Bulk Register Azure Resource Providers Using PowerShell

Azure Resource Providers registration dictates what types of resources you allow users to provision within your Azure subscription. Although by default, some resource providers are automatically registered, the user must have required permission to register resource providers (https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-supported-services). I had to create a script to bulk-register resource providers for a subscription because normal users have not been given the permissions to do so. In the following sample script, I am using regular expressions to match the resource provider names, and it is registering all Microsoft resource providers except for the classic (ASM) resource types. View the code on Gist. This

Generating Unique GUIDs in Azure Resource Manager Templates

If you have worked on ARM templates, you have probably already faced challenges when you need to use GUIDs within the templates. Currently there are several ways to generate GUID that  I can find on the Internet: Generating GUIDs in PowerShell and then pass them into the ARM templates Using a nested template to generate GUID – https://github.com/davidjrh/azurerm-newguid Using an Azure Function app – https://geeks.ms/davidjrh/2017/08/01/providing-a-guid-function-in-azure-resource-manager-templates-with-azure-functions/ Few weeks ago, I was working on an ARM template, where I need to generate 100+ Azure Automation runbook job schedules. For each job schedule, the ‘name’ property is a GUID, which needed to be

Restricting Public-Facing Azure Storage Accounts Using Azure Resource Policy

Background Back in September 2017, Microsoft has announced Virtual Network Service Endpoints for Azure Storage and Azure SQL at Ignite. This feature prevents Storage Accounts and Azure SQL Databases from being accessed from the public Internet. A customer had a requirement to enforce all storage accounts to be attached to VNets as part of their security policies. The Azure Resource Policy seems to be the logical solution for this requirement. In order to make this possible, I have contacted the Azure Policy product team, and thanks for their prompt response, this is now possible – although at the time of

Getting Azure AD Tenant Common Configuration Such as Tenant ID Using PowerShell

It has been a long time since my last post. I was very busy right until the Christmas eve, and it my to-be-blogged list is getting longer and longer. I had a very good break during the holiday period. My partner and I took our daughter to Sydney on the Christmas day and spent 5 days up there. When we were in Sydney, I visited Hard Rock Cafe for the first time in my life, and also spent 2 days with my buddy and MVP colleague Alex Verkinderen. Now that I’m somewhat recharged, I will start working on the backlog

Azure Resource Policy to Restrict ALL ASM Resources

I needed to find a way to restrict ALL Azure Service Manager (ASM, aka Classic) resources on the subscription level. Azure Resource Policy seems to be a logical choice. So I quickly developed a very simple Policy Definition: View the code on Gist. Once I have deployed the definition and assigned it to the subscription level (using PowerShell commands listed below), I could no longer deploy ASM resources:

i.e. when I tried to create a classic VNet, I could not pass the validation:

New PowerShell Module For Azure Automation: AzureServicePrincipalAccount

I’m currently working on a project where there has been a lot of discussion on how to use Azure AD Service Principals in Azure Automation and other solutions that involves any automated processes (i.e. VSTS pipelines). When signing in to Azure using a Service Principal, you can use either a key (password) or a certificate associated to the Service Principal. When using the Add-AzureRMAccount cmdlet, you can use one of the following parameter set: Key (password) based: Azure AD Tenant ID Azure Subscription Name or ID PS Credential object User name: Azure AD Application ID Password: Service Principal key Certificate

AzureTableEntity PowerShell Module Updated

I have updated the AzureTableEntity PowerShell module few days ago. The latest version is and it is published at: PowerShell Gallery: https://www.powershellgallery.com/packages/AzureTableEntity/ GitHub: https://github.com/tyconsulting/AzureTableEntity-PowerShell-Module/releases What’s changed? New function Merge-AzureTableEntity Merge one or more entities in a Azure table. Please make sure you understand the difference between Azure table merge and update operations: Update: replace entity fields with the the fields specified in the update operation Merge: update the value of existing fields specified in the merge operation If you want to update the value of an existing field and having the rest of the fields unchanged, make sure you

Azure Functions Demo: Voting App

Back in April this year, Pete Zerger (@pzerger) and I delivered two sessions in Experts Live Australia. One of which is titled “Cloud Automation Overview”. During this session, we have showed off a pretty cool voting demo app that is made up with Azure Functions, Key Vault, Azure SQL DB and Power BI. As shown above, this demo app allows attendees in our session to vote on a topic that we have chosen by scanning QR codes using mobile devices. In this case, since we were delivering the session in Melbourne Australia, we have decided to let people to vote

Preventing Azure Automation Concurrent Jobs In the Runbook

Recently when I was writing an Azure Automation PowerShell runbook, I had an requirement that I need to make sure there should be only one job running at any given time. Since this runbook will be triggered by a webhook from external systems, there was no way for me to control when and how the webhook would be triggered. So I had to add some logic in the runbook that only execute the core code block if there are no other jobs running. The key for this technique is to use the built-in variable that is available in any Azure

Programmatically Creating Azure Automation Runbook Webhooks Targeting Hybrid Worker Groups

In Azure Automation, you can create a webhook for a runbook and target it to a Hybrid Worker group (as opposed to run on Azure). In the Azure portal, it is pretty easy to configure this ‘RunOn’ property when you are creating the webhook. However, at the time of writing this blog post, it is STILL not possible to specify where the webhook should target when creating it using the Azure Automation PowerShell module AzureRM.Automation (version 3.1.0 at the time of writing). The cmdlet New-AzureRMAutomationWebhook does not provide a parameter where you can specify the webhook “RunOn” target: there are

%d bloggers like this: