Connect with experts and redefine what’s possible at work – join us at the Microsoft 365 Community Conference May 6-8. Learn more >

Azure Automation

85 Topics

Ad-Hoc Entra MFA using SMS
Error : Get MFA Client Access TokenDone. Send MFA challenge to the user Done. OTP sent to your phone. Please enter the OTP: Enter the OTP sent via SMS: 696632 Invoke-RestMethod: C:\Git_Repo\MFA_Test\MFATestWIthKyle\sms.ps1:54:28 Line | 54 | … ionResult = Invoke-RestMethod -Uri 'https://strongauthenticationservi … | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Service BODY { color: #000000; background-color: white; font-family: Verdana; margin-left: 0px; margin-top: 0px; | } #content { margin-left: 30px; font-size: .70em; padding-bottom: 2em; } A:link { color: #336699; font-weight: bold; | text-decoration: underline; } A:visited { color: #6699cc; font-weight: bold; text-decoration: underline; } A:active { color: | #336699; font-weight: bold; text-decoration: underline; } .heading1 { background-color: #003366; border-bottom: #336699 6px | solid; color: #ffffff; font-family: Tahoma; font-size: 26px; font-weight: normal;margin: 0em 0em 10px -20px; padding-bottom: | 8px; padding-left: 30px;padding-top: 16px;} pre { font-size:small; background-color: #e5e5cc; padding: 5px; font-family: | Courier New; margin-top: 0px; border: 1px #f0f0e0 solid; white-space: pre-wrap; white-space: -pre-wrap; word-wrap: break-word; | } table { border-collapse: collapse; border-spacing: 0px; font-family: Verdana;} table th { border-right: 2px white solid; | border-bottom: 2px white solid; font-weight: bold; background-color: #cecf9c;} table td { border-right: 2px white solid; | border-bottom: 2px white solid; background-color: #e5e5cc;} Service Endpoint not found. WARNING: Invalid OTP or validation failed. Below line causing the error $mfaValidationResult = Invoke-RestMethod -Uri 'https://strongauthenticationservice.auth.microsoft.com/StrongAuthenticationService.svc/Connector//ValidatePin' -Method POST -Headers $Headers -Body $XML -ContentType 'application/xml'
Biswajit21
Feb 21, 2025 Place Windows PowerShell
19Views
0likes
0Comments
Log Analytics Agent-based Azure Management Services: Shut down starting 28 February 2025
Overview The legacy Log Analytics (LA) agent, which has played a critical role in transferring data logs for software and applications to Azure, was deprecated on August 31, 2024. Subsequently, all Azure services and solutions relying on the Log Analytics agent for data collection are also being phased out. This transition ensures a seamless shift to more robust replacement products, enhancing continuity, security, and performance for customers' IT estates. Two of the Azure Automation solutions provided management of machines using the LA agent namely, Azure Automation Update Management for streamline software update deployment & Azure Change Tracking & Inventory for tracking changes and inventory for in-guest environments. These agent-based services were also deprecated on 31 st August 2024. Over the last 6 months, these solutions were maintained, giving customers time to move their management processes to the replacement products. In order to ensure a security posture of the customer environments, these LA agent-based solutions will be completely shut down starting 28 th February 2025. You may encounter your existing patching jobs fail and staleness in the changes data in the log analytics workspace after this date. Following captures further details on the impact to operations for the machines that continue to be on these solutions and provides additional guidance. What will change after 28 th February 2025? a) You will not be able to access both Azure Automation Update Management & Azure Change Tracking & Inventory enabled with the LA agent from the Azure Portal. b) For Azure Automation Update Management, no new periodic assessments or patching data corresponding to configured machines will be populated. c) For Change Tracking & Inventory with LA agent, no new changes or inventory logs will be captured. Note: Historical data for the last 30 days will continue to be available in LA workspace and can be directly queried from the LA tables LA workspace table Purpose ConfigurationData To obtain inventory logs for auditing and compliance needs ConfigurationChange To obtain logs corresponding to the changes made in customer environment Update To query periodic assessments and patched updates data for pending updates view What next? If you have any machines configured with legacy version of above-mentioned services, please use one of the following available methods to migrate to replacements products – Product Service Product Migration Guidance Azure Change Tracking & Inventory with LA agent a) Migrate to Azure Monitoring Agent (AMA) version of Change Tracking & Inventory – Using Azure Portal Using PowerShell b) If you have enabled File Integrity monitoring (FIM) with LA agent & managing it via Change Tracking & Inventory experience, here are the available options to migrate to - Move to Change Tracking & Inventory with AMAfor enhanced insights for data types including Files, Registry Keys, Software, Windows Services, Linux Daemons, File content changes. Move to FIM with MDE (part of Defender for Servers Plan 2) Azure Automation Update Management Migrate to Azure Update Manager (Does not rely on AMA) Using Azure Portal Using Runbook scripts Additionally, you can refer to these instructions to disable LA agent from your environment. Please feel free to reach out to us on aumpm@microsoft.com for any queries or feedback.
