Azure Automation Tutorial | Automate PowerShell execution

Azure Automation service is designed specifically to help with day to day operational challenges around process automation, configuration management and update management for both Azure and non-Azure environments. Join me and see what is this service all about.
In this episode I give you introduction to what Azure Automation service is and how can it solve your day to day operational challenges.
In a short demo I will show you how to
- Create automation account
- Manage and run notebooks
- Present different type of notebooks
- Manager permissions for service account
- Perform standard operational demo with Virtual Machine
- Update powershell modules
- Schedule execution of runbooks
Links from the video
- Update AzureRM modules docs.microsoft.com/en-us/azur...
- Update to Az modules docs.microsoft.com/en-us/azur...
Next steps for you after watching the video
1. Check Azure Automation documentation
- docs.microsoft.com/en-us/azur...
2. Want to learn more? Check Azure Friday video on Automation
- azure.microsoft.com/en-us/res...
Want to connect?
- Blog marczak.io/
- Twitter / marczakio
- Facebook / marczakio
- LinkedIn / adam-marczak
- Site azure4everyone.com

[@AdamMarczakYT]

Dear all, fresh news landed Today! Python 3 is now supported on Azure Automation :) azure.microsoft.com/en-us/updates/azure-automation-python-3-public-preview/?WT.mc_id=AZ-MVP-5003556

[@marktheimmortal]

Does this mean your warning to avoid Python runbooks is now void? i.e. do you support use of Python 3 runbooks in Azure?

[@thomaslindh4080]

Hi Adam you are best teacher. If you don't mind then I want you also share slides in description for each lectures.Thanks

[@trwagner1]

I am partial to Powershell; knowing Microsoft, they will support their own. I like the DSC here. Love it.

[@Southpaw07]

Thank you Adam for making this video! It provided all the key concepts about runbooks and I was able to create my first alert/runbook solution. Awesome!

[@asmarfontenot1313]

Awesome video! Very clear and practical introduction to Azure Automation. I especially loved the security tips regarding the default access of the run as accounts. Great job!

[@AdamMarczakYT]

Glad you enjoyed it!

[@fixit3111]

Thank you Adam. This is a goldmine of a channel!

[@AdamMarczakYT]

My pleasure!

[@icici321]

Superb Intro for Azure Automation !!!. I was trying to learn about how Azure automation account authenticates to subscription and resources. You explained it very well. Thanks very much.

[@AdamMarczakYT]

You are most welcome, glad it was helpful 😁

[@roycerenzogaleos9977]

As always, every topic from you Adam is very helpful. Thank you so much.

[@ankitarora4521]

A great detailed explanation of this concept! Look forward to watching your other video's too.

[@AdamMarczakYT]

Awesome, thank you!

[@James-sc1lz]

Excellent. Well explained. Better than majority I’ve already seen by miles. Subscribed

[@AdamMarczakYT]

Thanks and welcome James :)

[@deepakkumar-cl6hs]

Fantastic presentation , As always Adam your video are so simple to understand and full of useful Content . Many Thanks for your efforts.

[@geeks_football5751]

Hi Adam, I don't how , but anytime I am looking for any new thing in Azure. You have already explained it in a very elaborated manner. Thankyou very much. Really appreciated 👍👍👍👍

[@AdamMarczakYT]

Great to hear!

[@ljunq]

Great demo. Would love to see it updated w/the new Advanced (Managed Identities) and Networking screens.

[@vishrutisharma3973]

Commendable job done in explaining various aspects of Azure Automation service

[@AdamMarczakYT]

Cheers!

[@TheMLaskowsky]

Adam!! Thanks for this tutorial! That's what I was need it for run simple ps runbooks. Again-awesome work from you !:)

[@AdamMarczakYT]

Happy to help! Thanks :)

[@patrickbrodeur7466]

Awesome! Very effective 30 minutes! Very well explained! Thank you very much!

[@AdamMarczakYT]

You're welcome! Thanks!

[@jairamashish6930]

Simply Superb, Unfolded the doubts on RunBooks

[@AdamMarczakYT]

:D Glad to hear that!

[@phevos_sk]

That was super informative!! Thank you!

[@hassy9118]

Excellent presentation! Thank you Adam!

[@AdamMarczakYT]

My pleasure!

[@balanm8570]

Awesome Intro for Azure Automation !!!

[@AdamMarczakYT]

Cheers mate!

[@pkz001]

Thank you so much really helps a lot. looking forward for more awesome videos.

[@AdamMarczakYT]

More to come!

[@dchan5251]

thank you for the share. Awesome job !

[@STICCite]

Nice video. Concise and precise

[@praveenravela85]

you kept my job in the company. so helpful

[@AdamMarczakYT]

Hehe, thanks! Best of luck!

[@krimblikrambli]

Well done! Gives a good overview!

[@AdamMarczakYT]

Thank you :)

[@venkatx5]

Typo on New slide 6:41 "Connecvitity". Excellent Video.

[@AdamMarczakYT]

Ach! Darn it! I wish Visio was better at spellchecking.

[@rizwan4701798]

Thanks a lot, Adam. I learned a lot from your channel.

[@AdamMarczakYT]

My pleasure!

[@550891]

thank you very much Adam. this is excellent tutorial. I wish you have one vide that clearly shows how to use system managed identity to connect to Intune devices (Not AzureAD devices) including how to grant permission to the account like "DeviceManagementConfiguration.Read.All" etc .

[@sohilprasalla1733]

Thank you, this was very helpful! :-)

[@manikaggarwal897]

Excellent tutorial... i was actually looking for something where i can define start order of vms after azure migration. This should help. 👍

[@AdamMarczakYT]

Thanks!

[@SQLTalk]

Top notch video. Very helpful. Thank you very much.

[@AdamMarczakYT]

Cheers, great to hear that!

[@shadychim]

Very very nice tutorials, Well done

[@AdamMarczakYT]

Many thanks :)

[@ftlight2362]

great video! thanks

[@ifeomaudeozo6978]

Awesome explanation.🤗

[@AdamMarczakYT]

Thank you 🙂

[@BijouBakson]

We now use Managed identity for authentication, which MSFT recommends to be the best option, rather than user-assigned RunAs account. Also, a lot has changed, obviously. With the managed service you don't have to do much of the lifting done with credentials, certificates, or variables. Makes it much simpler. If I may ask, what is your preferred method, RunAs account or Managed Identity?

[@robertbarkovicz800]

Thank you very much for your awesome videos! Is there any chance to get such a thing like an execution context, to dynamically get the ressource group where the automation account exists in?

[@rajatbhawsar2750]

You are great sir. It helps alot.

[@AdamMarczakYT]

It's my pleasure

[@lashlarue7924]

I was about to thank you for de-mystifying this thing, but then I kept watching and it made me remember just how much I couldn't stand the bloated, overly complicated GUI. I will never bother to learn this because they will just make it obsolete in 3 years anyway and break all my stuff.

[@guappgetter5327]

Adam I love you man

[@GautamThakur]

Thanks for this tutorial!

[@AdamMarczakYT]

Glad it was helpful!

[@prathe4u]

Awesome!

[@ash3rr]

In 2022 there is a new step where you have to define the network connectivity and then an endpoint (if you select the recommended, private access). Do you have any advice about this step?

[@TradeWithScence]

excellent explained

[@AdamMarczakYT]

Glad you think so!

[@mariyammarsha4851]

Is there a way to get a warning for the expiration of the certificate used for the Azure RunAs Account

[@ramyananduri2785]

My update deployment is showing failed status with compliance and 2 kbs installed. I had created runbook as well and it's completed running as per deployment as well. Could you please help me troubleshoot this

[@marsrover7952]

Brilliant, thank you

[@AdamMarczakYT]

You're very welcome! Thanks!

