Configure Azure Automation Private Endpoint

This section will configure the Azure Automation accounts to use a private endpoint with SQL.

Manual Steps:

Step 1: Assign Azure Role to System Assigned Managed Identity (SAMI)

Type in automation in the top search box
Select Automation Accounts

Select aa-automation-00

Select Identity under the Account Settings navigation menu
Select Azure role assignements for the System Assigned Managed Identity

Select the subscription associated with this account
Select + Add role assignment

Fill out the values to add the roles to the aa-spark-automation0 account
Select Save to add the role

Name	Value
Scope	Resource Group
Subscription	The subscription associated with this account
Resource Group	The Resource Group created for SPARK
Role	Automation Operator & Storage Blob Data Contributor

Step 2: Configure Azure Automation Network

Type in automation in the top search box
Select Automation Accounts

Select aa-automation-00

Select Networking under the Account Settings navigation menu
Select the Private access tab
Select + Private endpoint

Fill in the values and select Next

Name	Value
Subscription	The subscription associated with this account
Resource Group	The Resource Group created for SPARK
Name	pe-spark-automation0

Select DSCAndHybridWorker for the Target sub-resource
Select Next

Fill in the values
Select Next

Name	Value
Subscription	The subscription associated with this account
Resource Group	The Resource Group created for SPARK
Private IP Configuration	Statically allocate IP address
Name	pipAgentService
Private IP	10.0.0.11
Name	pipJRDS
Private IP	10.0.0.12

Fill in the values
Select Next until you get to Review + Create
Select Create

Name	Value
Subscription	The subscription associated with this account
Resource Group	The Resource Group created for SPARK

Select Networking under the Account Settings navigation menu
Select Disable and then Apply to remove public network access

Step 3: Create Hybrid Worker Group

Select Hybrid Worker Groups under the Process Automation navigation menu
Select + Create Hybrid Worker Group

Set the Name to hwg-aa-spark-automation0
Select Next until you get to Review + Create

We will create the Virtual Machine in the next step and associate it with this Hybrid Worker Group afterwards.

Select + Add Machine
Select Add

Step 4: Create Virtual Machine

Type in virtual machine in the top search box
Select Virtual Machines

Select Virtual Machines from the left navigation menu
Select + Create and then Virtual Machine

Fill in the values
Select See all images under Image

Name	Value
Subscription	The subscription associated with this account
Resource Group	The Resource Group created for SPARK
Virtual Machine Name	vm-spark-aa0
Region	The Region associated with the Resource Group

Search for windows server
Find Windows Server 2022
Select Windows Server 2022 Datacenter: Azure Edition Core - x64 Gen 2

Select See all sizes under Size

Select D2lds_v7

Set the Username to sparkAdmin
Set the Password to a strong value
If you already have a license, then select and confirm license option
Select Next until you get to Review + Create
Select Create

Select vnet-pe-spark for the Virtual Network
Select the option to create a public ip, and then Next

Check Enable system assigned managed identity under Identity
Select Next until you get to Review + create
Select Create

Step 5: Associate Virtual Network with Hybrid Worker Group

Select Hybrid Worker Groups under the Process Automation navigation menu
Select spark-hwg-automation0

When you associate the VM with the hybrid worker group, it will automatically add the Hybrid Worker Extension to the VM. We must have this complete before testing the runbook.

Select Hybrid Workers from the left navigation
Select + Add

Select the vm-spark-aa0 virtual machine
Select Add

Click on the Azure Virutal Machine link to view the virtual machine

Select Extensions + applications

View the provisioning status

The virtual machine extension must succeed before testing the runbooks.

Step 6: Virtual Machine Modules

Select Connect from the left navigation
Select Configure JIT + Request access
Select Download RDP file

Wait for the JIT request to complete before connecting to the virtual machine.

Select 15 to access powershell
Run the following script to add PowerShell v7.4

# Requires Administrator

$ErrorActionPreference = 'Stop'

# Latest known 7.4 LTS release
$Version = "7.4.18"

# Build download URL
$MsiUrl = "https://github.com/PowerShell/PowerShell/releases/download/v$Version/PowerShell-$Version-win-x64.msi"

$Installer = Join-Path $env:TEMP "PowerShell-$Version-win-x64.msi"

Write-Host "Downloading PowerShell $Version..."
Invoke-WebRequest -Uri $MsiUrl -OutFile $Installer

Write-Host "Installing PowerShell..."
Start-Process msiexec.exe -ArgumentList @(
    "/i"
    "`"$Installer`""
    "/qn"
    "ADD_EXPLORER_CONTEXT_MENU_OPENPOWERSHELL=1"
    "ENABLE_PSREMOTING=1"
    "REGISTER_MANIFEST=1"
    "USE_MU=1"
    "ENABLE_MU=1"
) -Wait

Write-Host "Installation complete."

# Verify
$Pwsh = "C:\Program Files\PowerShell\7\pwsh.exe"

if (Test-Path $Pwsh) {
    & $Pwsh -NoLogo -NoProfile -Command '$PSVersionTable.PSVersion'
} else {
    throw "pwsh.exe not found after installation."
}

Run the following script to add the required modules for the runbooks.

