You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
pageTitle="Configure Azure Run As account | Microsoft Azure"
2
+
pageTitle="Configure Azure Run As Account | Microsoft Azure"
3
3
description="Tutorial that walks you through the creation, testing, and example use of security principal authentication in Azure Automation."
4
4
services="automation"
5
5
documentationCenter=""
@@ -13,63 +13,58 @@
13
13
ms.tgt_pltfrm="na"
14
14
ms.devlang="na"
15
15
ms.topic="get-started-article"
16
-
ms.date="07/29/2016"
16
+
ms.date="08/17/2016"
17
17
ms.author="magoedte"/>
18
18
19
-
# Authenticate runbooks with an Azure Run As account
19
+
# Authenticate Runbooks with Azure Run As account
20
20
21
-
This topic will show you how to configure an Azure Automation account from the Azure portal by using the Run As account feature to authenticate runbooks that manage resources in either Azure Resource Manager or Azure Service Management.
21
+
This topic will show you how to configure an Automation account from the Azure portal using the Run As account feature to authenticate runbooks managing resources in either Azure Resource Manager or Azure Service Management.
22
22
23
-
The process that creates a new Automation account in the Azure portal also automatically:
23
+
When you create a new Automation account in the Azure portal, it automatically creates:
24
24
25
-
- Creates a Run As account that:
26
-
- Creates a new service principal in Azure Active Directory.
27
-
- Creates a certificate.
28
-
- Assigns the Contributor role-based access control (RBAC), which will be used to manage Resource Manager resources by using runbooks.
29
-
- Creates a Classic Run As account by uploading a management certificate, which will be used to manage Azure Service Management or classic resources by using runbooks.
25
+
- Run As account which creates a new service principal in Azure Active Directory, a certificate, and assigns the Contributor role-based access control (RBAC), which will be used to manage Resource Manager resources using runbooks.
26
+
- Classic Run As account by uploading a management certificate, which will be used to manage Azure Service Management or classic resources using runbooks.
30
27
31
-
This simplifies the process for you and helps you quickly start to build and deploy runbooks to support your automation needs.
28
+
This simplifies the process for you and helps you quickly start building and deploying runbooks to support your automation needs.
32
29
33
-
When you use a Run As and Classic Run As account, you can:
30
+
Using a Run As and Classic Run As account, you can:
34
31
35
-
- Provide a standardized way to authenticate with Azure when you manage Azure Resource Manager or Azure Service Management resources from runbooks in the Azure portal.
36
-
- Automate the use of global runbooks that are configured in Azure Alerts.
32
+
- Provide a standardized way to authenticate with Azure when managing Azure Resource Manager or Azure Service Management resources from runbooks in the Azure portal.
33
+
- Automate the use of global runbooks configured in Azure Alerts.
37
34
38
35
39
-
>[AZURE.NOTE] The Azure [Alert integration feature](../azure-portal/insights-receive-alert-notifications.md) with Automation global runbooks requires an Automation account that is configured with a Run As and Classic Run As account. You can either select an Automation account that already has a defined Run As and Classic Run As account, or you can create a new account.
36
+
>[AZURE.NOTE] The Azure [Alert integration feature](../azure-portal/insights-receive-alert-notifications.md) with Automation Global Runbooks requires an Automation account that is configured with a Run As and Classic Run As account. You can either select an Automation account that already has a Run As and Classic Run As account defined or choose to create a new one.
40
37
41
-
We will show you how to create the Automation account from the Azure portal, how to update an Automation account by using PowerShell, and how to authenticate in your runbooks.
38
+
We will show you how to create the Automation account from the Azure portal, update an Automation account using PowerShell, and demonstrate how to authenticate in your runbooks.
42
39
43
-
Before we do that, there are a few things that you should understand and consider:
40
+
Before we do that, there are a few things that you should understand and consider before proceeding.
44
41
45
-
- This does not affect existing Automation accounts that are already created in either the classic or Resource Manager deployment model.