[@rameshm2771]

Hey Adam, Thanks a lot for the great explanatory videos. Can you please provide the complete topics of Azure Automation Runbooks with PowerShell.

[@AdamMarczakYT]

Thanks. Maybe in the future, thanks for the idea :)

[@luciosantos6659]

Hi! It is possible login directly to azure using user and password creds in power shell run book?

[@ericpietroski6055]

Hi Adam, Thanks for the great video. I know its been a while since you created it but it looks like MS just updated the service to no longer recommend the RunAs approach. I am sure you are aware but I wanted to mention it in case you were not.

[@vaibhavrana4953]

very good tutorial

[@AdamMarczakYT]

Many many thanks 😁

[@santoshsavakar9764]

Hi Adam, How do you automatically delete a VDI machine when a user hasn't logged in for 30 days?

[@manjeetsinghutube]

Awesome ... Thanks

[@AdamMarczakYT]

Glad you liked it!

[@jimmysr6]

Hello Adam. Keep up the good work with your videos. What is the best way to: 1. Have an automation for disable all azure guest users that have not login for 60 days? I have them all on a dynamic Group. 2. Is there any way to remove a user from azure group on specific date? Removal date may be different for any user upon the request. Thanks in afvance

[@AmitSharma-ql5nr]

good video

[@ganirban82]

Thank you @Adam. This is a wonderful of a channel! Above course, u shown us that how to schedule job with RunBook for shutting down a VM. Can we also start a VM daily at specific time by scheduling job with RunBook at automation ? Happy new year -2021 :) Many Thanks,

[@AdamMarczakYT]

Awesome, thank you kindly. You can do that too! But right now Virtual Machine tasks are in preview which makes this super easy with no coding! docs.microsoft.com/en-us/azure/logic-apps/create-automation-tasks-azure-resources?WT.mc_id=AZ-MVP-5003556

[@SajjadKhan-BSK]

We need new video for manage system identity , as Runbook Accounts going to be depreciated.

[@Wintersun729]

Many thanks for the video, I recently worked a lot with Automation Accounts, one little remark: ADD-AzureRMAccount will be depricated, use this instead: try{ Write-Output "Connecting to Azure" $ApplicationId = $servicePrincipalConnection.ApplicationId $TenantId = $servicePrincipalConnection.TenantId $CertificateThumbprint = $servicePrincipalConnection.CertificateThumbprint Connect-AzAccount ` -ServicePrincipal ` -Tenant $TenantId ` -ApplicationId $ApplicationId ` -CertificateThumbprint $CertificateThumbprint } catch{ Write-Output "Connection to Azure failed" } For this you have to Update the Module for the Automation Account, you will need the Module Az.Accounts

[@Ravishankar_RS]

Can you please update the video with new features in azure automation account ??

[@gopinathrajee]

Adam, For a Graphical Powershell runbook the retry behavior is specified in the UI. For a pure Powershell based runbook, do we have to implement in the code to retry as many times (try/catch perhaps)?

[@AdamMarczakYT]

Unfortunately not out of the box. You would have to run try catch with do while loop. There are some blogs around on this topic.

[@AkshayKumar-re3bf]

Please re do this video, since we are not using rm modules currently, and also this video is 2019 version and we are already at the end of 2022..

[@77zishan]

Adam you are great I love you

[@AdamMarczakYT]

Thanks mate!

[@amritarora8897]

Please also post about Configuration mgmt, Update mgmt . thank you

[@AdamMarczakYT]

I might. Thanks for watching!

[@tyrionlannister9278]

Hi Adam, question, do you have an idea on how I can access a file from azure virtual machine and save an output to azure blob using azure powershell?

[@AdamMarczakYT]

You can you Invoke-AzVmRunCommand an from PowerShell or install agent for automation. Then using either of those upload to blob using PowerShell cmdlets.

