Schedule and Run PowerShell Scripts for Azure VMs using Azure Automation

A while ago I wrote a blog post on how you can run a PowerShell or Bash script against multiple Azure Virtual Machines (VMs) using Run Command. In this blog post we are going to have a look on how you can schedule and run PowerShell and Bash scripts against Azure virtual machines (VMs) using Azure Automation. For this we are going to use Azure Run Command and Azure Automation.

Run Command can run a PowerShell or shell script within an Azure VM remotely by using the Azure Virtual Machine Agent. This scenario is especially useful when you need to run scripts against Azure VMs where you do not have network access. You use Run Command for Azure VMs through the Azure portal, REST API, Azure CLI, or PowerShell. Like I showed you in my blog post on Microsoft Tech Community.

Azure Automation delivers a cloud-based automation, operating system updates, and configuration service that supports consistent management across your Azure and non-Azure environments. It offers a couple of distinctive features, in this blog we are going to use the process automation feature, which allows you to run automation inform of PowerShell runbooks. We are going to use Azure Automation to schedule the scripts to run on Azure VMs.

Set up Azure Automation Account

First, you will need to create an Azure Automation account, this is very straight forward.

On the Advanced tab, you can configure the managed identity option for your new Automation account. This is the identity under which the runbook can sign in into Azure PowerShell for example. In this case I am going to use a System assigned identity.

Check out Microsoft Docs for more information.

Set up a system assigned managed identity, role assignment and grant permissions

After you have created the Azure Automation account, you can grant permissions to the managed identity by using Azure role-based access control (Azure RBAC). The managed identity is authenticated with Azure AD, so you don’t have to store any credentials in code.

To grant permissions for the Azure VM you want the script to run against, you can create a new Azure role assignment under identity.

Here you can select the scope this can be on a subscription, resource group, or even resource level. In my case I want to run this script only on Azure VMs in a specific resource group, if you want to run it on a subscription level, you can change the scope.

Create an Azure Automation PowerShell Runbook

Now you can create a new Azure Automation PowerShell runbook, which will host the script you are going to run on a schedule.

For this runbook we are going to use a PowerShell type and runtime version 7.1. With PowerShell 7 and higher we can make use of the “-parallel” parameter and some other cool features.

Now you can copy and paste the following script. You need to change the $scriptCode variable with the code you want to run against your Azure VMs.

Write-Output "Connecting to azure via Connect-AzAccount -Identity"
Connect-AzAccount -Identity 
Write-Output "Successfully connected with Automation account's Managed Identity"

# Script which should run inside the Azure VMs (Edit this)
$scriptCode = '<PASTE CODE HERE>'

#Get all Azure VMs which are in running state and are running Windows
$myAzureVMs = Get-AzVM -status | Where-Object {$_.PowerState -eq "VM running" -and $_.StorageProfile.OSDisk.OSType -eq "Windows"}
Write-Output "The following VMs are running and are running Windows:" 
Write-Output $myAzureVMs.Name 

# Run the script against all the listed VMs
Write-Output "Run Script Against Machines"
$myAzureVMs | ForEach-Object { 
	Invoke-AzVMRunCommand -ResourceGroupName $_.ResourceGroupName -Name $_.Name -CommandId 'RunPowerShellScript' -ScriptString $scriptCode
}

Should look like this:

Make sure after you are done editing, Save and Publish the script.

Run Azure Automation Runbook PowerShell Script against Azure VMs

Now you can start the Runbook and it will run against the Azure VMs the Managed Identity has access to. No local user account and password is required to run this.

Schedule Azure Automation Runbook

If you have tested the runbook, you can now schedule it, by linking it to a schedule. For that press Link to schedule.

You will always be able to edit the schedule or unlink it from the runbook if you don’t need it anymore.

Conclusion

I hope this post was helpful and showed you how you can use Azure Automation to schedule and run PowerShell scripts against Azure VMs using Run Command. If you have any questions or comments, feel free to leave the below.