -VmName vm-si -VmResourceGroup rg-si -KeyVaultName kv-si -AllowSchemaCreate -Apply

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Grant-SIIdentity.ps1 -Full

  SHA-256 1ebe1979307757bb4a89d5f492dd67240ad84f8336a5439b4ea8d2e8b3ee3d49

• Grant-SISupportAccess.ps1 · Community

  Give the customer's Invardia Support app the access only SecurityInsight can grant, or take it away (-Remove).

  THE PRODUCT DOES THIS NOW: the install's database setup job (caj-si-dbinit) makes the database part: the Invardia Support app's own database user (in the install's run, and a support repair, that names the Support app) as its own identity -- at the install and on every update -- so no person needs database admin rights for it. This script stays as a fallback: run it only when Invardia support asks for it.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Grant-SISupportAccess.ps1 -OutFile Grant-SISupportAccess.ps1
  .\Grant-SISupportAccess.ps1 -AppId <support app client id> -Level troubleshoot

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Grant-SISupportAccess.ps1 -Full

  SHA-256 583a312bd49990ff9973c890ef3a817d03e6be6884f5f433ec889aad11786586

• Grant-SIUpdaterDatabase.ps1 · Community

  ONE TIME: let the product updater (caj-si-updater) apply a release's database schema and grants.

  THE PRODUCT DOES THIS NOW: the install's database setup job (caj-si-dbinit) makes the updater's database user and its rights as its own identity -- at the install and on every update -- so no person needs database admin rights for it. This script stays as a fallback: run it only when Invardia support asks for it.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Grant-SIUpdaterDatabase.ps1 -OutFile Grant-SIUpdaterDatabase.ps1
  .\Grant-SIUpdaterDatabase.ps1 -SubscriptionId <SubscriptionId> -SqlServer <SqlServer> -SqlDatabase <SqlDatabase>

  Sign-in: browser sign-in (the SQL Entra admin)

  Every parameter: Get-Help .\Grant-SIUpdaterDatabase.ps1 -Full

  SHA-256 0582875258567ed5887cd8ddc79430a2c38b4fc58301586e55cfbc6e37476f7e

• Initialize-SIDataSql.ps1 · Community

  Prepare the Pro database for the data backend (schema sidata). Additive and idempotent.

  Applies sql\si-data-schema.sql (schema `sidata`: Run, Collection, Asset, AssetIdentifier, Finding, Recommendation, FindingDaily, VulnLifecycleDaily, FindingFacet, AssetTag, DepartmentFacet, the counted twins of the aggregates (#264) and the views vLatestCollection, vCurrentFinding, vCi, vExemptedFinding), then sql\si-cmdbsync-schema.sql (schema `cmdbsync`: the SQL CMDB connector's CI table, its identifiers, services, history and runs, and the view vConfigurationItem). Additive and idempotent: re-running changes nothing, and the file is checked for destructive statements before anything is sent. Run it again after an update that adds to the schema (the web app's collection views added columns to an existing install): the data sync says so when the columns it fills are missing.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Initialize-SIDataSql.ps1 -OutFile Initialize-SIDataSql.ps1
  .\Initialize-SIDataSql.ps1

  Sign-in: service principal + certificate (the install identity)

  Every parameter: Get-Help .\Initialize-SIDataSql.ps1 -Full

  SHA-256 d921e88ed720ad0ae2179b6fd2a2317e66f6af6903e2bbb7b04c6f0bd6967d85

• Initialize-SIVulnTargetSql.ps1 · Community

  Prepare a SQL database as the vulnerability close-loop's target (schema vuln). Additive and idempotent.

  Applies sql\si-vulnerability-target.sql (schema `vuln`: VulnerabilityItem + VulnerabilityEvent). Additive and idempotent: re-running changes nothing. Connects as the SI engine identity with its CERTIFICATE (Entra token), the same way the vulnerability sync does -- so a successful run here also proves the sync can reach the database.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Initialize-SIVulnTargetSql.ps1 -OutFile Initialize-SIVulnTargetSql.ps1
  .\Initialize-SIVulnTargetSql.ps1

  Sign-in: service principal + certificate (the install identity)

  Every parameter: Get-Help .\Initialize-SIVulnTargetSql.ps1 -Full

  SHA-256 82302f319c79e6897fd4a640119c294a2148bb5d458050ea971d7ab9edb0ec28

• Install-SecurityInsight.ps1 · Pro

  Install SecurityInsight Pro with two lines: signs you in once, downloads the Pro package of your update ring from Invardia, checks it and runs its installer with every parameter given.

  The ONE file a person downloads to install SecurityInsight (framework INSTALL-1). Runs in Azure Cloud Shell (PowerShell 7) and in PowerShell 7 or Windows PowerShell 5.1 on Windows. It needs no PowerShell module.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Install-SecurityInsight.ps1 -OutFile Install-SecurityInsight.ps1
  .\Install-SecurityInsight.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>

  Sign-in: browser sign-in (an admin) -- once: the installer takes it over -- or the Invardia Support app in a support session (-ViaSupportApp)

  Every parameter: Get-Help .\Install-SecurityInsight.ps1 -Full

  SHA-256 e49ec3564732c3c406225997f5fb5ff1ef88b5378baf4a0ea33e3bae05f45417

• Invoke-SIJobsOnce.ps1 · Community

  Run every Container Apps job of the install once, in pipeline order, and report each run.

  Reads the install's config (config/SecurityInsight.custom.ps1, without running it) for its subscription and resource group, lists the Container Apps jobs there and runs them the way the daily schedule would: jobs that start at the same time of day run together (in parallel), and each group waits for the one before it -- profilers before Risk Analysis, Risk Analysis before the trend. Each execution's outcome and duration is reported; exit code 1 when any run did not succeed (or did not finish within -TimeoutMinutes), 0 otherwise.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Invoke-SIJobsOnce.ps1 -OutFile Invoke-SIJobsOnce.ps1
  .\Invoke-SIJobsOnce.ps1

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Invoke-SIJobsOnce.ps1 -Full

  SHA-256 11f207f10fd71a93d9923dc2896847a43f3905f98e968a6b4bfed9cef2ca6599

• New-SIManagementAppRegistration.ps1 · Community

  Create or update the web app's sign-in application: its roles, its enterprise application with "assignment required" off (SecurityInsight decides who sees what), the people given a role. Plans by default; -Apply changes.

  One app registration serves both hosts: * the web app (Microsoft.Identity.Web, ID token only -- no client secret, no certificate, no credential at all); * the MCP server (JwtBearer: an access token for this app's API, carrying the Admin or Viewer app role).

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/New-SIManagementAppRegistration.ps1 -OutFile New-SIManagementAppRegistration.ps1
  .\New-SIManagementAppRegistration.ps1 -TenantId <tenant> -AdminUser admin@contoso.com

  Sign-in: browser sign-in (an administrator who may change the application), or the Invardia Support session

  Every parameter: Get-Help .\New-SIManagementAppRegistration.ps1 -Full

  SHA-256 7d027ab9917951e4bffd6bcdf1eebbb0783801c7ec6420a809e84acfc6670f70

• Request-SILicense.ps1 · Pro

  Ask Invardia for this install's SecurityInsight Pro licence, and install it once it is approved.

  The updater job does this on every update run. Run it by hand to ask now, to see where a request stands, or to ask again after a rejection:

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Request-SILicense.ps1 -OutFile Request-SILicense.ps1
  .\Request-SILicense.ps1

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Request-SILicense.ps1 -Full

  SHA-256 f21c496bb3f4508c60e755e5342851aa05ddb280e99d20b8baef010c69edca42

• Reset-SIData.ps1 · Pro

  A fresh start of the data: empties the data tables in place, keeps the configuration, users, grants and (unless -IncludeIdentityLedger) the identity ledger. Plans by default (rows and MB per table, what is kept); -Apply empties and reads back.

  For an install whose data should start again from nothing -- for example after a scope mistake collected objects that were never wanted -- while the customer does not use SecurityInsight yet. The scheduled pipeline fills the data again from the sources; nothing of the old data is kept.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Reset-SIData.ps1 -OutFile Reset-SIData.ps1
  .\Reset-SIData.ps1 -Reason <Reason>

  Sign-in: service principal + certificate (the install identity), or the Invardia Support session (-SupportSql)

  Every parameter: Get-Help .\Reset-SIData.ps1 -Full

  SHA-256 878055bb756a8230635b229887a1a5c5970d777cf5b5e8a32cb4b96db8d6da36

• Set-SICiCutoff.ps1 · Pro

  Set (or take back) the one-time CI cut-off: the CI build ignores records collected before it and retires the CIs built only from them. Plans by default (the CIs that would retire, whether data-out is on); -Apply writes.

  #1100 (owner 2026-11-04: "is it possible that we can do a one-time cut-off and then ignore older runs?" / "leave it as an hidden feature for customer to run from a script or through support app"). A HIDDEN feature: it is not a setting -- not in the settings catalog, not on the web Settings page, not over MCP. This script is the way to set it.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SICiCutoff.ps1 -OutFile Set-SICiCutoff.ps1
  .\Set-SICiCutoff.ps1 -Reason <Reason>

  Sign-in: service principal + certificate (the install identity), or the Invardia Support session (-SupportSql)

  Every parameter: Get-Help .\Set-SICiCutoff.ps1 -Full

  SHA-256 0ee990c58e3966680e3c5cfbb006e1593ab7e225cf9cac755422791dd4a5c98e

• Set-SIDisplayNames.ps1 · Community

  Give an existing install's applications and SQL admin group the names a new install gets (only from SecurityInsight's earlier default). Plan by default; -Apply renames.

