Get-AzAutomationSoftwareUpdateConfiguration -AzureVMResourceId

[Manbearpiet]

Description

I LOVE the fact that you added this parameter, we really want to index what updateconfigurations a VM uses. However the code returns nothing when fed with a resource-id of a VM. The VM is visible when previewing the updategroups in the schedule. Also it matches by PropertyName but VM's have a different propertyname (Name). Also there's no example with this switch, so how are we supposed to use this?

Steps to reproduce

Get-AzAutomationSoftwareUpdateConfiguration -ResourceGroupName eresgee -AutomationAccountName aaccount -AzureVMResourceId "/subscriptions/08ccea82-85e1-4a3e-b0a6-zzzzzzzzzz/resourceGroups/YUFYFYUF_GROUP/providers/Microsoft.Compute/virtualMachines/ghjgjh"

Environment data

$PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.0.3
PSEdition                      Core
GitCommitId                    7.0.3
OS                             Microsoft Windows 10.0.19041
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

 (Get-Module az.automation  -ListAvailable)

    Directory: C:\Users\ChristianPiet\OneDrive - Company\Documenten\PowerShell\Modules

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Script     1.4.0                 Az.Automation                       Core,Desk {Get-AzAutomationHybridWorkerGroup, Remove-AzAutomationHybridWorkerGroup, Get-AzAutomationJobOutputRecord, Import-AzAutomationDscNodeConfiguration…}

Debug output

Get-AzAutomationSoftwareUpdateConfiguration -ResourceGroupName eresgee -AutomationAccountName azureisdrunk -AzureVMResourceId "/subscriptions/subscriptionId/resourceGroups/YUFYFYUF_GROUP/providers/Microsoft.Compute/virtualMachines/ghjgjh"
DEBUG: 10:00:43 - GetAzureAutomationSoftwareUpdateConfiguration begin processing with ParameterSet 'ByVMId'.
DEBUG: 10:00:43 - using account id 'christian.piet@company.onmicrosoft.com'...
DEBUG: [Common.Authentication]: Authenticating using Account: 'christian.piet@company.onmicrosoft.com', environment: 'AzureCloud', tenant: 'tenantid'
DEBUG: [Common.Authentication]: Authenticating using configuration values: Domain: 'tenantid', Endpoint: 'https://login.microsoftonline.com/', ClientId: '1950a258-227b-4e31-a9cf-717495945fc2', ClientRedirect: 'urn:ietf:wg:oauth:2.0:oob', ResourceClientUri: 'https://management.core.windows.net/', ValidateAuthority: 'True'
DEBUG: [Common.Authentication]: Acquiring token using context with Authority 'https://login.microsoftonline.com/tenantid/', CorrelationId: '00000000-0000-0000-0000-000000000000', ValidateAuthority: 'True'
DEBUG: [Common.Authentication]: Acquiring token using AdalConfiguration with Domain: 'tenantid', AdEndpoint: 'https://login.microsoftonline.com/', ClientId: '1950a258-227b-4e31-a9cf-717495945fc2', ClientRedirectUri: urn:ietf:wg:oauth:2.0:oob
DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2822764Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: ADAL PCL.CoreCLR with assembly version '3.19.2.6005', file version '3.19.50302.0130' and informational version '2a8bec6c4c76d0c1ef819b55bdc3cda2d2605056' is running...

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2823364Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: ADAL PCL.CoreCLR with assembly version '3.19.2.6005', file version '3.19.50302.0130' and informational version '2a8bec6c4c76d0c1ef819b55bdc3cda2d2605056' is running...

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2823689Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: === Token Acquisition started:
        CacheType: null
        Authentication Target: User
        , Authority Host: login.microsoftonline.com

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2823822Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: === Token Acquisition started:
        Authority: https://login.microsoftonline.com/tenantid/
        Resource: https://management.core.windows.net/
        ClientId: 1950a258-227b-4e31-a9cf-717495945fc2
        CacheType: null
        Authentication Target: User

DEBUG: [ADAL]: Verbose: 2020-10-08T08:00:43.2824749Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: Loading from cache.

DEBUG: [ADAL]: Verbose: 2020-10-08T08:00:43.2824872Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: Loading from cache.

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2838288Z: 00000000-0000-0000-0000-000000000000 - LoggerBase.cs: Deserialized 13 items to token cache.