Swatidevgan
Feb 17, 2025 Place Azure Governance and Management Blog
744Views
0likes
0Comments
find the azure vm status in multiple subscription
We have multiple subscription (more than 10) in our environment and MFA enabled , I was trying to find one vm status using the name but its not working , setting azcontext with tenant ID also not working , I need command to set all subscription as context and find the vm status or any other way to find the vm status , this is needed for daily work, appreciate someone help on this .
Sean145
Jan 22, 2025 Place Windows PowerShell
16Views
0likes
1Comment
Securing Your Azure Automation Variables Automatically
Upgrade the security of your Azure Automation environment effortlessly. Learn how to convert non-encrypted variables to encrypted ones using a simple PowerShell script—securing your secrets has never been easier!
BlakeDrumm
Dec 16, 2024 Place Azure Governance and Management Blog
348Views
2likes
0Comments
Modernizing Azure Automation: A 2023 Retrospective and Future outlook
Azure Automation is striving to become the best-in-class platform for resource management in an adaptive cloud.
Nikita_Bajaj
Dec 06, 2024 Place Azure Governance and Management Blog
6.3KViews
7likes
4Comments
Azure Change Tracking & Inventory: Simplified onboarding to manage in-guest changes on Azure Arc VMs
Explore new Azure native few clicks onboarding experience for Change Tracking & Inventory on Azure Arc servers, streamlining in-guest change management operations, while strengthening your adaptive cloud strategy.
Swatidevgan
Dec 02, 2024 Place Azure Governance and Management Blog
541Views
1like
1Comment
Azure Automation is revising Service and Subscription Limits
Starting 7 th January 2025, Azure Automation will be revising its Service and Subscription limits to ensure fair distribution of cloud resources across all customers. This change is another step towards improving the reliability and performance of the service while optimizing resource utilization. Since the resource requirements vary across organizations and evolve over time, we are empowering customers to configure their quotas based on actual usage. Revised limits The current Service and Subscription limits for Azure Automation can be found here. To start with, we are revising the limits for two resources: Maximum number of Automation accounts in a subscription in a region. Maximum number of concurrent running jobs at the same instance of time per Automation account You will get an error message when you exceed the limits mentioned below: Resource Limit Notes Maximum number of Automation accounts in a subscription in a region 10 2 1 Enterprise and CSP subscriptions would be able to create accounts in any of the regions supported by the service. Pay-as-you-go, Sponsored, MSDN, MPN, Azure Pass subscriptions can create Automation accounts in any of the regions supported by the service. Free trial, Azure for Student, Azure in Open subscriptions can create only one Automation account per region per subscription. Allowed list of regions: EastUS, EastUS2, WestUS, NorthEurope, SoutheastAsia, and JapanWest2 Maximum number of concurrent running jobs at the same instance of time per Automation account per region 50 10 5 Enterprise and CSP subscriptions Pay-as-you-go, Sponsored, MSDN, MPN, Azure Pass subscriptions Free trial, Azure for Student, Azure in Open