46
-
- This will only work for Automation accounts that you created through the Azure portal. If you attempt to create an account from the Azure classic portal, the account will not replicate the Run As account configuration.
47
-
- You might have runbooks and assets (for example, schedules and variables) that were previously created to manage classic resources, and you might want those runbooks to authenticate with the new Classic Run As account. You will need to migrate the runbooks to the new Automation account or update your existing account by using the PowerShell script later in this article.
48
-
- To authenticate by using the new Run As account and Classic Run As Automation account, you will need to modify your existing runbooks with the example code later in this article.
42
+
1. This does not impact existing Automation accounts already created in either the classic or Resource Manager deployment model.
43
+
2. This will only work for Automation accounts created through the Azure portal. Attempting to create an account from the classic portal will not replicate the Run As account configuration.
44
+
3. If you currently have runbooks and assets (i.e. schedules, variables, etc.) previously created to manage classic resources, and you want those runbooks to authenticate with the new Classic Run As account, you will need to migrate them to the new Automation account or update your existing account using the PowerShell script below.
45
+
4. To authenticate using the new Run As account and Classic Run As Automation account, you will need to modify your existing runbooks with the example code below. **Please note** that the Run As account is for authentication against Resource Manager resources using the certificate-based service principal, and the Classic Run As account is for authenticating against Service Management resources with the management certificate.
49
46
50
-
>[AZURE.NOTE] The Run As account is for authentication against Resource Manager resources by using the certificate-based service principal. The Classic Run As account is for authenticating against Service Management resources by using the management certificate.
51
47
48
+
## Create a new Automation Account from the Azure Portal
52
49
53
-
## Create a new Automation account from the Azure portal
50
+
In this section, you will perform the following steps to create a new Azure Automation account from the Azure portal. This creates both the Run As and classic Run As account.
54
51
55
-
In this section, you will create a new Azure Automation account by using the Azure portal. This creates both the Run As and Classic Run As accounts.
52
+
>[AZURE.NOTE] The user performing these steps *must* be a member of the Subscription Admins role and co-administrator of the subscription which is granting access to the subscription for the user. The user must also be added as a User to that subscriptions default Active Directory; the account does not need to be assigned to a privileged role.
56
53
57
-
>[AZURE.NOTE] To perform these steps, you *must* be a member of the Subscription Admins role and co-administrator of the subscription that is granting access to the subscription for the user. You must also add the user as a User to that subscription's default Azure Active Directory (Azure AD). The account does not need to be assigned to a privileged role.
58
-
59
-
1. Sign in to the Azure portal with an account that is a member of the Subscription Admins role and a co-administrator of the subscription.
54
+
1. Log in to the Azure portal with an account that is a member of the Subscription Admins role and co-administrator of the subscription.
60
55
2. Select **Automation Accounts**.
61
-
3. In the Automation Accounts blade, click **Add**.<br>
62
-
63
-
>[AZURE.NOTE] If you see the following warning in the **Add Automation Account** blade, your account is not a member of the Subscription Admins role and a co-admin of the subscription.<br>
56
+
3. In the Automation Accounts blade, click **Add**.<br>
64
57
65
-
4. In the **Add Automation Account** blade, in the **Name**, box type a name for your new Automation account.
66
-
5. If you have more than one subscription, specify one for the new account, a new or existing **Resource group**, and an Azure datacenter **Location**.
67
-
6. Verify that **Yes** is selected for the **Create Azure Run As account** option, and then click the **Create** button.
58
+
>[AZURE.NOTE] If you see the following warning in the **Add Automation Account** blade, this is because your account is not a member of the Subscription Admins role and co-admin of the subcription.<br>
68
59
69
-
>[AZURE.NOTE] If you choose to not create the Run As account by selecting the **No** option, you will see a warning message in the **Add Automation Account** blade. Although the account is created in the Azure portal, it will not have a corresponding authentication identity within your classic or Resource Manager subscription directory service. Therefore, the account will not have access to resources in your subscription. This will prevent any runbooks that reference this account from being able to authenticate and perform tasks against resources in those deployment models.