  One naming convention for every Invardia product: "a short code in Azure, the full name where people read". Azure cannot rename a container app, a job, a managed identity, a SQL server, a Key Vault or a registry, so those keep their names. What CAN be renamed is renamed here, and ONLY from SecurityInsight's earlier default name (a name you chose is kept):

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SIDisplayNames.ps1 -OutFile Set-SIDisplayNames.ps1
  .\Set-SIDisplayNames.ps1 -ResourceGroupName rg-si-prod-pro-ca -SubscriptionId <sub>

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Set-SIDisplayNames.ps1 -Full

  SHA-256 c2aef19176138d533120e8a61a31fc7f074c1f223d0aef5425bca4a1e3efa412

• Set-SIInstallRing.ps1 · Community

  Record this install's update ring in the Pro database, so the web app shows it.

  The update ring is a property of the install, known when it is installed. This records it in the Pro database (cfg.InstallState 'Ring'); the web app's header shows it (UPDATE RING) from then on, also before the updater job has ever run. The guided install and Bootstrap-ContainerAppJob.ps1 run this for you; run it yourself for an install built another way, or to correct the ring.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SIInstallRing.ps1 -OutFile Set-SIInstallRing.ps1
  .\Set-SIInstallRing.ps1

  Sign-in: service principal + certificate (the install identity)

  Every parameter: Get-Help .\Set-SIInstallRing.ps1 -Full

  SHA-256 61748c3c2fbbcd75cd1942e175b83e4575b481252cd684220d76811a4b707d77

• Set-SIInstallTenant.ps1 · Community

  Read the tenant's own name from Entra ID and record it in the Pro database, so the web app's header shows it.

  The header shows the tenant this install serves by its NAME, beside its tenant id, as PIM Manager does. The name is never typed by hand: this reads the Entra organization through Microsoft Graph (GET /organization -- its display name and its onmicrosoft.com domain) and records both in the Pro database (cfg.InstallState 'Tenant'). The guided install and Bootstrap-ContainerAppJob.ps1 run this for you; run it yourself for an install built another way, or after the tenant was renamed.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SIInstallTenant.ps1 -OutFile Set-SIInstallTenant.ps1
  .\Set-SIInstallTenant.ps1

  Sign-in: browser sign-in (to read the tenant) + service principal + certificate (the install identity)

  Every parameter: Get-Help .\Set-SIInstallTenant.ps1 -Full

  SHA-256 00d3eb62e9e5a28c0e64450892f207362b48c588ad0bcfbd55f003d8e888a862

• Set-SILicense.ps1 · Pro

  Install a SecurityInsight Pro licence into the SecurityInsight Key Vault.

  SecurityInsight Pro reads its licence at run time from the Key Vault secret 'SI-License' in the vault Get-SIVaultName resolves (SI_KeyVaultName, or SpnKeyVaultName on an install that predates that name). Until now nothing put it there -- it was stored by hand, and a paying customer without it silently ran the free edition. This is how it gets there:

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SILicense.ps1 -OutFile Set-SILicense.ps1
  .\Set-SILicense.ps1 -Path .\contoso.silicense

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Set-SILicense.ps1 -Full

  SHA-256 32a3318e9477c2af9d431f4328351d49ac36e8947895a154974a778b9aa2ffa9

• Set-SIMail.ps1 · Community

  Set up how SecurityInsight sends mail: an Office 365 shared mailbox (created if asked; Mail.Send scoped to that mailbox only, verified) or your own SMTP relay. Plan by default; -Apply changes. For your Exchange administrator.

  ONE file, no PowerShell modules (native REST only), so it can be downloaded on its own and run by your Exchange administrator. PLAN BY DEFAULT: without -Apply it reads, prints what it would change and the exact commands, and changes nothing.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SIMail.ps1 -OutFile Set-SIMail.ps1
  .\Set-SIMail.ps1 -SharedMailbox securityinsight@contoso.com -ResourceGroup rg-si-prod-pro-ca -SubscriptionId <sub> -UseSignedInAccount

  Sign-in: browser sign-in (an Exchange administrator)

  Every parameter: Get-Help .\Set-SIMail.ps1 -Full

  SHA-256 4c2ed24e8a8c1632827b444381a9bbb68c017aa13b5610389200f63684212923

• Set-SIServiceNowCredential.ps1 · Pro

  Seed the ServiceNow instance URL and integration credential into the SecurityInsight Key Vault.