[@lekkerek]

Hi, I have just set started and hit a brick wall. Does anyone know why if I am the owner of the resource, I would not be able to edit the canvas? I can create a runbook but I cannot edit the runbook. I also cannot see any code on the example runbooks that are automatically created during the provisioning. I have tried changing browsers, checked permissions... I am simply stuck.

[@lekkerek]

PS: script line numbering also doesn't appear, it's just a blank canvas

[@nosferkg]

Does that mean that w/o "Create Azure Run as Account" option I cannot do it solely with Service Principal and Certificate added to it? Is the access to subscription required? I am trying to create a runbook that only needs access to "Sites", there will be no Azure management per se.

[@AdamMarczakYT]

You can. Just store service principal info in the credentials/certs blades on the left hand side. Create run as account is just default option. Access depends on the type of the actions you will be executing. Check out MS guides on how RBAC roles work and what role will you need under what scope.

[@benkeitly6402]

Adam! Great intro and very explained for Azure Automation. Have you done anything regarding Set notification for Azure AD Apps secrets and certificates expiration? Thank you very much

[@AdamMarczakYT]

Cheers! No video on that subject just yet, I hope in future I can do this part time to release even more videos each week.

[@mosbys7062]

Can you further give example on how to update Az modules? The link you provided is a 404 error and I've been researching and so far haven't found what is required

[@AdamMarczakYT]

Thanks for letting me know. Looks like Microsoft moved the article so link changed. Here is the updated one docs.microsoft.com/en-us/azure/automation/automation-update-azure-modules?WT.mc_id=AZ-MVP-5003556 but video is still valid, just run the script to update the modules :)

[@wallycall]

Is Python 3 now available? Would I be able to run pandas or somehow install that library?

[@AdamMarczakYT]

Unfortunately doesn't seem like MS will go into that direction. Python 2 is no longer support with no sight of Python 3 support, my hunch is this will be only PowerShell service in the future. If you want Python try Azure App Service/Functions or Azure Container Instances or even Databricks. Depending on your use case.

[@johnramz]

Hello Adam. Is there a wait to execute runbooks from PowerShell 7 in Visual Studio Code? . I tried running "Install-Module -Name AzureAutomationAuthoringToolkit" but it would not work. I even tried from ISE with PowerShell version 5.1.18362.1171 and it would not work.

[@AdamMarczakYT]

If you need assistance with this package then you need to contact the authors. I never used this package so it’s hard to say if it makes the development easier. Azure Automation is just a windows machine with a script, if you have the same modules installed locally everything should work just fine. Then you can move the code or package it as a PowerShell module and upload to Azure Automation.

[@lukehuang4467]

Thank you very much Adam, wonder if we import powershell module, it will be the latest version, right?

[@AdamMarczakYT]

Depends on how you do it. You can specify version, if you don't you will get a latest release version.

[@lukehuang4467]

Thank you Adam, Got it! Another question: how to setup the alerts for the automation job output in Azure? Is there any video you can recommend? Many thanks and wish you have a great day! Sincerely, Luke

[@hercules1943]

adam thanks

[@AdamMarczakYT]

my pleasure :)

[@ramyahello]

If you have to choose between your subscriptions, then is it possible to add them to the parameter and execute the script ?? And the automation account needs to be added to the contributor role to all the subscription to which it needs access Am i right ?

[@AdamMarczakYT]

Well, it should get minimum permission to perform operation. But if it needs contributor then yes, although since this is quite big permission, I usually recommend custom roles. It's dangerous to have delete permissions on entire subscriptions in case a developer makes mistakes. Resource locks help with this as well. As to parameter, yes you can add it, or just use Select-AzSubscription to change current subscription.

[@ramyahello]

@@AdamMarczakYT thanks a lot.... Your videos are awesome !!! Very useful

[@AdamMarczakYT]

Thank you!

[@h-s7218]

what if i have a new version of my code that i want to deploy automatically ?