60
+
4. In the **Add Automation Account** blade, in the **Name** box type in a name for your new Automation account.
61
+
5. If you have more than one subscription, specify one for the new account, as well as a new or existing **Resource group** and an Azure datacenter **Location**.
62
+
6. Verify the value **Yes** is selected for the **Create Azure Run As account** option, and click the **Create** button.
70
63
64
+
>[AZURE.NOTE] If you choose to not create the Run As account by selecting the option **No**, you will be presented with a warning message in the **Add Automation Account** blade. While the account is created in the Azure portal, it will not have a corresponding authentication identity within your classic or Resource Manager subscription directory service and therefore, no access to resources in your subscription. This will prevent any runbooks referencing this account from being able to authenticate and perform tasks against resources in those deployment models.
When the service principal is not created, the Contributor role will not be assigned.
67
+
When the service principal is not created the Contributor role will not be assigned.
73
68
74
69
75
70
7. While Azure creates the Automation account, you can track the progress under **Notifications** from the menu.
@@ -78,80 +73,80 @@ In this section, you will create a new Azure Automation account by using the Azu
78
73
79
74
When the Automation account is successfully created, several resources are automatically created for you. The following table summarizes resources for the Run As account.<br>
80
75
81
-
Resource|Description
82
-
----|----
83
-
AzureAutomationTutorial Runbook|An example PowerShell runbook that demonstrates how to authenticate by using the Run As account and then gets all the Resource Manager resources.
84
-
AzureAutomationTutorialScript Runbook|An example PowerShell runbook that demonstrates how to authenticate by using the Run As account and then gets all the Resource Manager resources.
85
-
AzureRunAsCertificate|A certificate asset that is automatically created during Automation account creation or by using the PowerShell script later in this article for an existing account. With the certificate, you can authenticate with Azure so that you can manage Azure Resource Manager resources from runbooks. This certificate has a one-year lifespan.
86
-
AzureRunAsConnection|A connection asset that is automatically created during Automation account creation or by using the PowerShell script later in this article for an existing account.
76
+
Resource|Description
77
+
--------|-----------
78
+
AzureAutomationTutorial Runbook|An example PowerShell runbook that demonstrates how to authenticate using the Run As account and gets all the Resource Manager resources.
79
+
AzureAutomationTutorialScript Runbook|An example PowerShell runbook that demonstrates how to authenticate using the Run As account and gets all the Resource Manager resources.
80
+
AzureRunAsCertificate|Certificate asset automatically created during Automation account creation or using the PowerShell script below for an existing account. It allows you to authenticate with Azure so that you can manage Azure Resource Manager resources from runbooks. This certificate has a one-year lifespan.
81
+
AzureRunAsConnection|Connection asset automatically created during Automation account creation or using the PowerShell script below for an existing account.
87
82
88
83
The following table summarizes resources for the Classic Run As account.<br>
89
84
90
-
Resource|Description
91
-
----|----
92
-
AzureClassicAutomationTutorial Runbook|An example runbook that gets all the classic virtual machines (VMs) in a subscription by using the Classic Run As Account (certificate) and then returns the VM name and status.
93
-
AzureClassicAutomationTutorial Script Runbook|An example runbook that gets all the classic VMs in a subscription by using the Classic Run As Account (certificate) and then returns the VM name and status.
94
-
AzureClassicRunAsCertificate|A certificate asset that is automatically created and used to authenticate with Azure so that you can manage Azure classic resources from runbooks. This certificate has a one-year lifespan.
95
-
AzureClassicRunAsConnection|A connection asset that is automatically created and used to authenticate with Azure so that you can manage Azure classic resources from runbooks.
85
+
Resource|Description
86
+
--------|-----------
87
+
AzureClassicAutomationTutorial Runbook|An example runbook which gets all the Classic VMs in a subscription using the Classic Run As Account (certificate) and then outputs the VM name and status.
