Skip to content

Commit 052f54d

Browse files
author
Ankita Dutta
committed
ASR managed identities for automation accounts
1 parent f0e4b27 commit 052f54d

File tree

1 file changed

+174
-0
lines changed

1 file changed

+174
-0
lines changed

‎articles/site-recovery/site-recoverymanaged-identities.md

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
---
2+
title: Managed identities for Automation accounts
3+
description: Learn how to migrate from Automation Run As Accounts to managed identities.
4+
author: ankitaduttaMSFT
5+
ms.service: site-recovery
6+
ms.topic: conceptual
7+
ms.date: 01/18/2023
8+
ms.author: ankitadutta
9+
ms.custom: template-concept
10+
---
11+
12+
13+
# Manage identities for automation accounts
14+
15+
> [!IMPORTANT]
16+
> - Azure Automation Run As Account will retire on September 30, 2023 and will be replaced with Managed Identities. Before that date, you'll need to start migrating your runbooks to use [managed identities](automation-security-overview.md#managed-identities). For more information, see [migrating from an existing Run As accounts to managed identity](https://learn.microsoft.com/azure/automation/migrate-run-as-accounts-managed-identity?tabs=run-as-account#sample-scripts).
17+
> - Delaying the feature has a direct impact on our support burden, as it would cause upgrades of mobility agent to fail.
18+
19+
20+
This article explains about Managed Identities for automation accounts in ASR. Azure Automation Accounts are used by Azure Site Recovery (ASR) customers to auto-update the agents of their protected virtual machines. ASR creates Azure Automation Run As Accounts when you enable replication via the IaaS VM Blade and Recovery Services Vault.
21+
22+
23+
## Managed identities in Azure
24+
25+
On Azure, managed identities eliminate the need for developers having to manage credentials by providing an identity for the Azure resource
26+
in Azure Active Directory (Azure AD) and using it to obtain Azure AD tokens.
27+
28+
> [!NOTE]
29+
> Managed identities for Azure is the new name for the service formerly known as *Managed Service Identity* (MSI).
30+
31+
**Here are some of the benefits of using managed identities:**
32+
33+
- You don't need to manage credentials. Credentials aren’t even accessible to you.
34+
- You can use managed identities to authenticate to any resource that supports Azure AD authentication, including your own applications.
35+
- Managed identities for Azure resources are free with Azure AD for Azure subscriptions. There's no extra cost.
36+
37+
### Configure managed identities
38+
39+
You can configure your managed identities through:
40+
41+
- Azure portal
42+
- Azure CLI
43+
- your Azure Resource Manager (ARM) template
44+
45+
When a managed identity is added, deleted, or modified on a running container app, the app doesn't automatically restart and a new revision isn't created.
46+
47+
> [!NOTE]
48+
> For more information about migration cadence and the support timeline for Run As account creation and certificate renewal, see the [frequently asked questions](automation-managed-identity-faq.md).
49+
50+
51+
## Migrate from an existing Run As account to a managed identity
52+
53+
### Portal experience
54+
55+
<content here>
56+
57+
58+
### Sample scripts
59+
60+
The following examples of runbook scripts fetch the Resource Manager resources by using the Run As account (service principal) and the managed identity.
61+
62+
# [Run As account](#tab/run-as-account)
63+
64+
```powershell-interactive
65+
$connectionName = "AzureRunAsConnection"
66+
try
67+
{
68+
# Get the connection "AzureRunAsConnection"
69+
$servicePrincipalConnection=Get-AutomationConnection -Name $connectionName
70+
71+
"Logging in to Azure..."
72+
Add-AzureRmAccount `
73+
-ServicePrincipal `
74+
-TenantId $servicePrincipalConnection.TenantId `
