1. Automation & Control Deep Dive
Presenter
Date

2. Agenda Overview Automation Capabilities Value Prop
Process Orchestration
Configuration Management & Change Tracking
Update Management

3. Overview

4. Microsoft’s IT management solution
11/3/2017 6:50 AM
Microsoft’s IT management solution
Operations Management Suite
Automation & Control
Configuration & automation
Insights & Analytics
Azure | AWS
Modern operations
management
Backup & Disaster Recovery
Security &
Compliance
System Center
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Configuration & Automation
Managing across the entire lifecycle .
SUBSCRIPTION
COST
POLICY
PACKAGING
DEVOPS TOOLING
CONFIG
PROTECT
MONITOR
SECURE
GOVERN
BUILD
DETECT
PREVENT
Configuration & Automation
PATCHING
CONFIG MONITORING
ORCHESTRATION
BACKUP
RECOVERY
ALERTS
DISCOVERY
ANALYTICS

6. Azure Automation Key Features Manage any cloud & on prem
11/3/2017
Key Features
Azure Automation
PowerShell & PS Workflow Engines
Use your existing PS scripts
Checkpoint/Parallel if needed
Runbooks, Modules
Author PS, PSWF, Graphical runbooks
Gallery – Runbooks, modules
Extensibility, integration
Assets
Secure, global store for variables, credentials, …
Schedules
Jobs
Troubleshoot/audit via job history
PowerShell DSC
Configurations, Pull service
Node Management & Reporting
Hybrid Runbook Workers
Install on any machine
Secure, only outbound ports
Webhooks
URL to start runbook remotely
Integration
Manage any cloud & on prem
Process automation & DSC
PowerShell & Graphical authoring
Integrate systems
Windows & Linux
OMS
Azure Automation
Azure
AWS
Service Providers
Orchestrator
Hybrid Worker
SMA
SCO
Hyper-V
VMWare
OpenStack
Hybrid management
Reliable, highly available, scalable
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Automation Capabilities
Trigger immediate action in response to issues automatically or on-demand
Maintain the state of IT resources and resolve configuration drifts
Keep IT systems updated with minimal downtime
Track and manage changes with ease
Integrate cloud and on premises systems to deliver on demand processes

8. Value Prop
Process Orchestration: Automate the manual, long-running, error-prone, and frequently repeated tasks that are commonly performed in a cloud and enterprise environment
Consistent configuration: Maintain the state of IT resources and resolve configuration drifts.
Update Management: Keep IT systems updated with minimal downtime
Change Tracking: Track and manage changes with ease to help troubleshooting

