Azure Automation Tutorial | Automate PowerShell execution
ฝัง
- เผยแพร่เมื่อ 11 พ.ย. 2019
- Azure Automation service is designed specifically to help with day to day operational challenges around process automation, configuration management and update management for both Azure and non-Azure environments. Join me and see what is this service all about.
In this episode I give you introduction to what Azure Automation service is and how can it solve your day to day operational challenges.
In a short demo I will show you how to
- Create automation account
- Manage and run notebooks
- Present different type of notebooks
- Manager permissions for service account
- Perform standard operational demo with Virtual Machine
- Update powershell modules
- Schedule execution of runbooks
Links from the video
- Update AzureRM modules docs.microsoft.com/en-us/azur...
- Update to Az modules docs.microsoft.com/en-us/azur...
Next steps for you after watching the video
1. Check Azure Automation documentation
- docs.microsoft.com/en-us/azur...
2. Want to learn more? Check Azure Friday video on Automation
- azure.microsoft.com/en-us/res...
Want to connect?
- Blog marczak.io/
- Twitter / marczakio
- Facebook / marczakio
- LinkedIn / adam-marczak
- Site azure4everyone.com - วิทยาศาสตร์และเทคโนโลยี
Dear all, fresh news landed Today! Python 3 is now supported on Azure Automation :)
azure.microsoft.com/en-us/updates/azure-automation-python-3-public-preview/?WT.mc_id=AZ-MVP-5003556
Does this mean your warning to avoid Python runbooks is now void? i.e. do you support use of Python 3 runbooks in Azure?
Hi Adam you are best teacher. If you don't mind then I want you also share slides in description for each lectures.Thanks
I am partial to Powershell; knowing Microsoft, they will support their own. I like the DSC here. Love it.
Awesome video! Very clear and practical introduction to Azure Automation. I especially loved the security tips regarding the default access of the run as accounts. Great job!
Glad you enjoyed it!
Thank you Adam. This is a goldmine of a channel!
My pleasure!
Thank you Adam for making this video! It provided all the key concepts about runbooks and I was able to create my first alert/runbook solution. Awesome!
As always, every topic from you Adam is very helpful. Thank you so much.
Excellent. Well explained. Better than majority I’ve already seen by miles. Subscribed
Thanks and welcome James :)
Superb Intro for Azure Automation !!!. I was trying to learn about how Azure automation account authenticates to subscription and resources. You explained it very well. Thanks very much.
You are most welcome, glad it was helpful 😁
Hi Adam,
I don't how , but anytime I am looking for any new thing in Azure. You have already explained it in a very elaborated manner.
Thankyou very much. Really appreciated 👍👍👍👍
Great to hear!
A great detailed explanation of this concept! Look forward to watching your other video's too.
Awesome, thank you!
Fantastic presentation , As always Adam your video are so simple to understand and full of useful Content . Many Thanks for your efforts.
Awesome! Very effective 30 minutes! Very well explained! Thank you very much!
You're welcome! Thanks!
Adam!! Thanks for this tutorial! That's what I was need it for run simple ps runbooks. Again-awesome work from you !:)
Happy to help! Thanks :)
Excellent presentation! Thank you Adam!
My pleasure!
Great demo. Would love to see it updated w/the new Advanced (Managed Identities) and Networking screens.
Commendable job done in explaining various aspects of Azure Automation service
Cheers!
That was super informative!! Thank you!
Simply Superb, Unfolded the doubts on RunBooks
:D Glad to hear that!
Awesome Intro for Azure Automation !!!
Cheers mate!
Nice video. Concise and precise
thank you for the share. Awesome job !
Thank you, this was very helpful! :-)
Thanks a lot, Adam. I learned a lot from your channel.
My pleasure!
Top notch video. Very helpful. Thank you very much.
Cheers, great to hear that!
Thank you so much really helps a lot. looking forward for more awesome videos.
More to come!
Well done! Gives a good overview!
Thank you :)
Thanks for this tutorial!