  🔒 Operator, 2026-08-31: *"use the keyvault for the SI instance, so it is captured into one SI keyvault."* This is how those three secrets get there.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SIServiceNowCredential.ps1 -OutFile Set-SIServiceNowCredential.ps1
  .\Set-SIServiceNowCredential.ps1 -Instance 'https://acme.service-now.com' -User 'si.integration'

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Set-SIServiceNowCredential.ps1 -Full

  SHA-256 c6222f2894d6a34992e97bb77c2e17565d56d6101602d90556dbcfa46f8fcdb4

• Set-SISqlAdminGroup.ps1 · Community

  Make grp-si-sql-admins the Pro SQL server's Entra admin, with SecurityInsight's identities as members.

  Operator rule 2026-10-03: "we need consistent naming ... one group per app and then the spn becomes member of that. this must be identically with any prod env". So the Pro SQL server's Entra admin is the group 'grp-si-sql-admins' (the same name in every environment and at every customer -- no environment or ring in it; PIM4EntraPS has 'grp-pim-sql-admins'), never an SPN or a person directly. Whoever administers the database -- the setup / management SPN, the Invardia Support app at setup level -- is a MEMBER of the group.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SISqlAdminGroup.ps1 -OutFile Set-SISqlAdminGroup.ps1
  .\Set-SISqlAdminGroup.ps1 -SqlServerName sql-si-prod-pro-ca -ResourceGroupName rg-si-prod-pro-ca

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Set-SISqlAdminGroup.ps1 -Full

  SHA-256 09f7a8cfde9cf9962ad520c03256876dce8aa5f0350a11f5ccff8beb3e05f93b

• Set-SIStorageSharedKey.ps1 · Community

  Show, or switch off, shared-key access on SecurityInsight's storage account after proving nothing uses a key.

  SecurityInsight reaches its storage account (the staging blobs, the cache tables, the shard queues) with its own identity only: the managed identity in a container, the app identity or a managed identity on a VM, each holding the Storage Blob / Queue / Table Data Contributor roles. A NEW install creates the account with shared-key access already OFF. An account created by an older release keeps it ON until you switch it off here -- nothing changes it automatically.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Set-SIStorageSharedKey.ps1 -OutFile Set-SIStorageSharedKey.ps1
  .\Set-SIStorageSharedKey.ps1 -Disable <Disable> -Enable <Enable>

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Set-SIStorageSharedKey.ps1 -Full

  SHA-256 5cab51a5b9c204f44b2f2be02eef50e3c4d578a7b4c90b39416ccdbd0f1f39cc

• Stop-SIRunAndUpdate.ps1 · Community

  Container install: stop the running pipeline run, confirm it stopped, then start the updater once and read the installed version back. Plan by default; -Apply acts.

  #1101 (owner 2026-11-04). A run that must not finish -- a hang, a run on the wrong release -- and an update that must land: cancelling the run and starting the updater at the same moment makes the updater find the run still going (the cancel takes minutes to stop the run's executions) and step aside. This script does it the one way that works:

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Stop-SIRunAndUpdate.ps1 -OutFile Stop-SIRunAndUpdate.ps1
  .\Stop-SIRunAndUpdate.ps1 -Reason <Reason>

  Sign-in: browser sign-in (an admin), or the Invardia Support app in a support session

  Every parameter: Get-Help .\Stop-SIRunAndUpdate.ps1 -Full

  SHA-256 7e2ada7a574b08758a6dd8bcd7c6529fa10460f634c225b3e4ee1b084baa43ad

• Switch-SIJobOrchestration.ps1 · Community

  Container install: switch between the daily job flow and one timer per job. Previewed; reversible.

  -Mode flow the jobs of the flow lose their own timer (Manual; the timer is remembered in the si-disabled-cron tag) and caj-si-flow gets the flow's start time: ONE start, each job when the one before it ended. -Mode schedules every job of the flow gets its timer back (the remembered one, or the shipped default in dependency order) and caj-si-flow waits (Manual, its time remembered). Without -Apply it only PRINTS what it would do. Switching back restores every remembered timer. A job outside the flow, an event-triggered (KEDA) job and the template job are never touched. A Pro install does the same from Operations > Jobs (the switch at the top), which also records the mode in the Pro database.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Switch-SIJobOrchestration.ps1 -OutFile Switch-SIJobOrchestration.ps1
  .\Switch-SIJobOrchestration.ps1 -Mode <Mode>

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Switch-SIJobOrchestration.ps1 -Full

  SHA-256 26480ce53e166fe3f586237da6c621b744694844ce2690e63dd81e795f39243f

• Test-SIInstall.ps1 · Community

  Read-only health check: tables, each engine's last run, the data collection rules, and the identity's rights. Exit 1 when anything is wrong.