88
+
AzureClassicAutomationTutorial Script Runbook|An example runbook which gets all the Classic VMs in a subscription using the Classic Run As Account (certificate) and then outputs the VM name and status.
89
+
AzureClassicRunAsCertificate|Certificate asset automatically created that is used to authenticate with Azure so that you can manage Azure classic resources from runbooks. This certificate has a one-year lifespan.
90
+
AzureClassicRunAsConnection|Connection asset automatically created that is used to authenticate with Azure so that you can manage Azure classic resources from runbooks.
96
91
97
92
## Verify Run As authentication
98
93
99
-
Next, we will perform a small test to confirm that you can successfully authenticate by using the new Run As account.
94
+
Next we will perform a small test to confirm you are able to successfully authenticate using the new Run As account.
100
95
101
-
1. In the Azure portal, open the Automation account that you created earlier.
102
-
2. Click the **Runbooks** tile to open the list of runbooks.
103
-
3. Select the **AzureAutomationTutorialScript** runbook, and then click **Start** to start the runbook. You will receive a prompt to verify that you want to start the runbook.
104
-
4. A [runbook job](automation-runbook-execution.md) is created and the **Job** blade shows the job status in the **Job Summary** tile.
105
-
The job status will start as *Queued*to indicate that the job is waiting for a runbook worker in the cloud to become available. The status will move to *Starting* when a worker claims the job and then to*Running* when the runbook actually starts running.
106
-
When the runbook job finishes, the status is**Completed**.<br> <br>
107
-
5. To see the detailed results of the runbook, click the **Output** tile.<br>
108
-
In the **Output** blade, you should see that the account has successfully authenticated and returned a list of all resources that are available in the resource group.
109
-
6. Close the **Output** blade to return to the **Job Summary** blade.
110
-
7. Close the **Job Summary** and the corresponding **AzureAutomationTutorialScript** runbook blade.
96
+
1. In the Azure Portal, open the Automation account created earlier.
97
+
2. Click on the **Runbooks** tile to open the list of runbooks.
98
+
3. Select the **AzureAutomationTutorialScript** runbook and then click **Start** to start the runbook. You will receive a prompt verifying you wish to start the runbook.
99
+
4. A [runbook job](automation-runbook-execution.md) is created, the Job blade is displayed, and the job status displayed in the **Job Summary** tile.
100
+
5.The job status will start as *Queued*indicating that it is waiting for a runbook worker in the cloud to become available. It will then move to *Starting* when a worker claims the job, and then *Running* when the runbook actually starts running.
101
+
6.When the runbook job completes, we should see a status of**Completed**.<br> <br>
102
+
7. To see the detailed results of the runbook, click on the **Output** tile.
103
+
8.In the **Output** blade, you should see it has successfully authenticated and returned a list of all resources available in the resource group.
104
+
9. Close the **Output** blade to return to the **Job Summary** blade.
105
+
13. Close the **Job Summary** and the corresponding **AzureAutomationTutorialScript** runbook blade.
111
106
112
107
## Verify Classic Run As authentication
113
108
114
-
Next, we will perform a small test to confirm that you can successfully authenticate by using the new Classic Run As account.
109
+
Next we will perform a small test to confirm you are able to successfully authenticate using the new Classic Run As account.
115
110
116
-
1. In the Azure portal, open the Automation account that you created earlier.
117
-
2. Click the **Runbooks** tile to open the list of runbooks.
118
-
3. Select the **AzureClassicAutomationTutorialScript** runbook, and then click **Start** to start the runbook. You will receive a prompt to verify that you want to start the runbook.
119
-
4. A [runbook job](automation-runbook-execution.md) is created, the Job blade opens, and the job status is displayed in the **Job Summary** tile.
120
-
The job status will start as *Queued*to indicate that the job is waiting for a runbook worker in the cloud to become available. It will move to *Starting* when a worker claims the job and then to*Running* when the runbook actually starts running.