subscriptions Frequently asked questions When will the new limits come into effect? New limits would be effective starting 7 th January 2025 across all commercial regions. Your patience during the transition period is appreciated. How do I check my current resource usage? You will be able to check your usage of Automation accounts and concurrently running jobs through Quotas service on Azure portal or while creating a support request under the category ‘Service and Subscription limits (Quotas)’. Quotas service on Azure portal will be enabled once deployment starts in January 2025. My current usage is more than the revised limits. What should I do? Rest assured that your current usage of both resources - Automation accounts and concurrent running jobs - will be honored and will not be impacted. For example, consider you are an Enterprise customer. Your new limit is 10 Automation accounts and current usage is 12 accounts. Even though your usage is higher than the new limit, your usage of 12 accounts would be honored and then considered as your new limit. When you exceed the new limit of 12 accounts, you would get an error. I need more resources than my current limits. What should I do? You will get complete control to request for quota increase and decrease based on your changing business requirements. Once the changes are deployed in January 2025, you will be able to check your current usage, current limit and request for quota changes by creating a support request under the category ‘Service and Subscription limits (Quotas)’ for ‘Azure Automation’. Detailed steps to request for quota changes would be shared once deployment starts in January 2025. Please feel free to reach out to askazureautomation@microsoft.com for any questions or feedback.
Nikita_Bajaj
Dec 02, 2024 Place Azure Governance and Management Blog
1.3KViews
0likes
0Comments
Does Microsoft stop support WMIC or WMI?
Hello everyone, Nice to meet you! I heard that MS has plans to deprecate and stop supporting the VB script very soon. I have few queries, please clarify Does Microsoft stop supporting WMIC or WMI along with the VB script? Can we use WMI commands in PowerShell scripts? thanks Madhu
madhugeddada
Nov 18, 2024 Place Windows PowerShell
57Views
0likes
1Comment
[resolved] Variables are not consistent
Hello internet. My mind is completely blown by this! I have a PowerAutomate that sets some 'compose' actions and then uses them to start a job. It is a PowerShell 7.2 script running in a Runbook extension-based hybrid worker on a Debian 11 Azure VM. I've reduced the script to just printing the inputted variable values. That's all, yet it provides them transposed! param ( [string] $siteNAME, [string] $OMd, [string] $userNAME, [string] $templateNAME ) $scriptVERSION = "x.y.z" function WO { write-output $wriOU } write-output "----------------------------------" $wriOU = "siteNAME: "+$($siteNAME);WO $wriOU = "OMd: "+$($OMd);WO $wriOU = "userNAME: "+$($userNAME);WO $wriOU = "templateNAME: "+$($templateNAME);WO write-output "----------------------------------" $wriOU = "Script Version: [ "+$scriptVERSION+" ]";WO write-output "-end of line-" #EOF As you can see 'siteNAME' retains the value correctly. But then 'OMd', 'username', and 'templateNAME' goes sideways so hard... Why? What am I doing wrong, this seems super odd... Any insight is greaaaatly appreciated. TY!
