Tag:"azure automation" | Microsoft Community Hub

Securing Your Azure Automation Variables Automatically
Upgrade the security of your Azure Automation environment effortlessly. Learn how to convert non-encrypted variables to encrypted ones using a simple PowerShell script—securing your secrets has never been easier!
BlakeDrumm
Dec 16, 2024 Place Azure Governance and Management Blog
174Views
2likes
0Comments
Modernizing Azure Automation: A 2023 Retrospective and Future outlook
Azure Automation is striving to become the best-in-class platform for resource management in an adaptive cloud.
Nikita_Bajaj
Dec 06, 2024 Place Azure Governance and Management Blog
6.2KViews
7likes
4Comments
Azure Change Tracking & Inventory: Simplified onboarding to manage in-guest changes on Azure Arc VMs
Explore new Azure native few clicks onboarding experience for Change Tracking & Inventory on Azure Arc servers, streamlining in-guest change management operations, while strengthening your adaptive cloud strategy.
Swatidevgan
Dec 02, 2024 Place Azure Governance and Management Blog
336Views
1like
1Comment
Azure Automation is revising Service and Subscription Limits
Starting 7 th January 2025, Azure Automation will be revising its Service and Subscription limits to ensure fair distribution of cloud resources across all customers. This change is another step towards improving the reliability and performance of the service while optimizing resource utilization. Since the resource requirements vary across organizations and evolve over time, we are empowering customers to configure their quotas based on actual usage. Revised limits The current Service and Subscription limits for Azure Automation can be found here. To start with, we are revising the limits for two resources: Maximum number of Automation accounts in a subscription in a region. Maximum number of concurrent running jobs at the same instance of time per Automation account You will get an error message when you exceed the limits mentioned below: Resource Limit Notes Maximum number of Automation accounts in a subscription in a region 10 2 1 Enterprise and CSP subscriptions would be able to create accounts in any of the regions supported by the service. Pay-as-you-go, Sponsored, MSDN, MPN, Azure Pass subscriptions can create Automation accounts in any of theregions supported by the service. Free trial, Azure for Student, Azure in Open subscriptions can create only one Automation account per region per subscription. Allowed list of regions: EastUS, EastUS2, WestUS, NorthEurope, SoutheastAsia, and JapanWest2 Maximum number of concurrent running jobs at the same instance of time per Automation account per region 50 10 5 Enterprise and CSP subscriptions Pay-as-you-go, Sponsored, MSDN, MPN, Azure Pass subscriptions Free trial, Azure for Student, Azure in Open subscriptions Frequently asked questions When will the new limits come into effect? New limits would be effective starting 7 th January 2025 across all commercial regions. Your patience during the transition period is appreciated. How do I check my current resource usage? You will be able to check your usage of Automation accounts and concurrently running jobs through Quotas service on Azure portal or while creating a support request under the category ‘Service and Subscription limits (Quotas)’. Quotas service on Azure portal will be enabled once deployment starts in January 2025. My current usage is more than the revised limits. What should I do? Rest assured that your current usage of both resources - Automation accounts and concurrent running jobs - will be honored and will not be impacted. For example, consider you are an Enterprise customer. Your new limit is 10 Automation accounts and current usage is 12 accounts. Even though your usage is higher than the new limit, your usage of 12 accounts would be honored and then considered as your new limit. When you exceed the new limit of 12 accounts, you would get an error. I need more resources than my current limits. What should I do? You will get complete control to request for quota increase and decrease based on your changing business requirements. Once the changes are deployed in January 2025, you will be able to check your current usage, current limit and request for quota changes by creating a support request under the category ‘Service and Subscription limits (Quotas)’ for ‘Azure Automation’. Detailed steps to request for quota changes would be shared once deployment starts in January 2025. Please feel free to reach out to askazureautomation@microsoft.com for any questions or feedback.
Nikita_Bajaj
Dec 02, 2024 Place Azure Governance and Management Blog
847Views
0likes
0Comments
Does Microsoft stop support WMIC or WMI?
