Hey there, Cloud Gurus,
and congratulations on making it to the end of this section.
Let's quickly review what we've covered in this section.
First up, we talk a look at automation accounts
and learned that automation accounts
provide configuration management,
update management, and process automation.
And you need to link a Log Analytics workspace
to your automation account
to enable the configuration management
and update management solutions.
And the automation account and the log analytics workspace
must be in the same region,
and it's also important to remember
that not all Azure regions support linking
a Log Analytics workspace to an automation account.
So check the Azure region for support
before you deploy your automation account.
We also took a look at process automation using runbooks.
And runbooks are used to provide process automation
that can be either PowerShell,
PowerShell workflow, or Python based.
Both Windows PowerShell
and the new cross-platform PowerShell are supported,
as well as multiple versions of the Python run time.
When a runbook is executed, it creates a job
and the job stores all of the details
of the runbook execution, including the parameters and logs,
and the job can run in the Azure sandbox
or on a hybrid worker.
And there are 2 types of hybrid worker groups,
Azure automation users use a hybrid worker groups
that you create to distribute jobs
between multiple hybrid workers.
Now, the load balancing of jobs between
user hybrid worker groups isn't perfect,
but it does provide some redundancy
for your hybrid worker runbook jobs.
There's also system hybrid worker groups
that are used for update management.
Now let's quickly review desired state configuration.
A DSC Configuration is a declaration of DSC resources
and the properties for the desired state of those resources.
These resources might be files, services,
folders, applications, or even network configuration.
The possibilities really are endless.
A Desired State Configuration resource
is part of a PowerShell module,
and it's used to apply configuration settings.
You can get additional DSC functionality
by downloading and installing PowerShell modules
that include DSC resources.
And finally, you can use DependsOn
to control the order in which DSC resources are applied,
which is very important for things like
setting a network configuration
before you attempt to join an Active Directory domain.
And we also took a look at automating updates.
If you're looking for very simple
and straightforward patch automation,
you can't go past automatic VM guest patching.
It'll keep you compliant with security updates
and secure your virtual machines with a single click.
But if you need something more sophisticated,
you can use Azure automations Update Management,
which provides many additional features
including, importantly, support for hybrid workloads.
In the Update Management, pre- and post-update scripts
run in the Azure sandbox automation.
But it's important to point out
that you can call a runbook from within another runbook,
which means that you can execute scripts on-premises
using hybrid workers in those pre- and post-scripts.
For example, if you wanted to test
if Active Directory was available
after patching a domain controller.
And then finally, we took a look at guest configuration.
Guest configuration extends the capabilities of Azure Policy
to VM guest operating systems in Azure
or on premises using Azure Arc.
And you can use built-in policies
to provide baseline security configuration
to your virtual machines,
and you can even create custom policies
that use the latest version of Desired State Configuration
to apply any configuration you can imagine
and report that compliance to Azure.
Now, I don't know why, but Microsoft likes to test
if you know your Azure role-based access control
on certification exams.
And because I only briefly touched on these requirements
in this section,
let's review some of the role requirements
for both Azure Policy and Azure Automation.
With Azure policy, to create policy definitions,
you need to be a member
of the resource policy contributor role,
the security admin role,
or a more privileged role,
and the same applies to assigning policies
and policy initiatives to management groups
and resource groups.
You need to be a member of either
the resource policy contributor role,
the security admin role,
or a more privileged role.
And you can remediate resources
with the contributor role or a more privileged role.
Now, Azure automation is a little bit simpler,
there are only a couple of roles
that allow you to manage Azure Automation accounts
including the automation contributor
and the Log Analytics contributor.
Runbooks are a little special though.
They have a couple of roles that are designed
to protect the secrets in the Azure Automation account.
Firstly, there is the Automation Operator role,
which allows you to run all of the runbooks
within an Automation account.
And then we have the Automation Runbook operator
and this allows a user to be assigned access
to run an individual Runbook.
All right, I think that just about does it.
Congrats again on making it to the end of this section,
I hope you've enjoyed exploring
all of these technologies
as much as I have taking you through this section.
And I look forward to seeing you in the next section.