DEBUG: [ADAL]: Verbose: 2020-10-08T08:00:43.2839156Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Verbose: 2020-10-08T08:00:43.2839333Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2840275Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: An item matching the requested resource was found in the cache

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2840445Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: An item matching the requested resource was found in the cache

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2842068Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: 58,981414055 minutes left until token in cache expires

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2842219Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: 58,981414055 minutes left until token in cache expires

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2842494Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: A matching item (access token or refresh token or both) was found in the cache

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2842629Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: A matching item (access token or refresh token or both) was found in the cache

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2844212Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: === Token Acquisition finished successfully. An access token was returned: Expiration Time: 08/10/2020 08:59:42 +00:00

DEBUG: [ADAL]: Information: 2020-10-08T08:00:43.2844369Z: ba2c0b04-d6db-4f8c-9911-4df0b39768bd - LoggerBase.cs: === Token Acquisition finished successfully. An access token was returned: Expiration Time: 08/10/2020 08:59:42 +00:00Access Token Hash: Tokenhash
         User id: userId

DEBUG: [Common.Authentication]: Renewing Token with Type: 'Bearer', Expiry: '10/08/2020 08:59:42 +00:00', MultipleResource? 'True', Tenant: 'tenantid', UserId: 'christian.piet@company.onmicrosoft.com'
DEBUG: [Common.Authentication]: User info for token DisplayId: 'christian.piet@company.onmicrosoft.com', Name: Christian Piet, IdProvider: 'https://sts.windows.net/tenantid/', Uid: 'userId'
DEBUG: [Common.Authentication]: Checking token expiration, token expires '10/08/2020 08:59:42 +00:00' Comparing to '10/08/2020 08:00:43 +00:00' With threshold '00:05:00', calculated time until token expiry: '00:58:58.8834453'
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/subscriptionId/resourceGroups/eresgee/providers/Microsoft.Automation/automationAccounts/azureisdrunk/softwareUpdateConfigurations?api-version=2017-05-15-preview&$filter=properties%2FupdateConfiguration%2FazureVirtualMachines%2Fany%28m%3A m eq %27%2Fsubscriptions%2FsubscriptionId%2FresourceGroups%2FYUFYFYUF_GROUP%2Fproviders%2FMicrosoft.Compute%2FvirtualMachines%2Fghjgjh%27%29

Headers:
x-ms-client-request-id        : 38f11a03-aa90-4e4a-8951-5ec97f7717e1
Accept-Language               : en-US

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Cache-Control                 : no-cache
Pragma                        : no-cache
x-ms-request-id               : 91e924ca-c97b-4e20-bf6a-89e57c94212a
Strict-Transport-Security     : max-age=31536000; includeSubDomains
Server                        : Microsoft-IIS/10.0
X-AspNet-Version              : 4.0.30319
X-Powered-By                  : ASP.NET
x-ms-ratelimit-remaining-subscription-reads: 11999
x-ms-correlation-request-id   : f920777c-963c-4fad-bbfc-9648090ea6d8
x-ms-routing-request-id       : WESTEUROPE:20201008T080043Z:f920777c-963c-4fad-bbfc-9648090ea6d8
X-Content-Type-Options        : nosniff
Date                          : Thu, 08 Oct 2020 08:00:43 GMT

Body:
{
  "value": []
}

DEBUG: AzureQoSEvent: CommandName - Get-AzAutomationSoftwareUpdateConfiguration; IsSuccess - True; Duration - 00:00:00.2229406;
DEBUG: Finish sending metric.
DEBUG: 10:00:44 - GetAzureAutomationSoftwareUpdateConfiguration end processing.

Error output

No error

[markcowl]

@Manbearpiet If you set $DebugPreference='Continue' the above cmdlet returns no debug traces?

[Manbearpiet]

Oh sorry PSA autocompleted it, but didn't finish it :) @markcowl It's there now

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @jaspkaur28.

[dingmeng-xue]

Automation team, please help to look into it. The information of debug is posted.

[jaspkaur28]

@msvijayn for getting it triaged.

[msvijayn]

@Manbearpiet - Debug variable/flag is an attribute of Azure powershell, which provides debugging details from Azure powershell of the internals steps done by the cmdlet. More info here: https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_preference_variables?#debugpreference.

It is not a flag or variable pushed or available for Azure REST API - in this case for Software Update Configurations.