Hello everyone, Nice to meet you! I heard that MS has plans to deprecate and stop supporting the VB script very soon. I have few queries, please clarify Does Microsoft stop supporting WMIC or WMI along with the VB script? Can we use WMI commands in PowerShell scripts? thanks Madhu
madhugeddada
Nov 18, 2024 Place Windows PowerShell
46Views
0likes
1Comment
[resolved] Variables are not consistent
Hello internet. My mind is completely blown by this! I have a PowerAutomate that sets some 'compose' actions and then uses them to start a job. It is a PowerShell 7.2 script running in a Runbook extension-based hybrid worker on a Debian 11 Azure VM. I've reduced the script to just printing the inputted variable values. That's all, yet it provides them transposed! param ( [string] $siteNAME, [string] $OMd, [string] $userNAME, [string] $templateNAME ) $scriptVERSION = "x.y.z" function WO { write-output $wriOU } write-output "----------------------------------" $wriOU = "siteNAME: "+$($siteNAME);WO $wriOU = "OMd: "+$($OMd);WO $wriOU = "userNAME: "+$($userNAME);WO $wriOU = "templateNAME: "+$($templateNAME);WO write-output "----------------------------------" $wriOU = "Script Version: [ "+$scriptVERSION+" ]";WO write-output "-end of line-" #EOF As you can see 'siteNAME' retains the value correctly. But then 'OMd', 'username', and 'templateNAME' goes sideways so hard... Why? What am I doing wrong, this seems super odd... Any insight is greaaaatly appreciated. TY!
Solved
webmasterSANTEE
Sep 13, 2024 Place Windows PowerShell
339Views
0likes
2Comments
Facing error when running a ps script using mggraph
Hi Community, I am facing issue in fetching lastsignindate from azure ad using mggraph it returns error of 404 not found whereas user is present in azure ad. The script i am sharing has some fields blank for security reasons: # Function to authenticate with Microsoft Graph function Get-GraphToken { param ( [string]$tenantId, [string]$clientId, [string]$clientSecret, [string]$authUrl ) $authBody = @{ grant_type = "client_credentials" scope = "https://graph.microsoft.com/.default" client_id = $clientId client_secret = $clientSecret } try { $tokenResponse = Invoke-RestMethod -Method Post -Uri $authUrl -ContentType "application/x-www-form-urlencoded" -Body $authBody return $tokenResponse.access_token } catch { Write-Error "Failed to authenticate with Microsoft Graph: $_" return $null } } # Function to get the most recent LastLogon attribute from all domain controllers function Get-LastLogon { param ( [string]$userName ) $dcs = Get-ADDomainController -Filter * | Select-Object -ExpandProperty HostName $lastLogon = 0 foreach ($dc in $dcs) { try { $user = Get-ADUser $userName -Server $dc -Properties LastLogon if ($user.LastLogon -gt $lastLogon) { $lastLogon = $user.LastLogon } } catch { Write-Error "Failed to retrieve LastLogon from $dc for $userName $_" } } if ($lastLogon -ne 0) { return [DateTime]::FromFileTime($lastLogon) } else { return $null } } # Function to get last sign-in date from Azure AD using User ID function Get-UserLastSignIn { param ( [string]$userId, [hashtable]$headers ) try { # Get the user's sign-in activity using userId $userInfo = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/$userId?$select=signInActivity" -Headers $headers if ($userInfo.signInActivity -and $userInfo.signInActivity.lastSignInDateTime) { # Return the lastSignInDateTime return [DateTime]::Parse($userInfo.signInActivity.lastSignInDateTime) } else { Write-Warning "No sign-in activity available for user with ID $userId." return $null } } catch { Write-Error "Failed to retrieve sign-in data for user with ID $userId $_" return $null } } # Function to send notification function Send-Notification { param ( [string]$userEmail, [string]$managerEmail ) $subject = "Login Reminder" $body = "You have not