Glad it was helpful!
you kept my job in the company. so helpful
Hehe, thanks! Best of luck!
Excellent tutorial... i was actually looking for something where i can define start order of vms after azure migration. This should help. 👍
Thanks!
great video! thanks
Awesome explanation.🤗
Thank you 🙂
Typo on New slide 6:41 "Connecvitity". Excellent Video.
Ach! Darn it! I wish Visio was better at spellchecking.
Very very nice tutorials, Well done
Many thanks :)
Thank you very much for your awesome videos! Is there any chance to get such a thing like an execution context, to dynamically get the ressource group where the automation account exists in?
You are great sir. It helps alot.
It's my pleasure
Brilliant, thank you
You're very welcome! Thanks!
Adam I love you man
Awesome!
We now use Managed identity for authentication, which MSFT recommends to be the best option, rather than user-assigned RunAs account. Also, a lot has changed, obviously. With the managed service you don't have to do much of the lifting done with credentials, certificates, or variables. Makes it much simpler. If I may ask, what is your preferred method, RunAs account or Managed Identity?
I was about to thank you for de-mystifying this thing, but then I kept watching and it made me remember just how much I couldn't stand the bloated, overly complicated GUI. I will never bother to learn this because they will just make it obsolete in 3 years anyway and break all my stuff.
Hey Adam,
Thanks a lot for the great explanatory videos.
Can you please provide the complete topics of Azure Automation Runbooks with PowerShell.
Thanks. Maybe in the future, thanks for the idea :)
thank you very much Adam. this is excellent tutorial. I wish you have one vide that clearly shows how to use system managed identity to connect to Intune devices (Not AzureAD devices) including how to grant permission to the account like "DeviceManagementConfiguration.Read.All" etc .
very good tutorial
Many many thanks 😁
excellent explained
Glad you think so!
Thank you @Adam. This is a wonderful of a channel!
Above course, u shown us that how to schedule job with RunBook for shutting down a VM.
Can we also start a VM daily at specific time by scheduling job with RunBook at automation ?
Happy new year -2021 :)
Many Thanks,
Awesome, thank you kindly. You can do that too! But right now Virtual Machine tasks are in preview which makes this super easy with no coding! docs.microsoft.com/en-us/azure/logic-apps/create-automation-tasks-azure-resources?WT.mc_id=AZ-MVP-5003556
Awesome ... Thanks
Glad you liked it!
Adam you are great I love you
Thanks mate!
Adam! Great intro and very explained for Azure Automation. Have you done anything regarding Set notification for Azure AD Apps secrets and certificates expiration? Thank you very much
Cheers! No video on that subject just yet, I hope in future I can do this part time to release even more videos each week.
good video
Hi Adam, Thanks for the great video. I know its been a while since you created it but it looks like MS just updated the service to no longer recommend the RunAs approach. I am sure you are aware but I wanted to mention it in case you were not.
In 2022 there is a new step where you have to define the network connectivity and then an endpoint (if you select the recommended, private access). Do you have any advice about this step?
Adam, For a Graphical Powershell runbook the retry behavior is specified in the UI. For a pure Powershell based runbook, do we have to implement in the code to retry as many times (try/catch perhaps)?
Unfortunately not out of the box. You would have to run try catch with do while loop. There are some blogs around on this topic.
Hello Adam. Keep up the good work with your videos.
What is the best way to:
1. Have an automation for disable all azure guest users that have not login for 60 days? I have them all on a dynamic Group.
2. Is there any way to remove a user from azure group on specific date? Removal date may be different for any user upon the request.
Thanks in afvance
Please also post about Configuration mgmt, Update mgmt . thank you
I might. Thanks for watching!
Thank you very much Adam, wonder if we import powershell module, it will be the latest version, right?
Depends on how you do it. You can specify version, if you don't you will get a latest release version.
Thank you Adam,
Got it!
Another question: how to setup the alerts for the automation job output in Azure? Is there any video you can recommend?