9. Process Orchestration

10. Configuration & Automation
Configuration & Automation Scenarios
11/3/2017 6:50 AM
Create VMs and Cloud infrastructure
Integrate into Dev tools
Build
Update management
Configure cloud and VMs per application
Configure
Identify changes causing issues
Integrate into ITSM solutions on Alerts
Monitor
Recover application / VM from backup
Integrate into Site Recovery for fail over
Protect
Quarantine VM if exploited
Set policy for infrastructure and app
Secure
Set up RBAC per user / group
Recover unused resources
Govern
CONFIG
PROTECT
MONITOR
SECURE
GOVERN
BUILD
Configuration & Automation
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Microsoft Ignite 2015
11/3/2017 6:50 AM
One Automation
One Automation Solution for Azure, 3rd party clouds and On Premises
User Interface
Web portal
Access Permissions (RBAC)
Source control & versioning
Authoring
Graphical Authoring to visualize end-to-end orchestration
PowerShell Authoring
Gallery
PowerShell Desired State Configuration support
Runbook Engine
Highly available
PowerShell-based engine
Hybrid runbook worker to enable management across public and private clouds.
REST web service and PowerShell modules to enable integration from 3rd party systems / web portals
Integration
Based on PowerShell modules with a rich ecosystem
Use existing PowerShell modules for Microsoft and 3rd party systems
Create PowerShell modules for additional resources/systems
Tools
Tools to convert SCO Integration Packs and runbooks and import into Azure Automation
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Authoring Graphical runbooks PowerShell ISE add-on
11/3/2017 6:50 AM
Authoring
Graphical runbooks
New type of graphical runbook based on native PowerShell
Improvements to graphical authoring and runbook capabilities
PowerShell ISE add-on
Author textual runbooks (PowerShell, PowerShell Workflow)
Continued improvements in response to feedback
Start-AzureRmAutomationRunbook cmdlet
Added –Wait and –MaxWaitSeconds parameters
Parent runbook can now wait for child runbook to finish and send back output
Enables any runbook type to call any runbook type and get back results
More Gallery runbooks
We continue to add useful runbooks to the gallery
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Graphical authoring Graphical PowerShell runbook
11/3/2017 6:50 AM
Graphical authoring
Graphical PowerShell runbook
New type of graphical runbook based on native PowerShell
All advantages of native PowerShell over PowerShell Workflow
Starts fast, full objects
Graphical authoring improvements
Object output properties available at design time
Canvas restyle for readability
Warnings for common design requirements
Error links & convert exception to error (coming soon)
Graphical runbook SDK update
Release latest version of the public-preview SDK
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Automation logs in OMS Log Types Scenarios in OMS Job Status
11/3/2017 6:50 AM
Automation logs in OMS
Log Types
Job Status
Job Streams
Scenarios in OMS
Get insights into job status
Set up alerts for failed or suspended jobs
Find completed jobs that had non-terminating errors
Write advanced queries over your streams and accounts
Azure Automation
Azure
Storage
OMS
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. Remediate VM alert with Automation runbook
11/3/2017 6:50 AM
Remediate VM alert with Automation runbook
Integrate Automation in Azure
Seamlessly use Automation to manage Azure resources
Trigger runbook from VM alert
Configure VM alert to start a runbook when alert triggers
Microsoft runbook or user runbook
Alert context passed to runbook
Account creation as needed
Create Automation account and Run As credentials as needed for user
Make it seamless to get going with alert remediation
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Alert remediation in OMS
11/3/2017 6:50 AM
Alert remediation in OMS
IT Management
Logs ingested by OMS from managed systems
Log analytics for system state information
Monitor and alert
Integrated automation for actions on machines or across systems
Alert Remediation
Alert triggered from log search
Start runbook from alert and pass search results
Runbook performs remediation, troubleshooting, reporting
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Automation Webhook Service
11/3/2017 6:50 AM
Automation Webhooks
Webhook
URL to start runbook from remote app
HTTP Post
Works with Visual Studio Online, GitHub, custom web sites, OMS alerts, Azure alerts, etc.
Runbook Parameters
At webhook creation, you configure parameter values to pass to runbook.
Additional $WebhookData parameter with HTTP headers and body (with data)
Example
Remote App
(e.g., OMS)
Store webhook URL
Event or user interaction
HTTP Post to webhook URL
Automation Webhook Service
Authenticate request
Create $WebhookData
Start runbook
Automation Runbook
Optional: Validate webhook
Optional: Use $WebhookData
Run the process
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Automation Scheduling
11/3/2017 6:50 AM
Automation Scheduling
Use automation scheduling capability to start runbooks
Previously scheduling offered daily and hourly schedules
New Features:
Weekly – day of week
Monthly – days of the month
Time zone support – allows adjustment for daylight savings
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

19. Configuration Management & Change Tracking

20. 11/3/2017
Value Prop
Keeping the 1000s of servers running in our services configured correctly Ed
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. PS DSC configuration management
Microsoft Ignite 2015
11/3/2017 6:50 AM
PS DSC configuration management
Simplifies configuration
Prevents configuration drift
Flexible deployment options
Enables continuous deployment
Development
Test
Production
Joe
Easy to manage via source control
Easy to “diff” configurations
Easy to read
Easy to apply
Environment data is separated from the desired configuration
Easy to check / enforce compliance
(monitor for drift from correct configuration)
Easier to write than writing imperative code:
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Azure Automation DSC
11/3/2017 6:50 AM
PS DSC pull / reporting service hosted in the cloud
Manage physical hosts and VMs in any cloud or on-premises
Windows or Linux
Part of the Azure Automation service
PS DSC configuration, node configuration, node, and resource management
Import
Authoring
Compiling
Versioning
Distribution to nodes
Reporting
Easy node onboarding
Joe
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Configuration & Automation DSC
Staging
Authoring
MOF
Node Configuration
(MOF)
Configuration
(script)
Reports
checksum
Rest Endpoint
DSC
Resources
Zip
Azure
Automation
Azure VM
Physical server
On-prem VM

