Skip to content

Commit 4c8e079

Browse files
megvanhuygenmegvanhuygen
authored
Merge pull request #109656 from BethWilke/branch3
Branch3
2 parents f1fa2f3 + f092174 commit 4c8e079

File tree

3 files changed

+230
-39
lines changed

3 files changed

+230
-39
lines changed

‎articles/automation/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
- name: Manage role-based access control
2323
href: automation-role-based-access-control.md
2424
displayName: RBAC
25+
- name: Use Azure AD in Azure Automation to authenticate to Azure
26+
href: automation-use-azure-ad.md
2527
- name: Move your Automation Account to another Subscription
2628
href: how-to/move-account.md
2729
- name: Automate onboarding of Automation Services

‎articles/automation/automation-use-azure-ad.md

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
---
2+
title: Use Azure AD in Azure Automation to authenticate to Azure
3+
description: Learn how to use Azure AD within Azure Automation as the provider for authentication to Azure.
4+
services: automation
5+
ms.date: 03/30/2020
6+
ms.topic: conceptual
7+
---
8+
9+
# Use Azure AD in Azure Automation to authenticate to Azure
10+
11+
The [Azure Active Directory (AD)](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) service enables a number of administrative tasks, such as user management, domain management, and single sign-on configuration. This article describes how to use Azure AD within Azure Automation as the provider for authentication to Azure.
12+
13+
>[!NOTE]
14+
>This article has been updated to use the new Azure PowerShell Az module. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. To learn more about the new Az module and AzureRM compatibility, see [Introducing the new Azure PowerShell Az module](https://docs.microsoft.com/powershell/azure/new-azureps-module-az?view=azps-3.5.0). For Az module installation instructions on your Hybrid Runbook Worker, see [Install the Azure PowerShell Module](https://docs.microsoft.com/powershell/azure/install-az-ps?view=azps-3.5.0). For your Automation account, you can update your modules to the latest version using [How to update Azure PowerShell modules in Azure Automation](automation-update-azure-modules.md).
15+
16+
## Installing Azure AD modules
17+
18+
You can enable Azure AD through the following PowerShell modules:
19+
20+
* Azure Active Directory PowerShell for Graph (AzureRM and Az modules). Azure Automation ships with the AzureRM module and its recent upgrade, the Az module. Functionality includes non-interactive authentication to Azure using Azure AD user (OrgId) credential-based authentication. See [Azure AD 2.0.2.76](https://www.powershellgallery.com/packages/AzureAD/2.0.2.76).
21+
22+
* Microsoft Azure Active Directory for Windows PowerShell (MSOnline module). This module enables interactions with Microsoft Online, including Office 365.
23+
24+
>[!NOTE]
25+
>PowerShell Core does not support the MSOnline module. To use the module cmdlets, you must run them from Windows PowerShell. You're encouraged to use the newer Azure Active Directory PowerShell for Graph modules instead of the MSOnline module.
26+
27+
### Preinstallation
28+
29+
Before installing the Azure AD modules on your computer:
30+
31+
* Uninstall any previous versions of the AzureRM/Az module and the MSOnline module.
32+
33+
* Uninstall the Microsoft Online Services Sign-In Assistant to ensure correct operation of the new PowerShell modules.
34+
35+
### Install the AzureRM and Az modules
36+
37+
>[!NOTE]
38+
>To work with these modules, you must use PowerShell version 5.1 or later with a 64-bit version of Windows.
39+
40+
1. Install Windows Management Framework (WMF) 5.1. See [Install and Configure WMF 5.1](https://docs.microsoft.com/powershell/scripting/wmf/setup/install-configure?view=powershell-7).
41+
42+
2. Install AzureRM and/or Az using instructions in [Install Azure PowerShell on Windows with PowerShellGet](https://docs.microsoft.com/powershell/azure/azurerm/install-azurerm-ps?view=azurermps-6.13.0).
43+
44+
### Install the MSOnline module
45+
46+
>[!NOTE]
47+
>To install the MSOnline module, you must be a member of an Office 365 admin role. See [About admin roles](https://docs.microsoft.com/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide).
48+
49+
1. Ensure that the Microsoft .NET Framework 3.5.x feature is enabled on your computer. It's likely that your computer has a newer version installed, but backward compatibility with older versions of the .NET Framework can be enabled or disabled.
50+
51+
2. Install the 64-bit version of the [Microsoft Online Services Sign-in Assistant](https://www.microsoft.com/download/details.aspx?id=41950).
52+
53+
3. Run Windows PowerShell as an administrator to create an elevated Windows PowerShell command prompt.
54+
55+
4. Deploy Azure Active Directory from [MSOnline 1.0](http://www.powershellgallery.com/packages/MSOnline/1.0).
56+
57+
5. If you're prompted to install the NuGet provider, type Y and press ENTER.
58+
59+
6. If you're prompted to install the module from [PSGallery](https://www.powershellgallery.com/), type Y and press ENTER.
60+
61+
### Install support for PSCredential
62+
63+
Azure Automation uses the [PSCredential](https://docs.microsoft.com/dotnet/api/system.management.automation.pscredential?view=pscore-6.2.0) class to represent a credential asset. Your scripts retrieve `PSCredential` objects using the `Get-AutomationPSCredential` cmdlet. For more information, see [Credential assets in Azure Automation](shared-resources/credentials.md).