# Requires -RunAsAdministrator

$ErrorActionPreference = 'Stop'

# ------------------------------------------------------------------
# PowerShell Runtime
# ------------------------------------------------------------------

Write-Host "PowerShell Version: $($PSVersionTable.PSVersion)"
Write-Host "PSEdition: $($PSVersionTable.PSEdition)"
Write-Host ""

# ------------------------------------------------------------------
# Required Modules
# ------------------------------------------------------------------

$RequiredModules = @(
    @{
        Name = 'Az'
        MinimumVersion = $null
    }
    @{
        Name = 'Az.Accounts'
        MinimumVersion = $null
    }
    @{
        Name = 'Az.Automation'
        MinimumVersion = $null
    }
    @{
        Name = 'Az.Resources'
        MinimumVersion = $null
    }
    @{
        Name = 'ExchangeOnlineManagement'
        MinimumVersion = $null
    }
    @{
        Name = 'Microsoft.Graph.Authentication'
        MinimumVersion = $null
    }
    @{
        Name = 'Microsoft.Graph.Groups'
        MinimumVersion = $null
    }
    @{
        Name = 'Microsoft.Graph.Sites'
        MinimumVersion = $null
    }
    @{
        Name = 'Microsoft.Graph.Users'
        MinimumVersion = $null
    }
    @{
        Name = 'Microsoft.Graph.Users.Actions'
        MinimumVersion = $null
    }
    @{
        Name = 'PnP.PowerShell'
        MinimumVersion = '3.2.0'
    }
    @{
        Name = 'SqlServer'
        MinimumVersion = $null
    }
)

# ------------------------------------------------------------------
# Package Providers / Repository
# ------------------------------------------------------------------

Write-Host "Configuring PSGallery..."

if (-not (Get-PackageProvider NuGet -ErrorAction SilentlyContinue))
{
    Install-PackageProvider `
        -Name NuGet `
        -MinimumVersion 2.8.5.201 `
        -Force
}

if ((Get-PSRepository PSGallery).InstallationPolicy -ne 'Trusted')
{
    Set-PSRepository `
        -Name PSGallery `
        -InstallationPolicy Trusted
}

# ------------------------------------------------------------------
# Azure CLI (winget method)
# ------------------------------------------------------------------

Write-Host ""
Write-Host "Checking Azure CLI..."

try
{
    $azVersion = az version 2>$null

    if (-not $azVersion)
    {
        Write-Host "Azure CLI not detected."

        if (Get-Command winget -ErrorAction SilentlyContinue)
        {
            winget install `
                --id Microsoft.AzureCLI `
                --exact `
                --accept-source-agreements `
                --accept-package-agreements
        }
        else
        {
            Write-Warning "winget not found. Install Azure CLI manually."
        }
    }
    else
    {
        Write-Host "Azure CLI already installed."
    }
}
catch
{
    Write-Warning $_
}

# ------------------------------------------------------------------
# Install / Upgrade Modules
# ------------------------------------------------------------------

$Results = @()

foreach ($Module in $RequiredModules)
{
    $Name = $Module.Name
    $MinimumVersion = $Module.MinimumVersion

    Write-Host ""
    Write-Host "================================================="
    Write-Host "Processing $Name"
    Write-Host "================================================="

    try
    {
        $Installed = Get-Module `
            -ListAvailable `
            -Name $Name |
            Sort-Object Version -Descending |
            Select-Object -First 1

        $InstallRequired = $false

        if (-not $Installed)
        {
            $InstallRequired = $true
        }
        elseif ($MinimumVersion)
        {
            if ($Installed.Version -lt ([version]$MinimumVersion))
            {
                $InstallRequired = $true
            }
        }

        if ($InstallRequired)
        {
            Write-Host "Installing/Updating $Name..."

            Install-Module `
                -Name $Name `
                -Scope AllUsers `
                -Repository PSGallery `
                -AllowClobber `
                -Force `
                -SkipPublisherCheck
        }
        else
        {
            Write-Host "Installed Version: $($Installed.Version)"
        }

        # Import latest available version
        Import-Module `
            -Name $Name `
            -Force `
            -ErrorAction Stop

        $Current = Get-Module `
            -ListAvailable `
            -Name $Name |
            Sort-Object Version -Descending |
            Select-Object -First 1

        $Results += [PSCustomObject]@{
            Module  = $Name
            Version = $Current.Version
            Status  = 'Validated'
        }

        Write-Host "Validation successful."
    }
    catch
    {
        $Results += [PSCustomObject]@{
            Module  = $Name
            Version = 'Unknown'
            Status  = $_.Exception.Message
        }

        Write-Error $_
    }
}

# ------------------------------------------------------------------
# Final Validation
# ------------------------------------------------------------------

Write-Host ""
Write-Host "================================================="
Write-Host "INSTALLED MODULES"
Write-Host "================================================="

$Results | Format-Table -AutoSize

Write-Host ""
Write-Host "================================================="
Write-Host "MODULE PATHS"
Write-Host "================================================="

$env:PSModulePath -split ';'

Write-Host ""
Write-Host "================================================="
Write-Host "RUNTIME"
Write-Host "================================================="

Write-Host "PowerShell Version: $($PSVersionTable.PSVersion)"
Write-Host "Edition: $($PSVersionTable.PSEdition)"

Write-Host ""
Write-Host "Bootstrap completed."

# Reboot the machine
Restart-Computer -Force

Step 7: Test Runbook

Type in automation in the top search box
Select Automation Accounts

Select aa-spark-automation0
Select Runbooks under Process Automation
Select the rb-spark-sitecollector runbook

Select Start
Select True for Show Logs
Select False for NewSitesOnly
Select Hybrid Worker for Run on
Select Start to test the virtual machine and validate it runs successfully

The modules must be installed before testing the runbook.