24. DSC and Runbooks – better together
11/3/2017
DSC and Runbooks – better together
Use PS DSC to declaratively configure VMs / physical hosts
Use runbooks to orchestrate complex processes across systems
Use PS DSC within Azure Automation runbooks to configure machines as part of larger processes
Test & deploy DSC Configurations to all of your servers
Receive request from self service portal from end user, runbook deploys the machine and decides which DSC policy to apply to it based on user type
Alex
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. DevOps Scenario Developer Operations VS Team Services
11/3/2017
DevOps Scenario
Application code / Infrastructure requirements
Source Control for Application / Configuration
Infrastructure policy / Application policy
Manage Builds / Test coverage
Approve releases
Developer
Operations
VS Team Services
Infrastructure policy / Application policy
Template for infra requirements
Alex
Azure / On-Premises / AWS
Automation Service
Configure OS / Deploy application using DSC
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. TechReady 23
11/3/2017 6:50 AM
Change Tracking
Identify software, Windows Services and file (new for Ignite)
View changes for:
Configuration type for software, file, daemons, and Windows services
Software changes to applications and updates
Windows service changes for individual servers
File changes for specific files or under a directory
Key Features:
Spans across Windows and 10 distributions of Linux
Correlate configuration changes with other relevant data
Create an alert & remediate if service stops
Reporting for package/software updates
DSC – new protocol to do ”Get-Inventory” in addition to Get, Set and Test.
Real customer had live site incident & DB server was behaving badly – at the end an antivirus program was installed & was impacting performance
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. Update Management

28. OMS Update Management capabilities
Unified Patch Orchestrated solution across Windows and Linux. Currently in Private Preview
Patch Insights
Across Windows and Linux
Across multiple Linux distros
Patch Action
Windows 2012 & above - One time parallel execution
Patch targeting leveraging existing WSUS/AD/OMS custom groups
Support for proxy environments
Detailed reporting

29. OMS Patching value prop
Patch Any Server, Any Cloud
Patch Insights (before, during, after, reliability, co-ordination)
Patch Orchestration (sequencing, pre/post steps etc)
Workload aware patching (leveraging ADM)
Linux patching
3rd party application patching
Current patching solutions
Microsoft Update
WSUS
SCCM
CAU

30. What needs Patching Azure Deliver IT insights AWS On-premises
OMS Update
Management
(Any Cloud Any OS
Windows Or
Linux
AWS
On-premises

31. Top customer pains
No reliability, struggling with multiple maintenance windows with multiple reboots
No patch Orchestration (critical systems patched “by hand” (with pre-steps, post steps))
Grouping based on workloads is difficult/Ability to leverage existing groups)
Error handling and troubleshooting is time consuming/Need better reporting
Patching is never zero downtime
Workload aware patching gaps
Workload awareness and knowledge on the “sequence” between servers is lacking (eg. patch SharePoint
Patching co-ordination/communication is big gap
Better control of which patches gets applied, when they get applied and to which components they get applied. Being able to enforce compliance, better reporting on compliance, better cluster aware update.
Source: Moneyball discussions, customer day data, customer calls, surveys, Internal field, Top support cases

32. Linux patching- Top customer pains
Lack of tooling – patching is “too manual”
Patchwork of scheduled scripts or manual actions currently used to patch Linux
Lack of unified tools
No unified solution across Linux distributions to report compliance status or manage patching
No heterogeneous Windows/Linux update management solution
Scheduling and orchestration in current tooling is too limited
No Orchestration – Sequencing, pre/post steps
No centralized schedules with maintenance windows
Patches break applications. Error handling and troubleshooting is time consuming
Better control of which packages gets applied, when they get applied and to which components they get applied. Being able to enforce compliance, better reporting on compliance
Workload aware patching gaps. Workload awareness and knowledge on the “sequence” between servers is lacking
IBMBigFix, Lumension(now HEAT) does few linux distribution but all distributions and but they don’t have much penetration
The Common Vulnerabilities and Exposures (CVE)

33. Linux Patch Insights Visibility into:
What’s installed/missing on the server (version no, name)
What’s missing on the server with more details (classification, severity, CVE, vendor article, Patch Repository, description etc)
MMA Supported Linux Operating Systems:
Red Hat Enterprise Linux Server 5,6 and 7 (x86/x64) 
Ubuntu LTS, LTS, 15.04, (x86/x64) 
SUSE Linux Enteprise Server 11 and 12 (x86/x64)
CentOS Linux 5,6, and 7 (x86/x64) 
Amazon Linux > (x86/x64) 
Oracle Linux 5,6, and 7 (x86/x64) 
Debian GNU/Linux 6, 7, and 8 (x86/x64)

34. Whats New in Automation & Control

35. ​Scheduler Improvements:​ Australia is now supported​
TechReady 23
11/3/2017 6:50 AM
Region support​
​Scheduler Improvements:​
Australia is now supported​
Support for Month / Week / Day of Week​ ​
Support for time zone & daylight savings
RunAs Account & Classic RunAs Account ​
Created during new account creation through portal​
Graphical authoring​
New graphical runbook type based on native PowerShell​
Azure VM Alert integration​
Output properties exposed at design time
Works against Azure ARM VMs.​
Canvas update
Use user runbooks in addition to standard runbooks​
Error handling
Added Scale Up and Scale Down VM runbooks to the Standard list​
New Gallery content
SDK update
ISE Toolkit update​
Gallery​
Bug fixes and updates from feedback
Scripts can now be imported from PowerShell Gallery​
Ability to start a new test job before the output window has shown previous results​
Graphical authoring support for new PowerShell type​
Filtering based on popularity / last updated time ​
Desired State Configuration support​
Deploy from PowerShell Gallery blade improved
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

