Azure Automation Runbooks
Executing PowerShell Scripts

The Need for Centralized Script Execution

Historically, System Administrators executed complex PowerShell scripts locally from their administrative workstations or dedicated management servers. While functional in small environments, this approach presents significant challenges in modern enterprises: "Where is the latest version of the script?", "Who has the credentials to run it?", and "How do we audit the execution logs?".

Azure Automation provides a native, integrated platform to solve these problems by centralizing the storage, orchestration, and secure execution of administrative tasks using Runbooks.

# Provisioning an Automation Account with a System-Assigned Identity
New-AzAutomationAccount -ResourceGroupName "rg-automation-prod" `
    -Name "aa-enterprise-ops" `
    -Location "UK South" `
    -AssignSystemIdentity

Storing Scripts as Runbooks

In Azure Automation, your PowerShell scripts exist as Runbooks. A Runbook is a set of tasks that perform some automated process in Azure Automation. There are several profound benefits to storing scripts this way:

Technical Implementation: Creating and Publishing a Runbook

Once your Automation Account is ready, you can deploy your scripts. Below is a practical example of creating a Runbook that stops untagged Virtual Machines, and publishing it directly via the Az PowerShell module.

$ScriptPath = ".\Stop-UntaggedVMs.ps1"
$ResourceGroup = "rg-automation-prod"
$AutomationAccount = "aa-enterprise-ops"

# Import a custom script as a Runbook
Import-AzAutomationRunbook -ResourceGroupName $ResourceGroup `
    -AutomationAccountName $AutomationAccount `
    -Path $ScriptPath `
    -Type PowerShell `
    -Name "Stop-UntaggedVMs" `
    -Description "Stops all VMs missing the 'Environment' tag"

# Publish the Runbook for execution
Publish-AzAutomationRunbook -ResourceGroupName $ResourceGroup `
    -AutomationAccountName $AutomationAccount `
    -Name "Stop-UntaggedVMs"

Executing PowerShell Scripts

The true power of Azure Automation lies in its flexible execution options for Runbooks. You can execute scripts seamlessly using multiple methods depending on your operational requirements:

1. Schedule-Based Execution

The most straightforward method is attaching a Schedule to a Runbook. Whether it's rotating logs at midnight or powering off non-production virtual machines at 6 PM on Fridays to save costs, schedules automate repetitive operational tasks without human intervention.

2. Webhook Triggers

Webhooks allow you to start a particular Runbook through a single HTTP request. This is exceptionally powerful for ITSM integration (e.g., ServiceNow triggering an Azure script to provision a user) or responding to Azure Monitor alerts containing auto-remediation payloads.

# Create Webhook (Valid for 1 year)
$Webhook = New-AzAutomationWebhook -ResourceGroupName $ResourceGroup `
    -AutomationAccountName $AutomationAccount `
    -Name "Invoke-StopVMs" `
    -RunbookName "Stop-UntaggedVMs" `
    -IsEnabled $True `
    -ExpiryTime (Get-Date).AddYears(1) `
    -Force

# The WebhookURI is ONLY shown once upon creation!
$URI = $Webhook.WebhookURI

# Trigger the Runbook externally via REST API
Invoke-RestMethod -Method Post -Uri $URI -Body (@{ "Action" = "ForceStop" } | ConvertTo-Json)

3. Azure Logic Apps Integration

For more sophisticated orchestrations, Azure Logic Apps can incorporate Azure Automation Runbooks into larger visual workflows. You can pass dynamically generated parameters from the Logic App directly into your PowerShell script.

Security Posture: The Era of Managed Identities

Executing actions against Azure resources requires authentication. Previously, "Run As Accounts" were widely used, which handled a Service Principal in the background. However, Microsoft has shifted the architectural standard.

The modern, secure approach utilizes Managed Identities. By assigning a System-Assigned or User-Assigned Managed Identity to the Automation Account, the Runbook seamlessly authenticates to Azure Active Directory (Entra ID) without touching any credentials. You simply grant the Identity the requisite RBAC roles (e.g., Virtual Machine Contributor) on your subscriptions.

# Authenticate using the system-assigned Managed Identity
Connect-AzAccount -Identity

# Execute tasks with inherited RBAC privileges
Get-AzVM -Status | Where-Object { $_.PowerState -eq 'VM running' } | Stop-AzVM -Force

Advanced Feature: Hybrid Runbook Worker

If your script needs to execute against an on-premises Windows Server or a proprietary database outside of Azure, you can deploy a Hybrid Runbook Worker. The Azure Automation service instructs the worker agent installed on a local machine to execute the script inside your private network, securely bridging cloud automation with on-premises infrastructure.

Conclusion

Azure Automation transforms raw PowerShell scripts into enterprise-ready automation assets. By integrating source control, securing execution with Managed Identities, and providing robust triggering mechanics, teams can elevate their cloud operations from manual reactions to scalable, reliable processes.

Looking to audit your automation security posture or migrate legacy scripts into modern Runbooks? Contact me to discuss orchestrating your environment.

Gunaseelan Madhavan

Senior Technical Architect & Cloud SME at NatWest Group Plc

20+ years of enterprise technology leadership across cloud, infrastructure, and digital workplace. Passionate about sharing practitioner knowledge and advancing the profession.