You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/automation/shared-resources/credentials.md
+3-9Lines changed: 3 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ As part of the Azure PowerShell Az module, the cmdlets in the following table ar
29
29
30
30
| Cmdlet | Description |
31
31
|:--- |:--- |
32
-
|[Get-AzAutomationCredential](/powershell/module/az.automation/get-azautomationcredential?view=azps-3.3.0)|Retrieves information about a credential asset. This cmdlet doesn't return a`PSCredential` object. |
32
+
|[Get-AzAutomationCredential](/powershell/module/az.automation/get-azautomationcredential?view=azps-3.3.0)|Retrieves a [CredentialInfo](https://docs.microsoft.com/dotnet/api/microsoft.azure.commands.automation.model.credentialinfo?view=azurerm-ps) object containing metadata about the credential. The cmdlet doesn't retrieve the`PSCredential` object itself. |
33
33
|[New-AzAutomationCredential](/powershell/module/az.automation/new-azautomationcredential?view=azps-3.3.0)|Creates a new Automation credential. |
34
34
|[Remove-AzAutomationCredential](/powershell/module/az.automation/remove-azautomationcredential?view=azps-3.3.0)|Removes an Automation credential. |
35
35
|[Set-AzAutomationCredential](/powershell/module/az.automation/set-azautomationcredential?view=azps-3.3.0)|Sets the properties for an existing Automation credential. |
@@ -40,17 +40,11 @@ The activities in the following table are used to access credentials in runbooks
40
40
41
41
| Activity | Description |
42
42
|:--- |:--- |
43
-
|`Get-AutomationPSCredential`|Gets a credential to use in a runbook or DSC configuration. The credential is in the form of a `PSCredential` object. For more about the cmdlet corresponding to this activity, see [Module assets in Azure Automation](modules.md). |
43
+
|`Get-AutomationPSCredential`|Gets a `PSCredential` object to use in a runbook or DSC configuration. Most often, you should use this activity instead of the `Get-AzAutomationCredential` cmdlet, as the latter only retrieves credential information. This information isn't normally helpful to pass to another cmdlet. |
44
44
|[Get-Credential](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/get-credential?view=powershell-7)|Gets a credential with a prompt for user name and password. |
45
45
|[New-AzureAutomationCredential](https://docs.microsoft.com/powershell/module/servicemanagement/azure/new-azureautomationcredential?view=azuresmps-4.0.0)| Creates a credential asset. |
46
46
47
-
To retrieve `PSCredential` objects in your code, you can install the Microsoft Azure Automation ISE add-on for the PowerShell ISE. For more information, see [Module assets in Azure Automation](modules.md).
Your script can also import the required module where needed, as in the following example:
47
+
To retrieve `PSCredential` objects in your code, you must import the `Orchestrator.AssetManagement.Cmdlets` module. For more information, see [Manage modules in Azure Automation](modules.md).
@@ -35,7 +34,7 @@ When Azure Automation executes runbook and DSC compilation jobs, it loads the mo
35
34
36
35
The following table lists modules that Azure Automation imports by default when you create your Automation account. Automation can import newer versions of these modules. However, you can't remove the original version from your Automation account, even if you delete a newer version. Note that these default modules include several AzureRM modules.
37
36
38
-
Az.Automation modules are preferred in your runbooks and DSC configurations. However, Azure Automation doesn't import the root Az module automatically into any new or existing Automation accounts. For more about working with these modules, see [Migrating to Az modules](#migrating-to-az-modules).
37
+
Azure Automation doesn't import the root Az module automatically into any new or existing Automation accounts. For more about working with these modules, see [Migrating to Az modules](#migrating-to-az-modules).
39
38
40
39
> [!NOTE]
41
40
> We don't recommend altering modules and runbooks in Automation accounts that contain the [Start/Stop VMs during off-hours solution in Azure Automation](../automation-solution-vm-management.md).
@@ -67,6 +66,10 @@ Az.Automation modules are preferred in your runbooks and DSC configurations. How
67
66
| xPowerShellExecutionPolicy | 1.1.0.0 |
68
67
| xRemoteDesktopAdmin | 1.1.0.0 |
69
68
69
+
## Az module cmdlets
70
+
71
+
For Az.Automation, the majority of the cmdlets have the same names as for the AzureRM modules, except that the AzureRm prefix has been changed to Az. For a list of Az modules that don't follow this naming convention, see [list of exceptions](/powershell/azure/migrate-from-azurerm-to-az#update-cmdlets-modules-and-parameters).
72
+
70
73
## Internal cmdlets
71
74
72
75
The following table defines the internal cmdlets supported by the `Orchestrator.AssetManagement.Cmdlets` module. Use these cmdlets in your runbooks and DSC configurations to interact with Azure assets within the Automation account. The cmdlets are designed to be used instead of Azure PowerShell cmdlets to retrieve secrets from encrypted variables, credentials, and encrypted connections.
