Azure Automation - Hybrid worker with Managed Identity

[supajo]

Many thanks to Stephan van Rooij for this incredibly helpful project!
This is how I plan to do it according to your documentation - maybe it will help somebody.
Unfortunately, until today I had no app that needed an update ^^
As far as I could test it, it worked.
I am using PowerShell 7.4.4 on my on-prem VM.

Runbook in Azure Automation (choosed Powershell 7.2)

# Managed Identity 
$AzureContext = (Connect-AzAccount -Identity).context
Start-Sleep -Seconds 10

# Modulname definieren
$moduleName = "WinTuner"

# Überprüfen, ob das Modul installiert ist
if (Get-Module -ListAvailable -Name $moduleName) {
    Write-Output "$moduleName ist bereits installiert. Modul wird importiert..."
    Import-Module -Name $moduleName
} else {
    Write-Output "$moduleName ist nicht installiert. Modul wird installiert..."
    Install-Module -Name $moduleName -Scope AllUsers -Force
    Write-Output "$moduleName wurde erfolgreich installiert. Modul wird importiert..."
    Import-Module -Name $moduleName
}

# Der folgende Code wird nach dem Import des Moduls ausgeführt
Write-Output "$moduleName wurde erfolgreich importiert."

$rootPackageFolder = "C:\temp\packages"
$appsWithUpdates = Get-WtWin32Apps -UseDefaultAzureCredential $true -Superseded $false -Update $true

$appsWithUpdates | Format-Table -Property PackageId, CurrentVersion, SupersededAppCount, SuperSedingAppCount

if ($appsWithUpdates.Count -gt 0) {
    foreach ($app in $appsWithUpdates) {
        New-WtWingetPackage -PackageId $($app.PackageId) -PackageFolder $rootPackageFolder -Version $($app.LatestVersion) | 
        Deploy-WtWin32App -UseDefaultAzureCredential $true -GraphId $($app.GraphId)
    }
} else {
    Write-Output "Keine Updates verfügbar."
}

[svrooij]

Updates are slower these days (the winget pkg repo, usually get changed several times a day). You can check the history on this file

Thanks for this documentation, this looks a lot like how I would document it.

If I'm correct, this should also be possible to run in the cloud with Azure Automation, this is why I painstakingly try to keep the NET6 code in there.

Hoping you can also run this in GitHub Actions so you would be able to run it for free 🤪

First is switching to the Connect-Wtwintuner strategy, so I can remove all the auth parameters from all other commands.
Are you ok if I put this manual in the docs afterwards?

[supajo]

I havent tried it at Azure Automation in the cloud alone but i guess this will work too.
Never used Github Actions, but i guess i should take a look...
Yes of course, use it as you need it. Connect-Wtwintuner sounds good also :-D

You could also provide the needed information to create a Managed Identity with the right permissions.
Honestly, i just used a already existing script from
https://www.tbone.se/2024/01/04/create-a-managed-identity-to-automate-intune-tasks/ and just edited the right informations

$TenantID = "USE YOUR OWN TENANTDID"
$ManagedIdentity = "Enter the name of your ManagedIdentity Account, should be the same name as your Azure Automation Account name"
    $Permissions = @(
    "DeviceManagementApps.ReadWrite.All"
    "Group.ReadWrite.All"
)