  Reads the install's config (config/SecurityInsight.custom.ps1, without running it) and reports: 1. rows and the last time per SI table in the install's workspace (Log Analytics data plane) 2. run health per engine: the latest start and end, and how the last run ended (ExitReason) 3. the data collection rules in its resource group 4. ISOLATION -- the install's managed identity holds NO write role (Owner / Contributor / Monitoring Metrics Publisher / User Access Administrator / ...) outside its own resource group, except the grants SecurityInsight documents for it; and its data collection rule names are unique in the subscription (an engine that resolves a rule by name could otherwise send this install's data into another one) 5. the licence request (when the config names its Key Vault): none / requested / pending / approved / rejected, valid-to and the last check, from the state the updater keeps (SI-LicenceRequest-State; never the pull token). 6. updates (Pro, when the config names its Key Vault): the update source, the last manifest per kind (version, sequence, ring), the last check and any HOLD, from the state the updater keeps (SI-Update-State; never the install key). A refused manifest or an install key that could not be claimed is a finding; a hold is a note. A REJECTED request is wrong; a request's last problem is a note 6. a summary. Exit code 1 when anything is wrong, 0 otherwise.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Test-SIInstall.ps1 -OutFile Test-SIInstall.ps1
  .\Test-SIInstall.ps1

  Sign-in: browser sign-in (a reader) or the install identity

  Every parameter: Get-Help .\Test-SIInstall.ps1 -Full

  SHA-256 058362deb5579c67f0be91e65cf6eca691dbe05efbd37d456b3c24fbd4d5a664

• Validate-SIOpenAI.ps1 · Community

  Create or check the Azure OpenAI account and model deployment for the AI features.

  What does this script do? Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/si/Validate-SIOpenAI.ps1 -OutFile Validate-SIOpenAI.ps1
  .\Validate-SIOpenAI.ps1

  Sign-in: browser sign-in (an admin)

  Every parameter: Get-Help .\Validate-SIOpenAI.ps1 -Full

  SHA-256 e1b9a106b815044a2f2191e7748b8c0d054891ef7a06a8f874ea132df96143f1

Checksums: SHA256SUMS.txt

Entra Policy Suite

• Deploy-EpsAzureMonitorAlerts.ps1

  Deploys (or updates) Entra Policy Suite's EXTERNAL alarm in your Azure: an Azure Monitor rule set that keeps working even when the product does not (DESIGN §5.7a).

  Built from the product's own settings - the break-glass accounts of the break-glass module, the attributes of the enabled tag types, the engine's identity, the tamper monitor's allow list - so run it again after any of them change: the rules follow exactly the accounts in the module and an account that left takes its rules with it. It creates: the Entra diagnostic setting 'eps-entra-logs' (AuditLogs + sign-in logs -> the install's Log Analytics workspace) unless one already sends AuditLogs somewhere (that workspace is then used); the action group ag-eps-alarm (mail + SMS); the scheduled query rules eps-* (AuditLogs / SigninLogs / SecurityEvent data missing, Conditional Access policy changed, break-glass sign-ins and actions in Entra and AD, a watched tag changed by a foreign writer, the product's heartbeat stopped). You sign in in a browser; no module. -WhatIf shows the plan and changes nothing.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Deploy-EpsAzureMonitorAlerts.ps1 -OutFile Deploy-EpsAzureMonitorAlerts.ps1
  .\Deploy-EpsAzureMonitorAlerts.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -InputFile <InputFile>

  Every parameter: Get-Help .\Deploy-EpsAzureMonitorAlerts.ps1 -Full

  SHA-256 66a3e55b5c377bf32de1d4f7419eebba92138d983185e661925e7be9e7457253

• Grant-EpsEnginePermissions.ps1

  Gives the Entra Policy Suite engine identity (id-eps-engine) the Microsoft Graph permissions and the Exchange right it is missing - or takes one away with -Remove. Every grant is read back.

  The install grants the engine its rights once. Run this when a right is missing afterwards (an approver granted it later, a feature is switched on that needs it, the install ran as an account that could not grant it) or to take a right away that a feature no longer needs. Only the rights Entra Policy Suite declares for its engine can be granted - anything else is refused. -GraphPermission: the Graph application permissions (none given: every one the engine needs). -Exchange: the Exchange right of the recipient conditions - the application permission Exchange.ManageAsApp plus the Entra role Exchange Recipient Administrator. You sign in in a browser (no module). -WhatIf: the plan - what is there, what would be granted or removed - nothing changed. It prints per right: granted / already there / removed / not there / refused (with the reason), and exits 1 when anything was refused. A new grant reaches the engine's token within about 30 minutes.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Grant-EpsEnginePermissions.ps1 -OutFile Grant-EpsEnginePermissions.ps1
  .\Grant-EpsEnginePermissions.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>

  Every parameter: Get-Help .\Grant-EpsEnginePermissions.ps1 -Full

  SHA-256 5fa791d09dc3068c9d0a3276281c0f545c8903189d580715d7749687c7544085

• Grant-EpsHybridWorkerAccess.ps1

  Gives the hybrid worker's MANAGED IDENTITY access to the Entra Policy Suite database (or takes it away with -Remove).

