Automating Domain Unjoin When Deleting VMSS Instance

Santosh Patil 5

Hello,

I am trying to create an automation that unjoins a domain when an alert triggers for VM deletion. I have set up a single VMSS, an alert, two action groups (for email and automation), and an Azure automation account runbook.

When attempting to destroy an instance in VMSS, I receive emails from the email action group, but there is no indication of an automation action group. Trying the "Test" button in the Automation action group results in an "HTTP 401: The Automation Runbook returned a 'Unauthorized' error." message. I'm not sure which permissions I need to set up and where. I have tried various permissions, but none of them seemed to work.

Thank you, Santosh Patil

Pranay Reddy Madireddy 440 Reputation points Microsoft Vendor

2024-09-10T12:58:22.85+00:00

Hii Santosh Patil

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

To check your Azure Automation Runbook, go to the Azure Portal and find your Automation Account. Click on "Runbooks," select the one you’re interested in, and ensure it is published and working properly.

For your Automation Runbooks to work, they need special permissions. Ensure that your Automation Account has either a managed identity or a service principal set up. This allows the runbook to access and control Azure resources securely.

In the Azure Portal, go to the resource (like a VMSS) that your runbook will work with. In the Access Control (IAM) section, give the managed identity or service principal of your Automation Account a role like Contributor. This allows the runbook to make changes, such as deleting VMSS instances, as needed.

In the Azure Portal, go to your Action Groups and check that the Webhook action is correctly set up with the URL of your Automation Runbook. Test the Action Group to make sure the webhook is working and that there are no authorization errors.

Make sure the webhook URL is correct and used in the action group. Ensure the URL is secure and has the right IP settings. Also, check that any required parameters for the runbook are set and passed correctly.

Check the runbook’s Jobs section for any errors or messages about why it’s not working. Also, look at the Azure Activity Logs for any issues or permission problems.

Ensure the alert rule is set up correctly to trigger the action group. Verify that the alert conditions are right and that the action group activates when those conditions are met.

For reference, please review this documentation: https://learn.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Pranay Reddy Madireddy 440 Reputation points Microsoft Vendor

2024-09-12T09:25:23.91+00:00

Hii Santosh Patil
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Santosh Patil 5 Reputation points

2024-09-12T13:57:45.2633333+00:00

Hi,

basically, I am looking for alert should be trigger when there is event for vim instance delete and alert should carry vim instance name, computer name, data disk name to azure automation account for further process.
Pranay Reddy Madireddy 440 Reputation points Microsoft Vendor

2024-09-16T18:52:14.5533333+00:00
Hii Santosh Patil

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Open "Azure Portal" go to VM

Navigate to Diagnostics settings in the Monitoring section.

Add a new diagnostic setting and choose to send logs to Log Analytics workspace.

Go to Azure Monitor. Select Logs under the Insights section.

Use this query to find VM deletion events:

AzureActivity

| where ResourceType == "MICROSOFT.COMPUTE/VIRTUALMACHINES"

| where OperationName == "Microsoft.Compute/virtualMachines/delete"

Save the query and set up an alert rule using it.

Create a Action Group in Azure Monitor.

Add an action to Run an Automation Runbook.

Create a Azure Automation Account.

Create a Runbook within this account.

Add a PowerShell script to the Runbook to handle the deletion alert.

Go back to your Action Group and link it to the Runbook you created.

Example PowerShell Script for Runbook:-

param(

[string]$ResourceId

)

$resourceDetails = Get-AzResource -ResourceId $ResourceId

$vmName = $resourceDetails.Name

$resourceGroupName = $resourceDetails.ResourceGroupName

Get VM details

$vm = Get-AzVM -ResourceGroupName $resourceGroupName -Name $vmName

Get data disk details

$dataDisks = $vm.StorageProfile.DataDisks | ForEach-Object { $_.Name }

Format alert message

$alertMessage = @{

VMName = $vmName ComputerName = $vm.ComputerName DataDiskNames = $dataDisks -join ', '

}

Example: Output the alert message to a log file

$alertMessage | ConvertTo-Json | Out-File -FilePath "C:\path\to\alert.log"

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".

Share via

Automating Domain Unjoin When Deleting VMSS Instance

Your answer