Skip to content

Commit 9f6c6c3

Browse files
BethWilkeBethWilke
committed
Adding new file to Automation Account section
1 parent 550da60 commit 9f6c6c3

File tree

3 files changed

+209
-31
lines changed

3 files changed

+209
-31
lines changed

‎articles/automation/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
- name: Manage role-based access control
2323
href: automation-role-based-access-control.md
2424
displayName: RBAC
25+
- name: Use Azure AD in Azure Automation to authenticate to Azure
26+
href: automation-use-azure-ad.md
2527
- name: Move your Automation Account to another Subscription
2628
href: how-to/move-account.md
2729
- name: Automate onboarding of Automation Services

‎articles/automation/automation-use-azure-ad.md

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
---
2+
title: Use Azure AD in Azure Automation to authenticate to Azure
3+
description: Learn how to use Azure AD within Azure Automation as the provider for authentication to Azure.
4+
services: automation
5+
ms.date: 03/30/2020
6+
ms.topic: conceptual
7+
---
8+
9+
# Use Azure AD in Azure Automation to authenticate to Azure
10+
11+
The [Azure Active Directory (AD)](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) service enables a number of administrative tasks, such as user management, domain management, and single sign-on configuration. This article describes how to use Azure AD within Azure Automation as the provider for authentication to Azure.
12+
13+
>[!NOTE]
14+
>This article has been updated to use the new Azure PowerShell Az module. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. To learn more about the new Az module and AzureRM compatibility, see [Introducing the new Azure PowerShell Az module](https://docs.microsoft.com/powershell/azure/new-azureps-module-az?view=azps-3.5.0). For Az module installation instructions on your Hybrid Runbook Worker, see [Install the Azure PowerShell Module](https://docs.microsoft.com/powershell/azure/install-az-ps?view=azps-3.5.0). For your Automation account, you can update your modules to the latest version using [How to update Azure PowerShell modules in Azure Automation](automation-update-azure-modules.md).
15+
16+
## Installing Azure AD modules
17+
18+
You can enable Azure AD through the following PowerShell modules:
19+
20+
* Azure Active Directory PowerShell for Graph (AzureRM and Az modules). Azure Automation ships with the AzureRM module and its recent upgrade, the Az module. Functionality includes non-interactive authentication to Azure using Azure AD user (OrgId) credential-based authentication. See [AzureAD 2.0.2.76](https://www.powershellgallery.com/packages/AzureAD/2.0.2.76).
21+
22+
* Microsoft Azure Active Directory for Windows PowerShell (MSOnline module). This module enables interactions with Microsoft Online, including Office 365.
23+
Note: PowerShell Core does not support the MSOnline module. To use the module cmdlets, you must run them from Windows PowerShell. You are encouraged to use the newer Azure Active Directory PowerShell for Graph modules instead of the MSOnline module.
24+
25+
* Azure Automation Authoring Toolkit. This module is the [Microsoft Azure Automation ISE add-on for the PowerShell ISE](https://github.com/azureautomation/azure-automation-ise-addon).
26+
27+
### Preinstallation
28+
29+
Before installing the Azure AD modules on your computer:
30+
31+
* Uninstall any previous versions of the AzureRM/Az module and the MSOnline module.
32+
33+
* Uninstall the Microsoft Online Services Sign-In Assistant to ensure correct operation of the new PowerShell modules.
34+
35+
### Install the AzureRM and Az modules
36+
37+
>[!NOTE]
38+
>To work with these modules, you must use PowerShell version 5.1 or later with a 64-bit version of Windows.
39+
40+
1. Install Windows Management Framework (WMF) 5.1. See [Install and Configure WMF 5.1](https://docs.microsoft.com/powershell/scripting/wmf/setup/install-configure?view=powershell-7).
