Using Azure Automation to realize automatic Operation and maintenance in Cloud (2)

Authentication of Azure automation: username and password

Using Powershell in the automation of Azure can manage resources for current subscriptions as well as resources for different subscriptions, so the problem is, how to ensure security? The automation of Azure, like other clients that use or manage Azure, requires authentication for any Azure that needs to be managed. There are two basic authentication methods, one is based on subscription username and password, and the other is based on certificate. This section describes user name password.

It is not recommended to use the OrgID and password of the current account for managing production subscriptions directly in automation. It is recommended to create a separate user name for automation. First, log in to the management interface of Azure and open Active Directory:

Select your current directory name, enter the main interface, you can see that there are users, applications, etc., then we need to add a new user, select the add user at the bottom:

Enter information about the user, select a new user in the organization, enter the user name, such as automationuser in the example, and select the next step:

Enter the user's profile, alternate email, etc., and make sure that multiple authentication is not enabled:

Create a stand-alone machine. After completion, the system will assign you a temporary password. You need to log in with a new user and change the temporary password before you can use it:

After the user is created, you must add the user to the collaborative administrator and assign the subscriptions you need to manage before you can use it:

Please keep in mind the automation username and password created here and use it in subsequent creation of automation scripts.

Advantages and disadvantages of using usernames and passwords for automated script authentication:

Advantages: simple, convenient and intuitive

Disadvantages: because Azure forces the password to be changed for 3 months, many users run automated scripts in this way, and the password is not updated in time, and they do not know it, resulting in a long interruption of maintenance work