@@ -86,41 +89,47 @@ The following table defines the internal cmdlets supported by the `Orchestrator.
86
89
87
90
Note that the internal cmdlets differ in naming from the Az and AzureRM cmdlets. Internal cmdlet names don't contain words like “Azure” or “Az” in the noun, but do use the word "Automation". We recommend their use over the use of Az or AzureRM cmdlets during runbook execution in an Azure sandbox or on a Windows hybrid worker. They require fewer parameters and run in the context of your already-executing job.
88
91
89
-
Use Az or AzureRM cmdlets for manipulating Azure Automation resources outside the context of a runbook. In these cases, you must implicitly connect to Azure when using the cmdlets, as when using a Run As account to authenticate to Azure.
92
+
We recommend that you use Az or AzureRM cmdlets for manipulating Azure Automation resources outside the context of a runbook.
90
93
91
-
## Modules supporting Get-AutomationPSCredential
94
+
## Module supporting Get-AutomationPSCredential
92
95
93
-
For local development using the Azure Automation Authoring Toolkit, the `Get-AutomationPSCredential` cmdlet is part of assembly [AzureAutomationAuthoringToolkit](https://www.powershellgallery.com/packages/AzureAutomationAuthoringToolkit/0.2.3.9). For Azure working with the Automation context, the cmdlet is in `Orchestrator.AssetManagement.Cmdlets`. To find out more about the use of credentials in Azure Automation, see [Credential assets in Azure Automation](credentials.md).
94
-
95
-
Note that `Get-AutomationPsCredential` returns a `PSCredential` object, which is expected by most PowerShell cmdlets that work with credentials. Most often, you should use this cmdlet instead of the [Get-AzAutomationCredential](https://docs.microsoft.com/powershell/module/az.automation/get-azautomationcredential?view=azps-3.8.0) cmdlet. `Get-AzAutomationCredential` retrieves a [CredentialInfo](https://docs.microsoft.com/dotnet/api/microsoft.azure.commands.automation.model.credentialinfo?view=azurerm-ps) object containing metadata about the credential. This information is not normally helpful to pass to another cmdlet.
96
+
The `Get-AutomationPSCredential` cmdlet is part of the module `Orchestrator.AssetManagement.Cmdlets`. This cmdlet returns a `PSCredential` object, which is expected by most PowerShell cmdlets that work with credentials. To find out more about the use of credentials in Azure Automation, see [Credential assets in Azure Automation](credentials.md).
96
97
97
98
## Migrating to Az modules
98
99
99
-
There are several things to take into consideration when using the Az modules in Azure Automation:
100
+
### Migration considerations
101
+
102
+
This section includes considerations to take into account when migrating to the Az modules in Azure Automation. See also [Migrate Azure PowerShell from AzureRM to Az](https://docs.microsoft.com/powershell/azure/migrate-from-azurerm-to-az?view=azps-3.7.0).
100
103
101
-
* We don't recommend running AzureRM modules and Az modules in the same Automation account, as it's guaranteed to cause problems. See [Migrate Azure PowerShell from AzureRM to Az](https://docs.microsoft.com/powershell/azure/migrate-from-azurerm-to-az?view=azps-3.7.0).
104
+
#### Use of AzureRM modules and Az modules in the same Automation account
102
105
103
-
* Be sure to test all runbooks and DSC configurations carefully in a separate Automation account before importing the Az modules.
106
+
We don't recommend running AzureRM modules and Az modules in the same Automation account. When you're sure you want to migrate from AzureRM to Az, it's best to fully commit to a complete migration. The most important reason for this is that Azure Automation often reuses sandboxes within the Automation account to save on startup times. If you don't make a full module migration, you might start a job using only AzureRM modules, then start another job using only Az modules. The sandbox soon crashes and you receive a fatal error stating that the modules aren’t compatible. This situation results in randomly occurring crashes for any given runbook or configuration.
104
107
105
-
* Importing an Az module into your Automation account doesn't automatically import the module into the PowerShell session that runbooks use. Modules are imported into the PowerShell session in the following situations:
108
+
#### Import of Az modules into the PowerShell session
106
109
107
-
* When a runbook invokes a cmdlet from a module
108
-
* When a runbook imports the module explicitly with the [Import-Module](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/import-module?view=powershell-7) cmdlet
109
-
* When a runbook imports another dependent module
110
+
Importing an Az module into your Automation account doesn't automatically import the module into the PowerShell session that runbooks use. Modules are imported into the PowerShell session in the following situations:
110
111
111
-
After you've completed the migration of your modules, don't try to start runbooks using AzureRM modules on the Automation account. It's also recommended to not import or update AzureRM modules on the account. Consider the account migrated to Az.Automation, and operate with Az modules only.