121
-
When the runbook job finishes, we should see a status of **Completed**.<br> <br>
122
-
5. To see the detailed results of the runbook, click the **Output** tile.<br>
123
-
In the **Output** blade, you should see that the account has successfully authenticated and returned a list of all classic VMs in the subscription.
124
-
6. Close the **Output** blade to return to the **Job Summary** blade.
125
-
7. Close the **Job Summary** and the corresponding **AzureClassicAutomationTutorialScript** runbook blade.
111
+
1. In the Azure Portal, open the Automation account created earlier.
112
+
2. Click on the **Runbooks** tile to open the list of runbooks.
113
+
3. Select the **AzureClassicAutomationTutorialScript** runbook and then click **Start** to start the runbook. You will receive a prompt verifying you wish to start the runbook.
114
+
4. A [runbook job](automation-runbook-execution.md) is created, the Job blade is displayed, and the job status displayed in the **Job Summary** tile.
115
+
5.The job status will start as *Queued*indicating that it is waiting for a runbook worker in the cloud to become available. It will then move to *Starting* when a worker claims the job, and then *Running* when the runbook actually starts running.
116
+
6.When the runbook job completes, we should see a status of **Completed**.<br> <br>
117
+
7. To see the detailed results of the runbook, click on the **Output** tile.
118
+
8.In the **Output** blade, you should see it has successfully authenticated and returned a list of all classic VM’s in the subscription.
119
+
9. Close the **Output** blade to return to the **Job Summary** blade.
120
+
13. Close the **Job Summary** and the corresponding **AzureClassicAutomationTutorialScript** runbook blade.
126
121
127
-
## Update an Automation account by using PowerShell
122
+
## Update an Automation Account using PowerShell
128
123
129
124
Here we provide you with the option to use PowerShell to update your existing Automation account if:
130
125
131
-
- You created an Automation account, but you declined to create the Run As account.
132
-
- You already have an Automation account to manage Resource Manager resources, and you want to update it to include the Run As account for runbook authentication.
133
-
- You already have an Automation account to manage classic resources, and you want to update it to use the Classic Run As instead of creating a new account and migrating your runbooks and assets to it.
126
+
1. You created an Automation account, but declined to create the Run As account
127
+
2. You already have an Automation account to manage Resource Manager resources and you want to update it to include the Run As account for runbook authentication
128
+
2. You already have an Automation account to manage classic resources and you want to update it to use the Classic Run As instead of creating a new account and migrating your runbooks and assets to it
134
129
135
-
Before proceeding, verify the following:
130
+
Before proceeding, please verify the following:
136
131
137
-
- You have downloaded and installed [Windows Management Framework (WMF) 4.0](https://www.microsoft.com/download/details.aspx?id=40855) if you are running Windows 7.
138
-
If you are running Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7 SP1, [Windows Management Framework 5.0](https://www.microsoft.com/download/details.aspx?id=50395) is available for installation.
139
-
- You have installed Azure PowerShell 1.0. For information about this release and how to install it, see [How to install and configure Azure PowerShell](../powershell-install-configure.md).
140
-
- You have created an automation account. This account will be referenced as the value for *–AutomationAccountName* and *-ApplicationDisplayName* parameters in both scripts in the following sections.
132
+
1. You have downloaded and installed [Windows Management Framework (WMF) 4.0](https://www.microsoft.com/download/details.aspx?id=40855) if you are running Windows 7.
133
+
If you are running Windows Server 2012 R2, Windows Server 2012, Windows 2008 R2, Windows 8.1, and Windows 7 SP1, [Windows Management Framework 5.0](https://www.microsoft.com/download/details.aspx?id=50395) is available for installation.
134
+
2.Azure PowerShell 1.0. For information about this release and how to install it, see [How to install and configure Azure PowerShell](../powershell-install-configure.md).
135
+
3. You have created an automation account. This account will be referenced as the value for parameters –AutomationAccountName and -ApplicationDisplayNamein both scripts below.