41+
42+
2. Install AzureRM and/or Az using instructions in [Install Azure PowerShell on Windows with PowerShellGet](https://docs.microsoft.com/powershell/azure/azurerm/install-azurerm-ps?view=azurermps-6.13.0).
43+
44+
### Install the MSOnline module
45+
46+
>[!NOTE]
47+
>To install the MSOnline module, you must be a member of an Office 365 admin role. See [About admin roles](https://docs.microsoft.com/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide).
48+
49+
1. Ensure that the Microsoft .NET Framework 3.5.x feature is enabled on your computer. It's likely that your computer has a newer version installed, but backward compatibility with older versions of the .NET Framework can be enabled or disabled.
50+
51+
2. Install the 64-bit version of the [Microsoft Online Services Sign-in Assistant](https://www.microsoft.com/download/details.aspx?id=41950).
52+
53+
3. Run Windows PowerShell as an administrator by opening an elevated Windows PowerShell command prompt.
54+
55+
4. Deploy Windows Azure AD from [MSOnline 1.0](http://www.powershellgallery.com/packages/MSOnline/1.0).
56+
57+
5. If prompted to install the NuGet provider, type Y and press ENTER.
58+
59+
6. If prompted to install the module from `PSGallery`, type Y and press ENTER.
60+
61+
### Install support for PSCredential
62+
63+
Azure Automation uses the [PSCredential](https://docs.microsoft.com/dotnet/api/system.management.automation.pscredential?view=pscore-6.2.0) class to represent a credential asset. Your scripts retrieve `PSCredential` objects using the `Get-AutomationPSCredential` cmdlet. For local development using the Azure Automation Authoring Toolkit, the cmdlet is part of assembly `AzureAutomationAuthoringToolkit`. For Azure working with the Automation context, the cmdlet is in `Orchestrator.AssetManagement.Cmdlets`.
64+
65+
To be able to retrieve the Azure Automation credential asset `PSCredential` in your code, you can install the [Microsoft Azure Automation ISE add-on for the PowerShell ISE](https://github.com/azureautomation/azure-automation-ise-addon).
66+
67+
```azurepowershell
68+
Install-Module AzureAutomationAuthoringToolkit -Scope CurrentUser -Force
69+
```
70+
71+
Your script can also import the required module where needed, as in the following example:
72+
73+
```azurepowershell
74+
Import-Module Orchestrator.AssetManagement.Cmdlets -ErrorAction SilentlyContinue
75+
```
76+
77+
## Assigning a subscription administrator
78+
79+
You must assign an administrator for the Azure subscription. This person has the role of Owner for the subscription scope. See [Role-based access control in Azure Automation](automation-role-based-access-control.md).
80+
81+
## Changing the Azure AD user's password
82+
83+
1. Log out of Azure.
84+
85+
2. Have the administrator log in to Azure as the Azure AD user just created, using the full user name (including the domain) and a temporary password.
86+
87+
3. Ask the administrator to change the password when prompted.
88+
89+
## Configuring Azure Automation to use the Azure AD user to manage the Azure subscription
90+
91+
For Azure Automation to communicate with Azure AD, you must retrieve the credentials associated with the Azure connection to Azure AD, such as tenant ID, subscription ID, etc. For more about the connection between Azure and Azure AD, see [Connect your organization to Azure Active Directory](https://docs.microsoft.com/azure/devops/organizations/accounts/connect-organization-to-azure-ad?view=azure-devops).
92+
93+
## Create a credential asset
94+
95+
With the Azure credentials for Azure AD available, it's time to create an Azure Automation credential asset to securely store the Azure AD credentials so that runbooks can access them. You can do this using either the Azure portal or PowerShell cmdlets.
96+
97+
### Create the credential asset in Azure portal
98+
99+