112
+
* When a runbook invokes a cmdlet from a module
113
+
* When a runbook imports the module explicitly with the [Import-Module](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/import-module?view=powershell-7) cmdlet
114
+
* When a runbook imports another dependent module
115
+
116
+
#### Testing for your runbooks and DSC configurations prior to module migration
112
117
113
-
>[!IMPORTANT]
114
-
>When you create a new Automation account, Azure Automation installs the AzureRM modules by default. You can still update the tutorial runbooks with AzureRM cmdlets. However, you should not run these runbooks.
118
+
Be sure to test all runbooks and DSC configurations carefully in a separate Automation account before migrating to the Az modules.
119
+
120
+
#### Updates for tutorial runbooks
121
+
122
+
When you create a new Automation account, even after migration to Az modules, Azure Automation installs the AzureRM modules by default. You can still update the tutorial runbooks with the AzureRM cmdlets. However, you shouldn't run these runbooks.
115
123
116
124
### Stop and unschedule all runbooks that use AzureRM modules
117
125
118
-
To ensure that you don't run any existing runbooks that use AzureRM modules, stop and unschedule all affected runbooks using the [Remove-AzureRmAutomationSchedule](https://docs.microsoft.com/powershell/module/azurerm.automation/remove-azurermautomationschedule?view=azurermps-6.13.0) cmdlet. It's important to review each schedule separately to ensure that you can reschedule it in the future for your runbooks, if necessary.
126
+
To ensure that you don't run any existing runbooks or DSC configurations that use AzureRM modules, you must stop and unschedule all affected runbooks and configurations. First, make sure that you review each runbook or DSC configuration and its schedules separately to ensure that you can reschedule the item in the future if necessary.
When you're ready to remove your schedules, you can either use the Azure portal or the [Remove-AzureRmAutomationSchedule](https://docs.microsoft.com/powershell/module/azurerm.automation/remove-azurermautomationschedule?view=azurermps-6.13.0) cmdlet. See [Manage schedules in Azure Automation](shared-resources/schedules.md).
129
+
130
+
### Remove the AzureRM modules
131
+
132
+
It's possible to remove the AzureRM modules before importing the Az modules. However, deletion of the AzureRM modules can interrupt source control synchronization and cause any scripts that are still scheduled to fail. If you decide to remove the modules, see [Uninstall AzureRM](https://docs.microsoft.com/powershell/azure/migrate-from-azurerm-to-az?view=azps-3.8.0#uninstall-azurerm).
124
133
125
134
### Import the Az modules
126
135
@@ -139,18 +148,12 @@ This import process can also be done through the [PowerShell Gallery](https://ww
139
148
140
149
### Test your runbooks
141
150
142
-
Once you've imported the Az modules into the Automation account, you can start editing your runbooks to use the new modules. The majority of the cmdlets have the same names as for the AzureRM modules, except that the AzureRm prefix has been changed to Az. For a list of modules that don't follow this naming convention, see [list of exceptions](/powershell/azure/migrate-from-azurerm-to-az#update-cmdlets-modules-and-parameters).
143
-
144
-
One way to test the modification of a runbook to use the new cmdlets is by using `Enable-AzureRmAlias -Scope Process` at the beginning of the runbook. By adding this command to your runbook, the script can run without changes.
151
+
Once you've imported the Az modules into the Automation account, you can start editing your runbooks and DSC configurations to use the new modules. One way to test the modification of a runbook to use the new cmdlets is by using `Enable-AzureRmAlias -Scope Process` at the beginning of the runbook. By adding this command to your runbook, the script can run without changes.
145
152
146
153
## Authoring modules
147
154
148
155
We recommend that you follow the considerations in this section when you author a PowerShell module for use in Azure Automation.
149
156
150
-
### References to AzureRM and Az
151
-
152
-
If referencing the Az modules in your module, ensure that you aren't also referencing the AzureRM modules. You can't use both sets of modules at the same time.
153
-
154
157
### Version folder
155
158
156
159
Do NOT include a version folder in the **.zip** package for your module. This issue is less of a concern for runbooks but does cause an issue with the State Configuration (DSC) service. Azure Automation creates the version folder automatically when the module is distributed to nodes managed by DSC. If a version folder exists, you end up with two instances. Here is an example folder structure for a DSC module:
When you're ready to remove your schedules, you can either use the Azure portal or the `Remove-AzureRmAutomationSchedule` cmdlet. Remember that you can only remove a schedule that has been disabled as described in the previous section.
177
+
178
+
### Remove a schedule using the Azure portal
179
+
180
+
1. In your Automation account, select **Schedules** under **Shared Resources**.
181
+
2. Click the name of a schedule to open the details pane.
182
+
3. Click **Delete**.
183
+
184
+
### Remove a schedule with PowerShell
185
+
186
+
You can use the [Remove-AzAutomationSchedule](https://docs.microsoft.com/powershell/module/Az.Automation/Remove-AzAutomationSchedule?view=azps-3.7.0) cmdlet to delete an existing schedule.
0 commit comments