141
136
142
-
To get the values for *SubscriptionID*, *ResourceGroup*, and *AutomationAccountName*, which are required parameters for the scripts, in the Azure portal, select your Automation account from the **Automation account** blade, and then select **All settings**. From the **All settings** blade, under **Account Settings**, select **Properties**. In the **Properties** blade, you can note these values.<br> 
137
+
To get the values for *SubscriptionID*, *ResourceGroup*, and *AutomationAccountName*, which are required parameters for the scripts, in the Azure portal select your Automation account from the **Automation account** blade and select **All settings**. From the **All settings** blade, under **Account Settings** select **Properties**. In the **Properties** blade, you can note these values.<br> 
143
138
144
-
### Create a Run As account PowerShell script
139
+
### Create Run As Account PowerShell script
145
140
146
-
The following PowerShell script will configure:
141
+
The PowerShell script below will configure the following:
147
142
148
-
- An Azure AD application that will be authenticated with the self-signed certificate, create a service principal account for this application in Azure AD, and assign the Contributor role for this account in your current subscription. You can change Contributor to Owner or any other role. For further information, review the [Role-Based Access Control in Azure Automation](../automation/automation-role-based-access-control.md) article.
149
-
- An Automation certificate asset in the specified automation account named AzureRunAsCertificate. The asset holds the certificate that the service principal uses.
150
-
- An Automation connection asset in the specified automation account named AzureRunAsConnection. The asset holds the application ID, tenant ID, subscription ID, and certificate thumbprint.
143
+
- An Azure AD application that will be authenticated with the self-signed cert, create a service principal account for this application in Azure AD, and assigned the Contributor role (you could change this to Owner or any other role) for this account in your current subscription. For further information, please review the [Role-based access control in Azure Automation](../automation/automation-role-based-access-control.md) article.
144
+
- An Automation certificate asset in the specified automation account named **AzureRunAsCertificate**, which holds the certificate used by the service principal.
145
+
- An Automation connection asset in the specified automation account named **AzureRunAsConnection**, which holds the applicationId, tenantId, subscriptionId, and certificate thumbprint.
151
146
152
-
The following steps will walk you through the process of executing the script.
147
+
The steps below will walk you through the process of executing the script.
153
148
154
-
1. Save the following script on your computer. In this example, save it with the file name**New-AzureServicePrincipal.ps1**.
149
+
1. Save the following script on your computer. In this example, save it with the filename**New-AzureServicePrincipal.ps1**.
155
150
156
151
#Requires -RunAsAdministrator
157
152
Param (
@@ -215,7 +210,7 @@ The following steps will walk you through the process of executing the script.
2. On your computer, start **Windows PowerShell** from the **Start** screen with elevated user rights.
234
-
3. From the elevated PowerShell command-line shell, go to the folder that contains the script that you created in Step 1 and execute the script. Change the values for the *–ResourceGroup*, *-AutomationAccountName*, *-ApplicationDisplayName*, *-SubscriptionId*, and *-CertPlainPassword* parameters.<br>
235
-
236
-
>[AZURE.NOTE] You will be prompted to authenticate with Azure after you execute the script. You must sign in with an account that is a member of the Subscription Admins role and that is a co-admin of the subscription.
229
+
3. From the elevated PowerShell command-line shell, navigate to the folder which contains the script created in Step 1 and execute the script changing the values for parameters *–ResourceGroup*, *-AutomationAccountName*, *-ApplicationDisplayName*, *-SubscriptionId*, and *-CertPlainPassword*.<br>
>[AZURE.NOTE] You will be prompted to authenticate with Azure after you execute the script. You must log in with an account that is a member of the Subscription Admins role and co-admin of the subscription.
After the script finishes successfully, refer to the [sample code](#sample-code-to-authenticate-with-resource-manager-resources) to authenticate with Resource Manager resources and validate credential configuration.
240
+
After the script completes successfully, refer to the [sample code](#sample-code-to-authenticate-with-resource-manager-resources)below to authenticate with Resource Manager resources and validate credential configuration.