  The worker signs in to SQL as its machine's managed identity (an Azure VM's, or an Azure Arc-enabled server's). This adds that identity to the database as the contained user 'eps-hybrid-worker' (WITH SID = its client id, never FROM EXTERNAL PROVIDER), in the role eps_worker only (sql/eps-grants.json: the work packages, its heartbeat, the AD group snapshots - framework §12.23, never db_datareader / db_datawriter). You sign in in a browser (no module). An install made since 2.0.59 does it through its database setup job: you need the right to start a job in the install's resource group, no database right; an older install needs you to be the SQL server's Entra admin. -WhatIf shows the T-SQL and runs nothing. The client id: Azure VM -> the VM's identity (portal: the VM > Identity); Arc -> the machine's enterprise application (Entra: Enterprise applications, the server's name) - its Application ID.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Grant-EpsHybridWorkerAccess.ps1 -OutFile Grant-EpsHybridWorkerAccess.ps1
  .\Grant-EpsHybridWorkerAccess.ps1 -TenantId <tenant> -SubscriptionId <sub> -WorkerClientId <client id> -WhatIf

  Every parameter: Get-Help .\Grant-EpsHybridWorkerAccess.ps1 -Full

  SHA-256 c4c115d536a91e3476fa8f515ebbc1788c904d5f67eb03f153942a1d666604c8

• Grant-EpsUpdaterPermissions.ps1

  Gives the Entra Policy Suite update identity (id-eps-updater) the Microsoft Graph permissions it is missing - or takes one away with -Remove. Every grant is read back.

  The install grants the update identity its rights once. The update job never grants itself a right, so run this when one is missing afterwards (the install ran as an account that could not grant it, or a release declares a new one). Only the rights Entra Policy Suite declares for its updater can be granted - anything else is refused: PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup and .Read.AzureADGroup, RoleManagementPolicy.Read.AzureADGroup (it keeps the database setup identity in the SQL admin group), GroupMember.Read.All and Application.Read.All (it reads them back) and Application.ReadWrite.OwnedBy (it keeps the web app's sign-in registration it owns as it should be). -GraphPermission: the permissions (none given: every one the updater needs). You sign in in a browser (no module). -WhatIf: the plan - what is there, what would be granted or removed - nothing changed. It prints per right: granted / already there / removed / not there / refused (with the reason), and exits 1 when anything was refused. A new grant reaches the update identity's token within about 30 minutes.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Grant-EpsUpdaterPermissions.ps1 -OutFile Grant-EpsUpdaterPermissions.ps1
  .\Grant-EpsUpdaterPermissions.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>

  Every parameter: Get-Help .\Grant-EpsUpdaterPermissions.ps1 -Full

  SHA-256 c9e39f34b8c5157d6616a9762b34827a029d642e8325d8983a09781dbbb744df

• Import-EpsV1Data.ps1

  Shows what a v1 Entra Policy Suite install's rules and settings become in Entra Policy Suite 2.0. Writes nothing.

  Reads a v1 folder - DATA\Identity_Tagging*.csv, Device_Tagging*.csv, EntraNamedLocations_AzureNetworkServiceTags.csv, Entra_Policy_Suite_custom.config, Entra_Policy_Suite_locked.config, and the attribute per tag type from Entra-Policy-Suite\Entra-ID-User-Tagging.ps1 - and shows the plan: the rule cards it makes (v1 rows with the same ConditionGroup become one card), the tag types and their values, the settings, break-glass accounts, admin units, target groups and service tags, and the HINTS on the rules (cloned rows that kept their ConditionGroup, a condition twice, a contradiction, an unknown condition type ...). This script never writes to the database (since 2.0.69 nobody needs a database right to import v1): the import is done in the web app - Overview > Import v1 (SuperAdmin): upload the same files, look at the plan, approve, and Entra Policy Suite writes it. -Apply prints those steps and the files to upload. The v1 folder is only read, never changed. Demo material (Identity_Tagging_Demo_Reset.csv, the demo scripts) is not read.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Import-EpsV1Data.ps1 -OutFile Import-EpsV1Data.ps1
  .\Import-EpsV1Data.ps1 -Path C:\SCRIPTS

  Every parameter: Get-Help .\Import-EpsV1Data.ps1 -Full

  SHA-256 1cec1791c598795aef44700cf4d0a8efc89508a99f252e8b4aa3dd8be5e39235

• Initialize-EpsHybridWorkerAd.ps1

  Delegates the Entra Policy Suite hybrid worker in Active Directory: the right to write EXACTLY the tag attributes you choose on user (and, for device tags, computer) objects - nothing else (DESIGN §6). Run once by a domain admin on a domain machine.