64+
65+
## Assigning a subscription administrator
66+
67+
You must assign an administrator for the Azure subscription. This person has the role of Owner for the subscription scope. See [Role-based access control in Azure Automation](automation-role-based-access-control.md).
68+
69+
## Changing the Azure AD user's password
70+
71+
To change the Azure AD user's password:
72+
73+
1. Log out of Azure.
74+
75+
2. Have the administrator log in to Azure as the Azure AD user just created, using the full user name (including the domain) and a temporary password.
76+
77+
3. Ask the administrator to change the password when prompted.
78+
79+
## Configuring Azure Automation to use the Azure AD user to manage the Azure subscription
80+
81+
For Azure Automation to communicate with Azure AD, you must retrieve the credentials associated with the Azure connection to Azure AD. Examples of these credentials are tenant ID, subscription ID, and the like. For more about the connection between Azure and Azure AD, see [Connect your organization to Azure Active Directory](https://docs.microsoft.com/azure/devops/organizations/accounts/connect-organization-to-azure-ad?view=azure-devops).
82+
83+
## Creating a credential asset
84+
85+
With the Azure credentials for Azure AD available, it's time to create an Azure Automation credential asset to securely store the Azure AD credentials so that runbooks and Desire State Configuration (DSC) scripts can access them. You can do this using either the Azure portal or PowerShell cmdlets.
86+
87+
### Create the credential asset in Azure portal
88+
89+
You can use the Azure portal to create the credential asset. Do this operation from your Automation account using **Credentials** under **Shared Resources**. See [Credential assets in Azure Automation](shared-resources/credentials.md).
90+
91+
### Create the credential asset with Windows PowerShell
92+
93+
To prepare a new credential asset in Windows PowerShell, your script first creates a `PSCredential` object using the assigned username and password. The script then uses this object to create the asset through a call to the [New-AzureAutomationCredential](https://docs.microsoft.com/powershell/module/servicemanagement/azure/new-azureautomationcredential?view=azuresmps-4.0.0) cmdlet. Alternatively, the script can call the [Get-Credential](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/get-credential?view=powershell-7) cmdlet to prompt the user to type in a name and password. See [Credential assets in Azure Automation](shared-resources/credentials.md).
94+
95+
## Managing Azure resources from an Azure Automation runbook
96+
97+
You can manage Azure resources from Azure Automation runbooks using the credential asset. Below is an example PowerShell runbook that collects the credential asset to use for stopping and starting virtual machines in an Azure subscription. This runbook first uses `Get-AutomationPSCredential` to retrieve the credential to use to authenticate to Azure. It then calls the [Connect-AzAccount](https://docs.microsoft.com/powershell/module/az.accounts/connect-azaccount?view=azps-3.6.1) cmdlet to connect to Azure using the credential. The script uses the [Select-AzureSubscription](https://docs.microsoft.com/powershell/module/servicemanagement/azure/select-azuresubscription?view=azuresmps-4.0.0) cmdlet to choose the subscription to work with.
98+
99+
```azurepowershell
100+
Workflow Stop-Start-AzureVM
101+
{
102+
Param
103+
(
104+
[Parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]
105+
[String]
106+
$AzureSubscriptionId,
107+
[Parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]
108+
[String]
109+
$AzureVMList="All",
110+
[Parameter(Mandatory=$true)][ValidateSet("Start","Stop")]
111+
[String]
112+
$Action
113+
)
114+
115+
$credential = Get-AutomationPSCredential -Name 'AzureCredential'
116+
Connect-AzAccount -Credential $credential
117+
Select-AzureSubscription -SubscriptionId $AzureSubscriptionId
118+
119+
if($AzureVMList -ne "All")
120+
{
121+
$AzureVMs = $AzureVMList.Split(",")
122+
[System.Collections.ArrayList]$AzureVMsToHandle = $AzureVMs
123+
}
124+
else
125+
{
126+
$AzureVMs = (Get-AzVM).Name
127+
[System.Collections.ArrayList]$AzureVMsToHandle = $AzureVMs
128+
129+
}
130+
131+
foreach($AzureVM in $AzureVMsToHandle)
132+
{
133+
if(!(Get-AzVM | ? {$_.Name -eq $AzureVM}))
134+
{
135+
throw " AzureVM : [$AzureVM] - Does not exist! - Check your inputs "
136+
}
137+
}
138+
139+
if($Action -eq "Stop")
140+
{
141+
Write-Output "Stopping VMs";
142+
foreach -parallel ($AzureVM in $AzureVMsToHandle)
143+
{
144+
Get-AzVM | ? {$_.Name -eq $AzureVM} | Stop-AzVM -Force
145+
}
146+
}
147+
else
148+
{
149+
Write-Output "Starting VMs";
150+
foreach -parallel ($AzureVM in $AzureVMsToHandle)
151+
{
152+
Get-AzVM | ? {$_.Name -eq $AzureVM} | Start-AzVM
153+
}
154+
}
155+
}
156+
```
157+
158+
## Next steps
159+
160+
* You can find information about Automation credential assets in [Credential assets in Azure Automation](shared-resources/credentials.md).
161+
* See [Manage modules in Azure Automation](shared-resources/modules.md) to find out how to work with Automation modules.
162+
* To learn more about the methods that can be used to start a runbook in Azure Automation, see [Starting a runbook in Azure Automation](automation-starting-a-runbook.md).
163+
* For more information about PowerShell, including language reference and learning modules, see the [PowerShell Docs](https://docs.microsoft.com/powershell/scripting/overview).

0 commit comments

Comments
 (0)