logged in for the past 10 days. Please log in to avoid account deactivation." # Uncomment the below line to send the actual email # Send-MailMessage -From "" -To $userEmail -Cc $managerEmail -Subject $subject -Body $body -SmtpServer $smtpServer } # Function to create and send the HTML report function Create-And-Send-HTMLReport { param ( [array]$csvData, [string]$htmlReportPath ) $htmlContent = @" <html> <head> <title>User Login Report</title> <style> table { width: 100%; border-collapse: collapse; } table, th, td { border: 1px solid black; } th, td { padding: 8px; text-align: left; } </style> </head> <body> <h2>User Login Report</h2> <table> <tr> <th>samAccountName</th> <th>DisplayName</th> <th>MailSentToManager</th> <th>LastLogonOnPrem</th> <th>LastLogonAzureAD</th> <th>SessionRevoked</th> <th>Action</th> </tr> "@ foreach ($row in $csvData) { $htmlContent += "<tr>" $htmlContent += "<td>$($row.samAccountName)</td>" $htmlContent += "<td>$($row.DisplayName)</td>" $htmlContent += "<td>$($row.MailSentToManager)</td>" $htmlContent += "<td>$($row.LastLogonOnPrem)</td>" $htmlContent += "<td>$($row.LastLogonAzureAD)</td>" $htmlContent += "<td>$($row.SessionRevoked)</td>" $htmlContent += "<td>$($row.Action)</td>" $htmlContent += "</tr>" } $htmlContent += @" </table> </body> </html> "@ # Save the HTML content to a file $htmlContent | Out-File -FilePath $htmlReportPath -Encoding UTF8 # Uncomment the below line to send the actual email # Send-MailMessage -From "" -To "" -Subject "Daily User Login HTML Report" -BodyAsHtml -Body $htmlContent -SmtpServer $smtpServer } # Function to send daily report to IT function Send-DailyReport { param ( [string]$reportPath ) $subject = "Daily User Login Report" $body = Get-Content -Path $reportPath -Raw # Uncomment the below line to send the actual email # Send-MailMessage -From "" -To "" -Subject $subject -Body $body -BodyAsHtml -SmtpServer $smtpServer -Port $smtpPort } # Main script starts here # Define variables $tenantId = "" $clientSecret = "" $clientId = "" $authUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" $smtpServer = "" $smtpPort = $departmentsFilePath = "C:\psscr\Departments.txt" # Authenticate with Microsoft Graph $token = Get-GraphToken -tenantId $tenantId -clientId $clientId -clientSecret $clientSecret -authUrl $authUrl # Ensure that the token was successfully obtained if (-not $token) { Write-Error "Failed to obtain Microsoft Graph token. Exiting script." exit } $headers = @{ Authorization = "Bearer $token" } # Set cut-off dates $cutOffDate10Days = (Get-Date).AddDays(-10) $cutOffDate15Days = (Get-Date).AddDays(-15) # Check departments $departments = Get-Content -Path $departmentsFilePath # Initialize CSV report $currentDateTime = (Get-Date).ToString("dd-MM-yyyy_HH-mm") $csvFilePath = "C:\psscr\DailyUserLoginReport_$currentDateTime.csv" $htmlReportPath = "C:\psscr\DailyUserLoginReport_$currentDateTime.html" $csvData = @() # Process each department foreach ($dept in $departments) { $users = Get-ADUser -Filter { Department -eq $dept } -Properties LastLogonTimestamp, Manager, Enabled, UserPrincipalName, DisplayName foreach ($user in $users) { if (-not $user.Enabled) { continue } # Get the most recent LastLogon from AD $lastLogon = Get-LastLogon -userName $user.SamAccountName $lastLogonString = if ($lastLogon) { $lastLogon.ToString("yyyy-MM-dd HH:mm:ss") } else { "Never" } # Get the user's Azure AD ID $userResponse = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq '$($user.UserPrincipalName)'" -Headers $headers # Find the user with the exact UserPrincipalName match $userId = $null foreach ($responseUser in $userResponse.value) { if ($responseUser.userPrincipalName -eq $user.UserPrincipalName) { $userId = $responseUser.id break } } #$userId = $userResponse.value[$user.UserPrincipalName].id # Ensure that a valid