  The same way for every hybrid worker (framework HYBRID-AD-1): - every right goes to the group "<gMSA>-PermissionGroup" (the gMSA its ONLY member) - never to the gMSA itself; the group is made in the gMSA's own container when it is missing; - at the DOMAIN ROOT, inherited by descendant objects of the classes you name (users are spread over many OUs): one Allow ACE per attribute and class, WriteProperty on that attribute; - only the attributes you list (extensionAttribute1-15 - your tag attributes; anything else is refused); - protected accounts (Domain Admins and the like) only with -IncludeProtectedAccounts: the same right on AdminSDHolder. Plan first: without -Apply it shows every step and changes nothing. With -Apply it makes the changes and reads them back. -Remove takes exactly these rights away again (the group stays). No module: .NET System.DirectoryServices. The gMSA itself (and its <gMSA>-PrincipalsAllowedAccess group, the worker computers that may use it) is made beforehand by your AD admin; this script finds it by name.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Initialize-EpsHybridWorkerAd.ps1 -OutFile Initialize-EpsHybridWorkerAd.ps1
  .\Initialize-EpsHybridWorkerAd.ps1 -Gmsa 'gMSA-EPS-L1-T0' -Attributes extensionAttribute6, extensionAttribute7

  Every parameter: Get-Help .\Initialize-EpsHybridWorkerAd.ps1 -Full

  SHA-256 a1814facb242131b3ce96d823d8ed27e4cb8e4ecc11b397aabf86e630f1d2105

• Initialize-EpsLogAnalytics.ps1

  Sets up Entra Policy Suite's Log Analytics integration (v1: EPSIntegration): the identity report's users go to the custom table EntraUsersMetadata_CL, and the exposure lists are read back from it with the Entra sign-in logs.

  In the workspace you name, it makes (or completes) what v1 used: - the table EntraUsersMetadata_CL with v1's columns. A table v1 already made is kept: its columns keep their types, only missing columns are added, nothing is removed; - a data collection endpoint (or the one you name) and the data collection rule dcr-entra-EntraUsersMetadata_CL; - for the engine's managed identity, exactly two rights: 'Monitoring Metrics Publisher' on that one rule (to send the rows) and 'Log Analytics Reader' on that one workspace (to read the exposure lists). No tenant-wide right. Every step is read back. Then it stores the target in the Entra Policy Suite database (through the database setup job). It does NOT switch the upload on: a SuperAdmin does that in Settings > Identity report. Run it again after adding a user tag type, so the table gets that column. You sign in in a browser (no module). You need rights to create resources and role assignments on the workspace's resource group. -WhatIf: the plan only.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Initialize-EpsLogAnalytics.ps1 -OutFile Initialize-EpsLogAnalytics.ps1
  .\Initialize-EpsLogAnalytics.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -WorkspaceResourceId <WorkspaceResourceId>

  Every parameter: Get-Help .\Initialize-EpsLogAnalytics.ps1 -Full

  SHA-256 de9c9671013bd168f42929ca4e3f9c46965cde6d84c87e7e943e06bb94449522

• Initialize-EpsMailSender.ps1

  Sets up Entra Policy Suite's mail (framework MAIL-1): a shared mailbox the engine sends its alerts from - and the right to send as THAT mailbox only.

  Creates the shared mailbox (or uses the one you name), registers the engine's managed identity in Exchange, creates a management scope matching exactly that mailbox and gives the identity 'Application Mail.Send' on it - Exchange RBAC for applications, so the engine can send as this mailbox and as no other. A tenant-wide Graph Mail.Send grant on the identity is removed (it would win beside the scope). Every step is read back. Then it stores the mail settings (Mail.Mode = sharedMailbox, the sender, the recipients) in the Entra Policy Suite database. You sign in in a browser (no module). Needs an Exchange Online plan in the tenant. -WhatIf: the plan, nothing changed.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Initialize-EpsMailSender.ps1 -OutFile Initialize-EpsMailSender.ps1
  .\Initialize-EpsMailSender.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -Sender <Sender> -Recipients <Recipients>

  Every parameter: Get-Help .\Initialize-EpsMailSender.ps1 -Full

  SHA-256 16338c80463d598a4cccf2ff04adcd18f3ab7f03cd407e6fd55fd75121993c5f

• Install-EpsHybridWorker.ps1

  Installs the Entra Policy Suite hybrid worker on a domain-joined Windows server (an Azure VM or an Azure Arc-enabled on-premises server) - run ON the worker, elevated (DESIGN §6; one worker per product, D5).