Many thanks and wish you have a great day!
Sincerely,
Luke
Is there a way to get a warning for the expiration of the certificate used for the Azure RunAs Account
My update deployment is showing failed status with compliance and 2 kbs installed. I had created runbook as well and it's completed running as per deployment as well. Could you please help me troubleshoot this
Hi! It is possible login directly to azure using user and password creds in power shell run book?
Hi Adam, How do you automatically delete a VDI machine when a user hasn't logged in for 30 days?
Many thanks for the video, I recently worked a lot with Automation Accounts, one little remark:
ADD-AzureRMAccount will be depricated, use this instead:
try{
Write-Output "Connecting to Azure"
$ApplicationId = $servicePrincipalConnection.ApplicationId
$TenantId = $servicePrincipalConnection.TenantId
$CertificateThumbprint = $servicePrincipalConnection.CertificateThumbprint
Connect-AzAccount `
-ServicePrincipal `
-Tenant $TenantId `
-ApplicationId $ApplicationId `
-CertificateThumbprint $CertificateThumbprint
}
catch{
Write-Output "Connection to Azure failed"
}
For this you have to Update the Module for the Automation Account, you will need the Module Az.Accounts
adam thanks
my pleasure :)
Can you please update the video with new features in azure automation account ??
Hi Adam, question, do you have an idea on how I can access a file from azure virtual machine and save an output to azure blob using azure powershell?
You can you Invoke-AzVmRunCommand an from PowerShell or install agent for automation. Then using either of those upload to blob using PowerShell cmdlets.
nice
Cheers!
Can you further give example on how to update Az modules? The link you provided is a 404 error and I've been researching and so far haven't found what is required
Thanks for letting me know. Looks like Microsoft moved the article so link changed. Here is the updated one docs.microsoft.com/en-us/azure/automation/automation-update-azure-modules?WT.mc_id=AZ-MVP-5003556 but video is still valid, just run the script to update the modules :)
Does that mean that w/o "Create Azure Run as Account" option I cannot do it solely with Service Principal and Certificate added to it? Is the access to subscription required? I am trying to create a runbook that only needs access to "Sites", there will be no Azure management per se.
You can. Just store service principal info in the credentials/certs blades on the left hand side. Create run as account is just default option. Access depends on the type of the actions you will be executing. Check out MS guides on how RBAC roles work and what role will you need under what scope.
We need new video for manage system identity , as Runbook Accounts going to be depreciated.
Is Python 3 now available? Would I be able to run pandas or somehow install that library?
Unfortunately doesn't seem like MS will go into that direction. Python 2 is no longer support with no sight of Python 3 support, my hunch is this will be only PowerShell service in the future. If you want Python try Azure App Service/Functions or Azure Container Instances or even Databricks. Depending on your use case.
Hi, I have just set started and hit a brick wall. Does anyone know why if I am the owner of the resource, I would not be able to edit the canvas? I can create a runbook but I cannot edit the runbook.
I also cannot see any code on the example runbooks that are automatically created during the provisioning. I have tried changing browsers, checked permissions... I am simply stuck.
PS: script line numbering also doesn't appear, it's just a blank canvas
Hello Adam. Is there a wait to execute runbooks from PowerShell 7 in Visual Studio Code? . I tried running "Install-Module -Name AzureAutomationAuthoringToolkit" but it would not work. I even tried from ISE with PowerShell version 5.1.18362.1171 and it would not work.
If you need assistance with this package then you need to contact the authors. I never used this package so it’s hard to say if it makes the development easier. Azure Automation is just a windows machine with a script, if you have the same modules installed locally everything should work just fine. Then you can move the code or package it as a PowerShell module and upload to Azure Automation.
If you have to choose between your subscriptions, then is it possible to add them to the parameter and execute the script ?? And the automation account needs to be added to the contributor role to all the subscription to which it needs access Am i right ?