[@AdamMarczakYT]

Use git integration docs.microsoft.com/en-us/azure/automation/source-control-integration?WT.mc_id=AZ-MVP-5003556

[@h-s7218]

@@AdamMarczakYT thank you so so much ❤❤❤

[@abdulthakur5608]

nice

[@AdamMarczakYT]

Cheers!

[@nikhilkenvetil1594]

Azure Automation does not support Python 3, which is sad, as Python 2 is being phased out in 2020.

[@AdamMarczakYT]

Yes, I mentioned this during the video. I strictly said that I don't recommend using Python notebooks. Thanks for commenting, it's valuable info in case someone missed it.

[@AlbionSupreme]

Are there no good videos on this subject in English?

[@AdamMarczakYT]

Sorry to disappoint 🤷‍♂️

[@vijaygupta0842]

Hi Adam, i am using hybrid worker in automation account but whenever i am trying to connect getting below error . ----------------------------------------------------------------------------------------------------------------------------------------- Connect-AzAccount : No certificate was found in the certificate store with thumbprint 6B72EFE920D0E5076D2 At line:7 char:5 + Connect-AzAccount ` + ~~~~~~~~~~~~~~~~~~~ + CategoryInfo : CloseError: (:) [Connect-AzAccount], ArgumentException + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand' ----------------------------------------------------------------------------------------------------------------------------------------- Srcipt:- ---------------------------------------------------------------------------------------------------------------------- $connectionName = "AzureRunAsConnection" try { # Get the connection "AzureRunAsConnection " $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName "Logging in to Azure..." Connect-AzAccount ` -ServicePrincipal ` -TenantId $servicePrincipalConnection.TenantId ` -ApplicationId $servicePrincipalConnection.ApplicationId ` -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint } catch { if (!$servicePrincipalConnection) { $ErrorMessage = "Connection $connectionName not found." throw $ErrorMessage } else{ Write-Error -Message $_.Exception throw $_.Exception } } get-azvm ----------------------------------------------------------------------------------------------------------------- i have installed az module on win 2016 and same machine working as a hybrid worker . Can you suggest ?

[@AdamMarczakYT]

You probably didn't select "Create RunAs account" when crating Automation Account. So there is no account set up. try this docs.microsoft.com/en-us/azure/automation/manage-runas-account?WT.mc_id=AZ-MVP-5003556

[@BijouBakson]

The fact that you've had to downgrade the RBAC for the application service principal only to limit it to the resource group indicate a problem that needs to be dealt with. But then again this is a 3 year old video - maybe they dealt with it by now! Here you have demonstrated how to stop one machine. Difficulties might rise when you have to pull your configuration from the pull server in the Automation account, in the case where you're doing a DSC for example. For example: When you're managing a large number of machines it might be a problem if you have to set up RBAC for each machine. I guess this is the part where grouping comes in handy, am I correct? Or perhaps... you have other ideas or answer for this, haven't you? Thanks

[@AdamMarczakYT]

My channel was created 1y 8 months ago, so this video surely isn't 3 years old :) They didn't change that yet unfortunately, by default automation runas account will get high RBAC role on the entire sub. What you describe can be achieved in many ways, so it's up to a developer to decide. But it's powershell so anything can be done. As to RBAC, well this is access management already, so you set it up as you wish. If you want to manage all VMs on broader scope you can grant appropriate roles on the entire subscription or create scripts that grant permissions. Azure (like any other platform) on larger scale is all about automation.

[@BijouBakson]

@@AdamMarczakYT The video date states 2019, so it was me with terrible arithmetic processing moment, sorry about that. :) I have seen tutorials on how you can use variables to manage multiple resources. Perhaps that'd come in handy. In the Az-104 module they do not mention the need to delete the service principal though. But I can see why this might pause a problem in a production environment. I will keep looking into it. Thanks for a prompt response. Great job!

[@ronaldabellano5643]

goodies

[@AdamMarczakYT]

Thanks!