75+
-ApplicationId $servicePrincipalConnection.ApplicationId `
76+
-CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
77+
}
78+
catch {
79+
if (!$servicePrincipalConnection)
80+
{
81+
$ErrorMessage = "Connection $connectionName not found."
82+
throw $ErrorMessage
83+
} else{
84+
Write-Error -Message $_.Exception
85+
throw $_.Exception
86+
}
87+
}
88+
89+
#Get all Resource Manager resources from all resource groups
90+
$ResourceGroups = Get-AzureRmResourceGroup
91+
92+
foreach ($ResourceGroup in $ResourceGroups)
93+
{
94+
Write-Output ("Showing resources in resource group " + $ResourceGroup.ResourceGroupName)
95+
$Resources = Find-AzureRmResource -ResourceGroupNameContains $ResourceGroup.ResourceGroupName | Select ResourceName, ResourceType
96+
ForEach ($Resource in $Resources)
97+
{
98+
Write-Output ($Resource.ResourceName + " of type " + $Resource.ResourceType)
99+
}
100+
Write-Output ("")
101+
}
102+
```
103+
104+
# [System-assigned managed identity](#tab/sa-managed-identity)
105+
106+
>[!NOTE]
107+
> Enable appropriate RBAC permissions for the system identity of this Automation account. Otherwise, the runbook might fail.
108+
109+
```powershell-interactive
110+
try
111+
{
112+
"Logging in to Azure..."
113+
Connect-AzAccount -Identity
114+
}
115+
catch {
116+
Write-Error -Message $_.Exception
117+
throw $_.Exception
118+
}
119+
120+
#Get all Resource Manager resources from all resource groups
121+
$ResourceGroups = Get-AzResourceGroup
122+
123+
foreach ($ResourceGroup in $ResourceGroups)
124+
{
125+
Write-Output ("Showing resources in resource group " + $ResourceGroup.ResourceGroupName)
126+
$Resources = Get-AzResource -ResourceGroupName $ResourceGroup.ResourceGroupName
127+
foreach ($Resource in $Resources)
128+
{
129+
Write-Output ($Resource.Name + " of type " + $Resource.ResourceType)
130+
}
131+
Write-Output ("")
132+
}
133+
```
134+
# [User-assigned managed identity](#tab/ua-managed-identity)
135+
136+
```powershell-interactive
137+
try
138+
{
139+
140+
"Logging in to Azure..."
141+
142+
$identity = Get-AzUserAssignedIdentity -ResourceGroupName <myResourceGroup> -Name <myUserAssignedIdentity>
143+
Connect-AzAccount -Identity -AccountId $identity.ClientId
144+
}
145+
catch {
146+
Write-Error -Message $_.Exception
147+
throw $_.Exception
148+
}
149+
#Get all Resource Manager resources from all resource groups
150+
$ResourceGroups = Get-AzResourceGroup
151+
foreach ($ResourceGroup in $ResourceGroups)
152+
{
153+
Write-Output ("Showing resources in resource group " + $ResourceGroup.ResourceGroupName)
154+
$Resources = Get-AzResource -ResourceGroupName $ResourceGroup.ResourceGroupName
155+
foreach ($Resource in $Resources)
156+
{
157+
Write-Output ($Resource.Name + " of type " + $Resource.ResourceType)
158+
}
159+
Write-Output ("")
160+
}
161+
```
162+
---
163+
164+
## Next steps
165+
166+
Learn more about:
167+
168+
- [Managed identities](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).
169+
- [Connecting from your application to resources without handling credentials](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview-for-developers?tabs=portal%2Cdotnet)
170+
- [Implementing managed identities for Microsoft Azure Resources](https://www.pluralsight.com/courses/microsoft-azure-resources-managed-identities-implementing).
171+
- [Using a system-assigned managed identity for an Azure Automation account](https://learn.microsoft.com/en-us/azure/automation/enable-managed-identity-for-automation).
172+
- [Using a user-assigned managed identity for an Azure Automation account](https://learn.microsoft.com/en-us/azure/automation/add-user-assigned-identity).
173+
- [FAQ for migrating from a Run As account to a managed identity](https://learn.microsoft.com/en-us/azure/automation/automation-managed-identity-faq).
174+

0 commit comments

Comments
 (0)