Well, it should get minimum permission to perform operation. But if it needs contributor then yes, although since this is quite big permission, I usually recommend custom roles. It's dangerous to have delete permissions on entire subscriptions in case a developer makes mistakes. Resource locks help with this as well. As to parameter, yes you can add it, or just use Select-AzSubscription to change current subscription.
@@AdamMarczakYT thanks a lot.... Your videos are awesome !!! Very useful
Thank you!
Please re do this video, since we are not using rm modules currently, and also this video is 2019 version and we are already at the end of 2022..
Azure Automation does not support Python 3, which is sad, as Python 2 is being phased out in 2020.
Yes, I mentioned this during the video. I strictly said that I don't recommend using Python notebooks. Thanks for commenting, it's valuable info in case someone missed it.
what if i have a new version of my code that i want to deploy automatically ?
Use git integration docs.microsoft.com/en-us/azure/automation/source-control-integration?WT.mc_id=AZ-MVP-5003556
@@AdamMarczakYT thank you so so much ❤❤❤
The fact that you've had to downgrade the RBAC for the application service principal only to limit it to the resource group indicate a problem that needs to be dealt with. But then again this is a 3 year old video - maybe they dealt with it by now!
Here you have demonstrated how to stop one machine. Difficulties might rise when you have to pull your configuration from the pull server in the Automation account, in the case where you're doing a DSC for example. For example: When you're managing a large number of machines it might be a problem if you have to set up RBAC for each machine. I guess this is the part where grouping comes in handy, am I correct? Or perhaps... you have other ideas or answer for this, haven't you?
Thanks
My channel was created 1y 8 months ago, so this video surely isn't 3 years old :) They didn't change that yet unfortunately, by default automation runas account will get high RBAC role on the entire sub. What you describe can be achieved in many ways, so it's up to a developer to decide. But it's powershell so anything can be done. As to RBAC, well this is access management already, so you set it up as you wish. If you want to manage all VMs on broader scope you can grant appropriate roles on the entire subscription or create scripts that grant permissions. Azure (like any other platform) on larger scale is all about automation.
@@AdamMarczakYT The video date states 2019, so it was me with terrible arithmetic processing moment, sorry about that. :) I have seen tutorials on how you can use variables to manage multiple resources. Perhaps that'd come in handy. In the Az-104 module they do not mention the need to delete the service principal though. But I can see why this might pause a problem in a production environment. I will keep looking into it. Thanks for a prompt response. Great job!
goodies
Thanks!
Are there no good videos on this subject in English?
Sorry to disappoint 🤷♂️
Hi Adam,
i am using hybrid worker in automation account but whenever i am trying to connect getting below error .
-----------------------------------------------------------------------------------------------------------------------------------------
Connect-AzAccount : No certificate was found in the certificate store with thumbprint
6B72EFE920D0E5076D2
At line:7 char:5
+ Connect-AzAccount `
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Connect-AzAccount], ArgumentException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand'
-----------------------------------------------------------------------------------------------------------------------------------------
Srcipt:-
----------------------------------------------------------------------------------------------------------------------
$connectionName = "AzureRunAsConnection"
try
{
# Get the connection "AzureRunAsConnection "
$servicePrincipalConnection=Get-AutomationConnection -Name $connectionName
"Logging in to Azure..."
Connect-AzAccount `
-ServicePrincipal `
-TenantId $servicePrincipalConnection.TenantId `
-ApplicationId $servicePrincipalConnection.ApplicationId `
-CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
}
catch {
if (!$servicePrincipalConnection)
{
$ErrorMessage = "Connection $connectionName not found."
throw $ErrorMessage
} else{
Write-Error -Message $_.Exception
throw $_.Exception
}
}
get-azvm
-----------------------------------------------------------------------------------------------------------------
i have installed az module on win 2016 and same machine working as a hybrid worker .
Can you suggest ?
You probably didn't select "Create RunAs account" when crating Automation Account. So there is no account set up. try this docs.microsoft.com/en-us/azure/automation/manage-runas-account?WT.mc_id=AZ-MVP-5003556