userId was retrieved if ($null -eq $userId) { Write-Warning "Could not retrieve userId for $($user.UserPrincipalName). Skipping..." continue } # Get the most recent last sign-in date from Azure AD using ID $lastSignInDate = Get-UserLastSignIn -userId $userId -headers $headers $lastSignInDateString = if ($lastSignInDate) { $lastSignInDate.ToString("yyyy-MM-dd HH:mm:ss") } else { "Never" } $action = "" $mailSent = $false $sessionRevoked = $false if ($lastLogon -lt $cutOffDate10Days -and $lastSignInDate -lt $cutOffDate10Days) { # Send notification to the user and manager $manager = Get-ADUser -Identity $user.Manager -Properties EmailAddress Send-Notification -userEmail $user.EmailAddress -managerEmail $manager.EmailAddress $mailSent = $true } if ($lastLogon -lt $cutOffDate15Days -and $lastSignInDate -lt $cutOffDate15Days) { # Revoke Azure AD sessions and disable the on-premises AD account # Uncomment the below line to revoke Azure AD sessions # Invoke-RestMethod -Method Post -Uri "https://graph.microsoft.com/v1.0/users/$userId/revokeSignInSessions" -Headers $headers #Disable-ADAccount -Identity $user.SamAccountName $action = "Account Disabled" $sessionRevoked = $true } $csvData += [pscustomobject]@{ samAccountName = $user.SamAccountName DisplayName = $user.DisplayName MailSentToManager = $mailSent LastLogonOnPrem = $lastLogonString LastLogonAzureAD = $lastSignInDateString SessionRevoked = $sessionRevoked Action = $action } } } # Export to CSV $csvData | Export-Csv -Path $csvFilePath -NoTypeInformation # Create and send the HTML report Create-And-Send-HTMLReport -csvData $csvData -htmlReportPath $htmlReportPath # Send the daily report to IT Send-DailyReport -reportPath $htmlReportPath Any help is appreciated why this error occurs is known to us that it is not found will this need changes in script or something else. The permissions given to Azure app is correct as is does not show permission error when running the script.
Solved
vrush96
Sep 02, 2024 Place Windows PowerShell
440Views
0likes
6Comments
Start-AzAutomationRunbook : Invalid runbook parameters.
Hi Team, My PowerShell Script trying to run a Runbook job using Runbook Hybrid worker group gives this error: Start-AzAutomationRunbook : Invalid runbook parameters. This happens when I am trying to pass parameter such as website name. Any help will be great. Clear-AzContext -Force Import-Module Az.Accounts Import-Module Az.Automation $Secret = "" $AppId = "" $TenantID = "" $SecurePass = ConvertTo-SecureString $Secret -AsPlainText -Force $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $AppId, $SecurePass Connect-AzAccount -ServicePrincipal -Tenant $TenantID -Credential $Credential #$IIS = "bill36" #$Redi = "https://www.google.com" $parameters= [ordered]@{'SiteName' = 'bill36' ; Redirect = 'https://www.google.com'} $resourceGroupName = "OnPrem-Automation" $automationAccountName = "AzOnPrem-Automation" $runbookName1 = "US03wredirect-IIS" $hybridWorkerGroupName1 = "OnPrem-Automation" $runbookName2 = "US01WREDIRECT111-IIS-OnPrem-Automation1" $hybridWorkerGroupName2 = "OnPrem-Automation1" $job1 = Start-AzAutomationRunbook -ResourceGroupName $resourceGroupName -AutomationAccountName $automationAccountName -Name $runbookName1 -Parameters $parameters -RunOn $hybridWorkerGroupName1 -debug #$job2 = Start-AzAutomationRunbook -ResourceGroupName $resourceGroupName -AutomationAccountName $automationAccountName -Name $runbookName2 -Parameters $params2 -RunOn $hybridWorkerGroupName2
Arindam
Aug 13, 2024 Place Windows PowerShell
209Views
0likes
0Comments
Fabric API: Update user scopes