36. Automation Cmdlets​ (AzureRm.Automation module)
TechReady 23
11/3/2017 6:50 AM
DSC Management ​
Automation Cmdlets​ (AzureRm.Automation module)
ARM templates support for Azure VMs with Automation DSC to wait for configuration to be applied before continuing
Update Start-AzureRmAutomationRunbook with -Wait​ - MaxWaitSeconds
Update New-AzureRmAutomationRunbook and Import- AzureRmAutomationRunbook to support new Graphical PowerShell runbook type​
Logging Automation Jobs in OMS​
New/Get-AzureRMAutomationSchedule support for timezones, weekly, and monthly schedules ​
Send runbook job status to Log Analytics ​ ​​
Get-AzureRMAutomationHybridWorkerGroup cmdlet to retrieve hybrid workers
Patching
Patch Insights ​
Time estimates applying patchesOne time parallel execution
​Hybrid Improvements
Support for graphical runbooks
Leveraging WSUS/AD/creating custom
Reliability improvements​
Detailed Reporting
Support for proxy environment
Linux reporting/Insights
ARM
Schema published for ARM template authoring help
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

37. Appendix

38. Setting up log ingestion to OMS
11/3/2017 6:50 AM
Setting up log ingestion to OMS
1. Install the Azure Diagnostics & Log Analytics Module & authenticate to your Azure account
3.  Retrieve the Storage account, Automation account, and Log Analytics Workspace. Note that the Storage account and the Automation account must be in the same region.
4. Configure Automation to send its logs to Azure Diagnostics. Once this is configured, your logs will start flowing to the Storage account you have specified.
5. Send the logs to your Log Analytics Workspace. This can take about 5 – 20 minutes to start syncing data.
6. Ensure Automation solution is enabled in Log Analytics
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

39. Run As accounts Easily authenticate to manage Azure resources
11/3/2017 6:50 AM
Run As accounts
Easily authenticate to manage Azure resources
Get started quickly.
When you create a new Automation account you can have Run As accounts created too.
Soon from the UX you will be able to create Run As accounts for existing Automation accounts.
(There is current work-around via scripts or Azure VM create alert.)
Azure Run As
Service principal with certificate
Contributor role
Manage ARM resources from runbooks
Assets: AzureRunAsCertificate, AzureRunAsConnection
Azure Classic Run As
Certificate
Manage ASC resources from runbooks
Assets: AzureClassicRunAsCertificate, AzureClassicRunAsConnection
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

40. OMS Alert Data in Webhook
11/3/2017 6:50 AM
OMS Alert Data in Webhook
The OMS log search results that trigger the alert are passed from the webhook to the runbook in the $WebhookData input parameter.
WebhookData object contains:
[string] WebhookName - contains the webhook name
[hashtable] RequestHeaders - contains the header of the POST request
[string] RequestBody - contains the body of the POST request with the JSON-formatted search results
Helper cmdlet or runbook to extract the search results.
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

41. Patching tools Target/scope Description/OMS
Different Patching tools from Microsoft
Patching tools
Target/scope
Description/OMS
Microsoft Update
Clients, servers
Directly connected systems. Automatic Updates or manually install.
WSUS
Curate/approve and proxy patches from Windows Update.
Typical server patch install method:
Manual
Automation through GPO/PowerShell
SC Configuration Manager, Intune
90% of SCCM customers are using patching features on servers.
Typical server patch install method : Manual, Automation
Missing: Linux patching
SCCM 2016 adding support for patching clusters
Cluster Aware Update (CAU) and Patching
Windows 2012 and above clusters
Ability to apply a patch on nodes of a cluster in a cluster aware way (drain, patch, reboot, add to cluster).
SC VMM
Hyper-V hosts
Cluster aware way to keep Hypervisor patched and up to date (CAU)
Azure VM extension
Linux virtual machines in Azure
Targeted at Azure Virtual Machine customers. Exposes ability to specify a weekly maintenance mode (specific time/day and duration) to do “predicable patching” on the node.
Cloud Platform System: P&U framework
CPS system
Investment in a Zero-downtime Patch and Update Orchestration system for the Cloud Platform System (multi-node)
Feedback to date is to make this P&U system available directly outside of CPS.
This is the current set of options our customers have around patching. This sets up why OMS is different and building upon what we have.