Hence the o/p is correct. When using $DebugPreference='Continue' a variable for Azure powershell - you should see debugging info from powershell for any cmdlet used - detailing what processing cmdlet does. It doesn't entail debugging information from the Azure REST API calls, which ultimately the Azure PS cmdlet internally calls/abstracts.

[Manbearpiet]

Why is this closed @msvijayn , I still have no information regarding

Get-AzAutomationSoftwareUpdateConfiguration​ ​-​ResourceGroupName eresgee ​-​AutomationAccountName aaccount ​-​AzureVMResourceId ​"subscriptions/08ccea82-85e1-4a3e-b0a6-zzzzzzzzzz/resourceGroups/YUFYFYUF_GROUP/providers/Microsoft.Compute/virtualMachines/ghjgjh"

[msvijayn]

@Manbearpiet - see my answer by which I have closed your issue. Have re-opened it now, if you have any further questions.

As stated in the answer, see the links on the functioning of the $DebugPreference from Azure Powershell. It is for providing details of cmdlet execution and not debugging information from Azure.

[Manbearpiet]

Yes, I understand @mattetti thanks for your reply. However my issue is not regarding the built-in DebugPreference, but with the Get-AzAutomationSoftwareUpdateConfiguration​ -​AzureVMResourceId. This cmdlet with this parameter is not outputting anything.

[msvijayn]

Hi, the command works for me. Note that Get-AzAutomationSoftwareUpdateConfiguration​ -​AzureVMResourceId will filter and show SUC resources which were created with explicit values in 'AzureVMResourceId' field (i.e.) during creation via New-AzAutomationSoftwareUpdateConfiguration you specified scope using 'AzureVMResourceId' variable and not 'AzureQuery' property.

If you had created SUC with 'AzureVMResourceId' variable and Get-AzAutomationSoftwareUpdateConfiguration​ -​AzureVMResourceId isn't working. Then it would be a bug or issue which would need investigation - possibly unique to you and some other select set of users; as we are not seeing the stated issue on our subscriptions. Suggest creating a support ticket on Azure, to help us investigate the bug report. As the team can get access to at your subscription & configuration details for investigation - only after you approve during the support process.

[msvijayn]

@Manbearpiet - please see my response posted yesterday. If it answers your query, kindly close the issue or we can do it for you if you can confirm the same.

[Manbearpiet]

I understand @msvijayn, that was not the usecase I tested. This refers to the Virtual Machine binding with the Update Management functionality of a Automation Account. Which is shown in https://docs.microsoft.com/en-us/azure/automation/update-management/deploy-updates#schedule-an-update-deployment bullit 6, "Pick Machines".

Most MSP's don't manually add the machines that way, but use the Azure Query functionality (Dynamic Groups) to define the Update Configuration scope. So in that case there is no issue, but it would be handy to mention this in the documentation of the cmdlet? This to prevent creation of similar issues :). i.e. "Dynamic Groups not supported" or a mention "only works when binded as a Machine to the Update Management functionality of the Automation Account."

Thanks for your effort anyway 👍

[msvijayn]

Thanks, @Manbearpiet - I am closing the issue based on your response.

I understand the predicament caused when you're using Dynamic Groups. In short - since the scope is dynamic, it can only be known if provided VM is part of one or more SUC - if we execute all of their dynamic queries, combine their results and filter for provided VM. First and foremost, this can be a very costly operation as some dynamic queries may span hundreds of machines. Second, at Azure we have strict norms around security & privacy - due to which subsystems like Automation can not (and should not) willy-nilly fetch customer data from other subsystems in Azure like your VM details from Compute. And are only allowed to access such information strictly on a must-need basis like when we have to execute the SUC and need to know the machines to do it for. This ensures that in any worst-case occurrence, your data is isolated and not scattered - reduce chances of an issue in one Azure service having impact on another.

I take your suggest of updating the documentation/content for the cmdlet. I guess we are culpable here, as technical folks at Azure - we think everyone understands our lingo and that having distinct variables called 'AzureVMResourceId' & 'AzureQuery', communicates the difference in function.

[Manbearpiet]

I can agree to the cost aspect, however it's odd that functionality is provided for https://docs.microsoft.com/en-us/powershell/module/az.automation/get-azautomationsoftwareupdateconfiguration?view=azps-5.2.0 Get-AzAutomationSoftwareUpdateConfiguration-AzureVMResourceId, which could contain hundreds of machines also. The option is provided for New configurations with -AzureVMResourceId provided , but not the retrieval of current SUC's with Dynamic Groups.