246
241
247
-
### Create a Classic Run As account PowerShell script
242
+
### Create Classic Run As account PowerShell script
248
243
249
-
The following PowerShell script will configure:
244
+
The PowerShell script below will configure the following:
250
245
251
-
- An Automation certificate asset in the specified automation account named **AzureClassicRunAsCertificate**. The asset holds the certificate that is used to authenticate your runbooks.
252
-
- An Automation connection asset in the specified automation account named **AzureClassicRunAsConnection**. The asset holds the subscription name, subscription ID, and certificate asset name.
246
+
- An Automation certificate asset in the specified automation account named **AzureClassicRunAsCertificate**, which holds the certificate used to authenticate your runbooks.
247
+
- An Automation connection asset in the specified automation account named **AzureClassicRunAsConnection**, which holds the subscription name, subscriptionId and certificate asset name.
253
248
254
-
The script will create a self-signed management certificate and save it to the temporary files folder on your computer under the user profile used to execute the PowerShell session: *%USERPROFILE%\AppData\Local\Temp*. After script execution, you will need to upload the Azure management certificate to the management store for the subscription that the Automation account was created in. The following steps will walk you through the process of executing the script and uploading the certificate.
249
+
The script will create a self-signed management certificate and save it to the temporary files folder on your computer under the user profile used to execute the PowerShell session - *%USERPROFILE%\AppData\Local\Temp*. After script execution, you will need to upload the Azure management certificate into the management store for the subscription the Automation account was created in. The steps below will walk you through the process of executing the script and uploading the certificate.
255
250
256
-
1. Save the following script on your computer. In this example, save it with the file name**New-AzureClassicRunAsAccount.ps1**.
251
+
1. Save the following script on your computer. In this example, save it with the filename**New-AzureClassicRunAsAccount.ps1**.
257
252
258
253
#Requires -RunAsAdministrator
259
254
Param (
@@ -297,46 +292,46 @@ The script will create a self-signed management certificate and save it to the t
# Create an Automation connection asset named AzureClassicRunAsConnection in the Automation account. This connection uses ClassicCertificateAssetName.
295
+
# Create a Automation connection asset named AzureClassicRunAsConnection in the Automation account. This connection uses the ClassicCertificateAssetName.
Write-Host -ForegroundColor red "Please upload the cert $CertPathCer to the Management store by following the steps below."
307
302
Write-Host -ForegroundColor red "Log in to the Microsoft Azure Management portal (https://manage.windowsazure.com) and select Settings -> Management Certificates."
308
303
Write-Host -ForegroundColor red "Then click Upload and upload the certificate $CertPathCer"
309
304
310
305
2. On your computer, start **Windows PowerShell** from the **Start** screen with elevated user rights.
311
-
3. From the elevated PowerShell command-line shell, go to the folder that contains the script that you created in Step 1, and execute the script. Change the values for the*–ResourceGroup*, *-AutomationAccountName*, *-ApplicationDisplayName*, *-SubscriptionId*, and *-CertPlainPassword* parameters.<br>
306
+
3. From the elevated PowerShell command-line shell, navigate to the folder which contains the script created in Step 1 and execute the script changing the values for parameters*–ResourceGroup*, *-AutomationAccountName*, *-ApplicationDisplayName*, *-SubscriptionId*, and *-CertPlainPassword*.<br>
312
307
313
-
>[AZURE.NOTE] You will be prompted to authenticate with Azure after you execute the script. You must sign in with an account that is a member of the Subscription Admins role and that is a co-admin of the subscription.
>[AZURE.NOTE] You will be prompted to authenticate with Azure after you execute the script. You must log in with an account that is a member of the Subscription Admins role and co-admin of the subscription.
After the script finishes successfully, you will need to copy the certificate that was created in your user profile **Temp** folder. Follow the steps to [upload a management API certificate](../azure-api-management-certs.md) to the Azure classic portal, and then refer to the [sample code](#sample-code-to-authenticate-with-service-management-resources) to validate credential configuration with Service Management resources.