Context:Thetoken I generatedwas retrieved by logging in with 'Login-PowerBI', followed by "Get-PowerBiAccessToken -asstring"inside of Powershell. This token was then copied and used inside of postman for the authorization. I didn't use any extra parameters. Since thecurrent usage of a Service Principal is quite limitedfor the Fabric API, we'reopting to use the personal bearer token. Scenario:At our company we're trying to experiment a bit with the MS Fabric API (https://api.fabric.microsoft.com). With the service principal token, we've been able to use the API to list the workspaces, items, ... basically most standard get calls you could imagine. But, it doesn't support creating items yet via the service principal. So, we had to switch to the usage of a personal user token. We areable to create workspacesvia my individual token, but I'm unable to create individual items inside of a workspace. This is due to the fact thatI don't have any individual item level scopes assigned to mefor now. My current scopes are:"App.Read.All Capacity.Read.All Capacity.ReadWrite.All Content.Create Dashboard.Read.All Dashboard.ReadWrite.All Dataflow.Read.All Dataflow.ReadWrite.All Dataset.Read.All Dataset.ReadWrite.All Gateway.Read.All Gateway.ReadWrite.All Pipeline.Deploy Pipeline.Read.All Pipeline.ReadWrite.All Report.Read.All Report.ReadWrite.All StorageAccount.Read.All StorageAccount.ReadWrite.All Tenant.Read.All Tenant.ReadWrite.All UserState.ReadWrite.All Workspace.Read.All Workspace.ReadWrite.All" As you can see, it's quite normal that I'm only able to create a Workspace.But I want to be able to assign e.g. "Notebook.ReadWrite.All" to my user. How do I do this for an individual user?I'm trying to automate as much as possible using Powershell scripts, but the current scopes are quite limited. Goal: Using a personal bearer token (not generated through a service principal) to create a notebook item. Endpoint:https://learn.microsoft.com/en-us/rest/api/fabric/core/items/create-item?tabs=HTTP Question: Is it possible to do this without the usage of a service principal? I know you can use the copy(PowerBIAccessToken) inside of the dev-tools in your browser, but I want to do it more automatically. Hopefully this is the right section to ask such things, and thank you in advance for your help!
dver344
Jul 25, 2024 Place Windows PowerShell
314Views
0likes
0Comments
Important Update: Azure Automation Update Management and Log Analytics Agent Retirement
Important Update: Azure Automation Update Management and Log Analytics Agent Retirement Attention Azure users! This is a critical notice regarding the retirement of two key services: Azure Automation Update Management and the Log Analytics agent. Both will be discontinued on August 31, 2024. To ensure uninterrupted update management for your virtual machines, migrating to Azure Update Manager is essential before the retirement date. Why the Change? Microsoft is streamlining its update management offerings by focusing on Azure Update Manager, a robust solution with several advantages. These include: Simplified onboarding: Azure Update Manager leverages existing Azure features for effortless integration. Enhanced control: Granular access controls allow for precise management of update deployment. Flexible automation: Automatic patching capabilities streamline the update process. Taking Action: Migrate to Azure Update Manager To avoid disruptions after August 31st, migrating to Azure Update Manager is necessary. Microsoft provides a comprehensive guide to facilitate this transition: Move from Automation Update Management to Azure Update Manager https://learn.microsoft.com/en-us/azure/automation/update-management/overview This guide details the migration process, ensuring a smooth transfer to the new platform. Don't wait! Begin the migration process today to ensure your virtual machines receive updates seamlessly after the retirement of Azure Automation Update Management and the Log Analytics agent.
emadadel2008
Jul 01, 2024 Place Azure Tech Bites
414Views
0likes
1Comment