  The worker writes the tags of AD-synced users in on-premises AD and reads AD group membership for the rules. It talks to Entra Policy Suite only through its SQL database, with the MACHINE's managed identity; nothing inbound, no password, no certificate, no gallery module (the in-box Windows ScheduledTasks module and icacls / secedit are used - owner-approved for the hybrid worker). AD is written AS THE gMSA you give (create it and delegate it first: Initialize-EpsHybridWorkerAd.ps1), and the worker's identity is given access to the database with Grant-EpsHybridWorkerAccess.ps1. It: copies the worker's code to <Root>\versions\<version> and points the junction <Root>\app at it (2.0.102); locks <Root> down (only SYSTEM and Administrators write the code the gMSA runs, the gMSA reads it and writes only <Root>\logs); writes <Root>\worker.json (the database, the worker's name - no secret); on an Arc server adds the gMSA to the local group 'Hybrid agent extension applications' (it reads the Arc agent's identity key); grants the gMSA 'Log on as a batch job'; registers the task 'EntraPolicySuite Hybrid Worker' (every 5 minutes, as the gMSA) and runs it once; registers the task 'EntraPolicySuite Hybrid Worker Update' (daily 05:30, as SYSTEM: Update-EpsHybridWorker.ps1 - the worker follows the version the install runs, only from Invardia's signed release, switched back automatically when the new version fails its self-test). -WhatIf: every step it would take, nothing changed. -Remove: the two tasks, the group membership, <Root>\app and <Root>\versions go (the logs stay; the gMSA, the machine and its domain membership are not touched). -AsGuestOf pim (owner 2026-10-30: "we must support both, in internal we reuse the pim hybrid worker"; framework §12.26 SHARED-WORKER): on PIM's worker HOST, never under PIM's identity - Entra Policy Suite's own gMSA, its own task (task folder \EPS\), its own root C:\EPS beside C:\PIM, its own USER-ASSIGNED managed identity (-ManagedIdentityClientId, required: the VM's system identity belongs to the host's product), and the guest registration file C:\ProgramData\HybridWorkerHost\guests\eps.json (PIM's remove refuses to delete the machine while it exists). Refused on an Azure Arc host (only the system identity exists there) and where PIM's worker is not installed.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Install-EpsHybridWorker.ps1 -OutFile Install-EpsHybridWorker.ps1
  .\Install-EpsHybridWorker.ps1 -GmsaName 'CORP\gmsa-eps$' -SqlServer sql-eps-1a2b3c4d.database.windows.net -WhatIf

  Every parameter: Get-Help .\Install-EpsHybridWorker.ps1 -Full

  SHA-256 774d7b427b26a4d0093ef917345642316baca4c1c19aa2a30f236051a39863a0

• Set-EpsWebAccess.ps1

  Names who may use the Entra Policy Suite web app: SuperAdmin, Admin or Reader. Used once to name the first SuperAdmin.

  The web app's access list (eps.WebAccess) is managed in the app itself by a SuperAdmin. When there is none - every SuperAdmin has left - this script names one: it starts the install's database setup job with that person (you need the right to start a job in the install's resource group, no database right); the job names a SuperAdmin only when there is none. An install made before 2.0.59 (no setup job) is changed directly, by a SQL administrator of the database. Anyone who signs in and is not named is a Reader. The change is written to the audit trail. You sign in in a browser (no module). -WhatIf: what it would write, nothing changed.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Set-EpsWebAccess.ps1 -OutFile Set-EpsWebAccess.ps1
  .\Set-EpsWebAccess.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId> -UserPrincipalName <UserPrincipalName> -Reason <Reason>

  Every parameter: Get-Help .\Set-EpsWebAccess.ps1 -Full

  SHA-256 463b67c29bffd5019447e850fda7aaf382af74c418bc31148ac1921eb21ec765

• Start-EpsInstall.ps1

  Downloads Entra Policy Suite 2.0 Pro - the signed Pro package from Invardia - and starts the install.

  You sign in in your browser to the tenant you install in; the launcher asks Invardia for the Pro package of your ring (or -Version), checks Invardia's signature and the size and SHA-256 it names (a mismatch deletes it and stops), unpacks it in a new temporary folder and runs its tools/setup/Install-EntraPolicySuite.ps1 with your parameters. Everything comes from Invardia. Run it in PowerShell 7 or Azure Cloud Shell: Invoke-WebRequest https://invardia.com/support/eps/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1 ./Start-EpsInstall.ps1 -TenantId <tenant id> -SubscriptionId <subscription id> Add -WhatIf at the end of line 2 to see the plan first (nothing is created in Azure). Exit code: the installer's (0 done, 1 a step failed, 2 a check failed, 4 waiting for a step of yours - run again when done), 3 = the download failed or did not match.

  What does this script do? (documentation out of date) Purpose, every permission and change, -WhatIf and undo.

  Invoke-WebRequest https://invardia.com/support/eps/Start-EpsInstall.ps1 -OutFile Start-EpsInstall.ps1
  .\Start-EpsInstall.ps1 -TenantId <TenantId> -SubscriptionId <SubscriptionId>

  Every parameter: Get-Help .\Start-EpsInstall.ps1 -Full

  SHA-256 f93eb5d9ec76d281555a21089043917480bed01841592a6fcf6582a4114af875

Checksums: SHA256SUMS.txt