316
+
After the script completes successfully, you will need to copy the certificate created in your user profile **Temp** folder. Follow the steps for [uploading a management API certificate](../azure-api-management-certs.md) to the Azure classic portal and then refer to the [sample code](#sample-code-to-authenticate-with-service-management-resources) to validate credential configuration with Service Management resources.
322
317
323
318
## Sample code to authenticate with Resource Manager resources
324
319
325
-
You can use the following updated sample code, which is taken from the **AzureAutomationTutorialScript** example runbook, to authenticate by using the Run As account to manage Resource Manager resources with your runbooks.
320
+
You can use the updated sample code below, taken from the **AzureAutomationTutorialScript** example runbook, to authenticate using the Run As account to manage Resource Manager resources with your runbooks.
@@ -349,44 +344,44 @@ You can use the following updated sample code, which is taken from the **AzureAu
349
344
Write-Error -Message $_.Exception
350
345
throw $_.Exception
351
346
}
352
-
}
347
+
}
348
+
353
349
350
+
The script includes two additional lines of code to support referencing a subscription context so you can easily work between multiple subscriptions. A variable asset named SubscriptionId contains the ID of the subscription, and after the Add-AzureRmAccount cmdlet statement, the [Set-AzureRmContext cmdlet](https://msdn.microsoft.com/library/mt619263.aspx) is stated with the parameter set *-SubscriptionId*. If the variable name is too generic, you can revise the name of the variable to include a prefix or other naming convention to make it easier to identify for your purposes. Alternatively, you can use the parameter set -SubscriptionName instead of -SubscriptionId with a corresponding variable asset.
354
351
355
-
The script includes two additional lines of code to support referencing a subscription context so that you can easily work between multiple subscriptions. The *SubscriptionId* variable asset contains the ID of the subscription. After the Add-AzureRmAccount cmdlet statement, the [Set-AzureRmContext cmdlet](https://msdn.microsoft.com/library/mt619263.aspx) is stated with the *-SubscriptionId* parameter set. If the variable name is too generic, you can revise the name of the variable to include a prefix or other naming convention to make it easier to identify for your purposes. Alternatively, you can use the *-SubscriptionName* parameter set instead of *-SubscriptionId* and a corresponding variable asset.
356
-
357
-
Notice that the cmdlet that is used to authenticate in the runbook, **Add-AzureRmAccount**, uses the *ServicePrincipalCertificate* parameter set. It authenticates by using the service principal certificate instead of credentials.
352
+
Notice the cmdlet used for authenticating in the runbook - **Add-AzureRmAccount**, uses the *ServicePrincipalCertificate* parameter set. It authenticates by using service principal certificate, not credentials.
358
353
359
354
## Sample code to authenticate with Service Management resources
360
355
361
-
You can use the following updated sample code, which is taken from the **AzureClassicAutomationTutorialScript** example runbook, to authenticate by using the Classic Run As account to manage classic resources with your runbooks.
362
-
356
+
You can use the updated sample code below, taken from the **AzureClassicAutomationTutorialScript** example runbook, to authenticate using the Classic Run As account to manage classic resources with your runbooks.
- For more information about service principals, refer to [Application Objects and Service Principal Objects](../active-directory/active-directory-application-objects.md).
391
-
- For more information about Role-Based Access Control in Azure Automation, refer to [Role-based access control in Azure Automation](../automation/automation-role-Based-access-control.md).
392
-
- For more information about certificates and Azure services, refer to [Certificates overview for Azure Cloud Services](../cloud-services/cloud-services-certs-create.md).
385
+
- For more information about Service Principals, refer to [Application Objects and Service Principal Objects](../active-directory/active-directory-application-objects.md).
386
+
- For more information about Role-based Access Control in Azure Automation, refer to [Role-based access control in Azure Automation](../automation/automation-role-based-access-control.md).
387
+
- For more information about certificates and Azure services, refer to [Certificates overview for Azure Cloud Services](../cloud-services/cloud-services-certs-create.md)
0 commit comments