You can use the Azure portal to create the credential asset. Perform this operation from your Automation account using **Credentials** under **Shared Resources**. See [Credential assets in Azure Automation](https://docs.microsoft.com/azure/automation/shared-resources/credentials).
100+
101+
### Create the credential asset with Windows PowerShell
102+
103+
To prepare a new credential asset in Windows PowerShell, your script first creates a `PSCredential` object using the assigned name and password. The script then uses this object to create the asset through a call to the [New-AzureAutomationCredential](https://docs.microsoft.com/powershell/module/servicemanagement/azure/new-azureautomationcredential?view=azuresmps-4.0.0) cmdlet. Alternatively, the script can call the [Get-Credential](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/get-credential?view=powershell-7) cmdlet to prompt the user to type in a name and password. See [Credential assets in Azure Automation](https://docs.microsoft.com/azure/automation/shared-resources/credentials).
104+
105+
## Managing Azure resources from an Azure Automation runbook
106+
107+
You can manage Azure resources from Azure Automation runbooks using the credential asset. Below is an example PowerShell runbook that collects the credential asset to use for stopping and starting virtual machines in an Azure subscription. This runbook first uses `Get-AutomationPSCredential` to retrieve the credential to use to authenticate to Azure. It then calls the [Connect-AzAccount](https://docs.microsoft.com/powershell/module/az.accounts/connect-azaccount?view=azps-3.6.1) cmdlet to connect to Azure using the credential. After this, the script uses the [Select-AzureSubscription](https://docs.microsoft.com/powershell/module/servicemanagement/azure/select-azuresubscription?view=azuresmps-4.0.0) cmdlet to choose the subscription to work with.
108+
109+
```azurepowershell
110+
Workflow Stop-Start-AzureVM
111+
{
112+
Param
113+
(
114+
[Parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]
115+
[String]
116+
$AzureSubscriptionId,
117+
[Parameter(Mandatory=$true)][ValidateNotNullOrEmpty()]
118+
[String]
119+
$AzureVMList="All",
120+
[Parameter(Mandatory=$true)][ValidateSet("Start","Stop")]
121+
[String]
122+
$Action
123+
)
124+
125+
$credential = Get-AutomationPSCredential -Name 'AzureCredential'
126+
Connect-AzAccount -Credential $credential
127+
Select-AzureSubscription -SubscriptionId $AzureSubscriptionId
128+
129+
if($AzureVMList -ne "All")
130+
{
131+
$AzureVMs = $AzureVMList.Split(",")
132+
[System.Collections.ArrayList]$AzureVMsToHandle = $AzureVMs
133+
}
134+
else
135+
{
136+
$AzureVMs = (Get-AzVM).Name
137+
[System.Collections.ArrayList]$AzureVMsToHandle = $AzureVMs
138+
139+
}
140+
141+
foreach($AzureVM in $AzureVMsToHandle)
142+
{
143+
if(!(Get-AzVM | ? {$_.Name -eq $AzureVM}))
144+
{
145+
throw " AzureVM : [$AzureVM] - Does not exist! - Check your inputs "
146+
}
147+
}
148+
149+
if($Action -eq "Stop")
150+
{
151+
Write-Output "Stopping VMs";
152+
foreach -parallel ($AzureVM in $AzureVMsToHandle)
153+
{
154+
Get-AzVM | ? {$_.Name -eq $AzureVM} | Stop-AzVM -Force
155+
}
156+
}
157+
else
158+
{
159+
Write-Output "Starting VMs";
160+
foreach -parallel ($AzureVM in $AzureVMsToHandle)
161+
{
162+
Get-AzVM | ? {$_.Name -eq $AzureVM} | Start-AzVM
163+
}
164+
}
165+
}
166+
```
167+
168+
## Next steps
169+
170+
* You can find information about Automation credential assets in [Credential assets in Azure Automation](https://docs.microsoft.com/azure/automation/shared-resources/credentials).
171+
* To learn more about the methods that can be used to start a runbook in Azure Automation, see [Starting a runbook in Azure Automation](automation-starting-a-runbook.md).
172+
* For more information on PowerShell, including language reference and learning modules, refer to the [PowerShell Docs](https://docs.microsoft.com/powershell/scripting/overview).

0 commit comments

Comments
 (0)