Solved
webmasterSANTEE
Sep 13, 2024 Place Windows PowerShell
364Views
0likes
2Comments
Facing error when running a ps script using mggraph
Hi Community, I am facing issue in fetching lastsignindate from azure ad using mggraph it returns error of 404 not found whereas user is present in azure ad. The script i am sharing has some fields blank for security reasons: # Function to authenticate with Microsoft Graph function Get-GraphToken { param ( [string]$tenantId, [string]$clientId, [string]$clientSecret, [string]$authUrl ) $authBody = @{ grant_type = "client_credentials" scope = "https://graph.microsoft.com/.default" client_id = $clientId client_secret = $clientSecret } try { $tokenResponse = Invoke-RestMethod -Method Post -Uri $authUrl -ContentType "application/x-www-form-urlencoded" -Body $authBody return $tokenResponse.access_token } catch { Write-Error "Failed to authenticate with Microsoft Graph: $_" return $null } } # Function to get the most recent LastLogon attribute from all domain controllers function Get-LastLogon { param ( [string]$userName ) $dcs = Get-ADDomainController -Filter * | Select-Object -ExpandProperty HostName $lastLogon = 0 foreach ($dc in $dcs) { try { $user = Get-ADUser $userName -Server $dc -Properties LastLogon if ($user.LastLogon -gt $lastLogon) { $lastLogon = $user.LastLogon } } catch { Write-Error "Failed to retrieve LastLogon from $dc for $userName $_" } } if ($lastLogon -ne 0) { return [DateTime]::FromFileTime($lastLogon) } else { return $null } } # Function to get last sign-in date from Azure AD using User ID function Get-UserLastSignIn { param ( [string]$userId, [hashtable]$headers ) try { # Get the user's sign-in activity using userId $userInfo = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/$userId?$select=signInActivity" -Headers $headers if ($userInfo.signInActivity -and $userInfo.signInActivity.lastSignInDateTime) { # Return the lastSignInDateTime return [DateTime]::Parse($userInfo.signInActivity.lastSignInDateTime) } else { Write-Warning "No sign-in activity available for user with ID $userId." return $null } } catch { Write-Error "Failed to retrieve sign-in data for user with ID $userId $_" return $null } } # Function to send notification function Send-Notification { param ( [string]$userEmail, [string]$managerEmail ) $subject = "Login Reminder" $body = "You have not logged in for the past 10 days. Please log in to avoid account deactivation." # Uncomment the below line to send the actual email # Send-MailMessage -From "" -To $userEmail -Cc $managerEmail -Subject $subject -Body $body -SmtpServer $smtpServer } # Function to create and send the HTML report function Create-And-Send-HTMLReport { param ( [array]$csvData, [string]$htmlReportPath ) $htmlContent = @" <html> <head> <title>User Login Report</title> <style> table { width: 100%; border-collapse: collapse; } table, th, td { border: 1px solid black; } th, td { padding: 8px; text-align: left; } </style> </head> <body> <h2>User Login Report</h2> <table> <tr> <th>samAccountName</th> <th>DisplayName</th> <th>MailSentToManager</th> <th>LastLogonOnPrem</th> <th>LastLogonAzureAD</th> <th>SessionRevoked</th> <th>Action</th> </tr> "@ foreach ($row in $csvData) { $htmlContent += "<tr>" $htmlContent += "<td>$($row.samAccountName)</td>" $htmlContent += "<td>$($row.DisplayName)</td>" $htmlContent += "<td>$($row.MailSentToManager)</td>" $htmlContent += "<td>$($row.LastLogonOnPrem)</td>" $htmlContent += "<td>$($row.LastLogonAzureAD)</td>" $htmlContent += "<td>$($row.SessionRevoked)</td>" $htmlContent += "<td>$($row.Action)</td>" $htmlContent += "</tr>" } $htmlContent += @" </table> </body> </html> "@ # Save the HTML content to a file $htmlContent | Out-File -FilePath $htmlReportPath -Encoding UTF8 # Uncomment the below line to send the actual email # Send-MailMessage -From "" -To "" -Subject "Daily User Login HTML Report" -BodyAsHtml -Body $htmlContent -SmtpServer $smtpServer } # Function to send daily report to IT function Send-DailyReport { param ( [string]$reportPath ) $subject = "Daily User Login Report" $body = Get-Content -Path $reportPath -Raw # Uncomment the below line to send the actual email # Send-MailMessage -From "" -To "" -Subject $subject -Body $body -BodyAsHtml -SmtpServer $smtpServer -Port $smtpPort } # Main script starts here # Define variables $tenantId = "" $clientSecret = "" $clientId = "" $authUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" $smtpServer = "" $smtpPort = $departmentsFilePath = "C:\psscr\Departments.txt" # Authenticate with Microsoft Graph $token = Get-GraphToken -tenantId $tenantId -clientId $clientId -clientSecret $clientSecret -authUrl $authUrl # Ensure that the token was successfully obtained if (-not $token) { Write-Error "Failed to obtain Microsoft Graph token. Exiting script." exit } $headers = @{ Authorization = "Bearer $token" } # Set cut-off dates $cutOffDate10Days = (Get-Date).AddDays(-10) $cutOffDate15Days = (Get-Date).AddDays(-15) # Check departments $departments = Get-Content -Path $departmentsFilePath # Initialize CSV report $currentDateTime = (Get-Date).ToString("dd-MM-yyyy_HH-mm") $csvFilePath = "C:\psscr\DailyUserLoginReport_$currentDateTime.csv" $htmlReportPath = "C:\psscr\DailyUserLoginReport_$currentDateTime.html" $csvData = @() # Process each department foreach ($dept in $departments) { $users = Get-ADUser -Filter { Department -eq $dept } -Properties LastLogonTimestamp, Manager, Enabled, UserPrincipalName, DisplayName foreach ($user in $users) { if (-not $user.Enabled) { continue } # Get the most recent LastLogon from AD $lastLogon = Get-LastLogon -userName $user.SamAccountName $lastLogonString = if ($lastLogon) { $lastLogon.ToString("yyyy-MM-dd HH:mm:ss") } else { "Never" } # Get the user's Azure AD ID $userResponse = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq '$($user.UserPrincipalName)'" -Headers $headers # Find the user with the exact UserPrincipalName match $userId = $null foreach ($responseUser in $userResponse.value) { if ($responseUser.userPrincipalName -eq $user.UserPrincipalName) { $userId = $responseUser.id break } } #$userId = $userResponse.value[$user.UserPrincipalName].id # Ensure that a valid userId was retrieved if ($null -eq $userId) { Write-Warning "Could not retrieve userId for $($user.UserPrincipalName). Skipping..." continue } # Get the most recent last sign-in date from Azure AD using ID $lastSignInDate = Get-UserLastSignIn -userId $userId -headers $headers $lastSignInDateString = if ($lastSignInDate) { $lastSignInDate.ToString("yyyy-MM-dd HH:mm:ss") } else { "Never" } $action = "" $mailSent = $false $sessionRevoked = $false if ($lastLogon -lt $cutOffDate10Days -and $lastSignInDate -lt $cutOffDate10Days) { # Send notification to the user and manager $manager = Get-ADUser -Identity $user.Manager -Properties EmailAddress Send-Notification -userEmail $user.EmailAddress -managerEmail $manager.EmailAddress $mailSent = $true } if ($lastLogon -lt $cutOffDate15Days -and $lastSignInDate -lt $cutOffDate15Days) { # Revoke Azure AD sessions and disable the on-premises AD account # Uncomment the below line to revoke Azure AD sessions # Invoke-RestMethod -Method Post -Uri "https://graph.microsoft.com/v1.0/users/$userId/revokeSignInSessions" -Headers $headers #Disable-ADAccount -Identity $user.SamAccountName $action = "Account Disabled" $sessionRevoked = $true } $csvData += [pscustomobject]@{ samAccountName = $user.SamAccountName DisplayName = $user.DisplayName MailSentToManager = $mailSent LastLogonOnPrem = $lastLogonString LastLogonAzureAD = $lastSignInDateString SessionRevoked = $sessionRevoked Action = $action } } } # Export to CSV $csvData | Export-Csv -Path $csvFilePath -NoTypeInformation # Create and send the HTML report Create-And-Send-HTMLReport -csvData $csvData -htmlReportPath $htmlReportPath # Send the daily report to IT Send-DailyReport -reportPath $htmlReportPath Any help is appreciated why this error occurs is known to us that it is not found will this need changes in script or something else. The permissions given to Azure app is correct as is does not show permission error when running the script.
Solved
vrush96
Sep 02, 2024 Place Windows PowerShell
471Views
0likes
6Comments