IntegrationWorkz

 Using Azure Virtual WAN for your hub/spoke network and want to know how to control the 'Propagate Default Route' setting on a Azure VHub Network Connection via code? Modifying this setting via the UI is easy. Go to the specific virtual network connection in the Virtual network connections setting of the Virtual WAN and change the value from Enable into Disable or vice versa. How to do this via code was a mystery for me until I consulted Microsoft support. If you consult the documentation for maintaining the virtual hub network connection you don't find a setting named 'Propogate Default Route' or a mention in the description about it. ARM / Bicep - Hub virtual network connections PowerShell - New-AzVirtualHubVnetConnection Azure CLI - az network vhub connection Microsoft Support explained that the attribute  enableInternetSecurity , with description 'Enable internet security.', is actually controlling the behavior off the option 'Propagate Default Ro...

If I want to deploy a monthly schedule on for example the last day of the month I encounter an error message when I used the REST API or the ARM template. The body of the REST API for creating schedules I used look likes this: { "name": "demoSchedule", "properties": { "startTime": "2022-05-07T22:00:00+02:00", "interval": 1, "frequency": "Month", "advancedSchedule": { "weekDays": [], "monthDays": [ -1 ], "monthlyOccurrences": [] } } } When I execute this REST call I receive the following error message: { "code": "BadRequest", "message": "Argument requestScheduleData with value Orchestrator.Schedules.DataAccess.Models.ScheduleAllData is not valid. Error message: The input value is not valid for Monthly Schedule Type" } After spending a lot of time of trial & error I ...

When you want to do a role assignment to a principal in an ARM template you will use code like the one below. In this example the role definition is actual the object id of the role. If you want to assign the contributor role you will use the value 'b24988ac-6180-42a0-ab88-20f7382dd24c'. You also have to specify the id of the principal so you will have to retrieve that value yourself upfront. { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2020-04-01-preview", "name": "[guid(parameters('roleAssignmentName'))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId'))]", "principalId": "[parameters('principalId')]", "scope": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters(...

Lately I am busy with Azure Automation . In terms of ARM templates I run into a number of issues with this product. See also my previous blog postings about this. This time too I had to look for another workaround. In this case it concerns the start time of a schedule . This must be at least 5 minutes in the future for the product group each time you do an ARM deployment for the schedule object. This resource is also not complying to the idempotency rules of ARM template. My workaround is to mark the date part of the startTime (for daily, weekly, montly recurring schedules) in my parameter file with ' GEN-DATE ' placeholder and my ARM template will generate each time the correct date if I do the deploy. To replace the placeholder with the correct value I first thought to use an user defined function for this purpose. After reading the documentation, I could conclude that this functionality did not match what I needed. An user defined function consist of input parameters and ...

The implementation of Azure Automation in ARM templates has some quirks. The last time I blogged about the lack of idempotency for the jobSchedule resource. In this article I will write about the solution I had to write because the ARM template for webhooks has a little flaw. If you read the template reference documentation you can see that the template format is as follows. { "name": "string", "type": "Microsoft.Automation/automationAccounts/webhooks", "apiVersion": "2015-10-31", "properties": { "isEnabled": "boolean", "uri": "string", "expiryTime": "string", "parameters": {}, "runbook": { "name": "string" }, "runOn": "string" } } Quite straight forward you will think but there is one catch: there are some properties which are defined as not required ...

This week I was busy with writing ARM templates for deploying a runbook within an Azure Automation account. One of the parts you need for this is the jobSchedule object. The first time I created the object the deployment went succesful but when I deployed the same template a second time the deployment fails with the error message "A job schedule for the specified runbook and schedule already exists".  After doing some research I found out that I was not the only one. In Azure Feedback I found a bug item from Yulun Zeng dated January 24, 2018 who encountered the same issue. The bug is under review since January 7, 2020 but is still not solved. Some of the Azure Automation resources are conflicting with a fundamental rule of ARM templates documented by Microsoft. Repeatable results: Repeatedly deploy your infrastructure throughout the development lifecycle and have confidence your resources are deployed in a consistent manner. Templates are idempotent, which means you can ...

When updating some network related ARM templates I stumbled on the concept of subnet delegation. What is subnet delegation? Subnet delegation enables you to designate a specific subnet for an Azure PaaS service of your choice that needs to be injected into your virtual network. When you delegate a subnet to an Azure service, you allow that service to establish some basic network configuration rules for that subnet, which help the Azure service operate their instances in a stable manner. One of the advantages is that the service can configure for example routing policies or network security groups.  Subnet delegation and API Management When I was updating our virtual network/subnet templates I stumbled on the delegation section. "delegations": [ { "id": "string", "properties": { "serviceName": "string" }, "name": "string" } ] After doing some research about the concept I opened ...

The Microsoft documentation for modularizing ARM templates is missing a sample where the copy loop is combined with returning output. I modified the example template which Microsoft uses in their Get values from linked template example to demonstrate this scenario.  The linked template gets a parameter where we can pass in a name for the greeting. { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "name": { "type": "string" } }, "variables": {}, "resources": [], "outputs": { "greetingMessage": { "value": "[concat('Hello ', parameters('name')]", "type": "string" } } } The main template deploys the linked template and gets the returned values from the name array. Notice th...

Within the company I work for we use Azure DevTest Labs already for a year to host our personal development computer and the BizTalk CI machines we need. We are planning to host also our development and test environments in Lab environments. At the moment we configure the lab environments manually. I invested some time to write ARM templates to deploy Azure DevTest Labs within 5 minutes based on Azure DevOps CI/CD pipelines. In the process of writing these scripts I learned a lot. For example that the Azure documentation is not always up to date and that includes also tooling like Azure Resource Explorer . Based on querying the REST API with Postman I found the missing pieces for deploying a DevTest Lab environment based on nested ARM templates. In this post I will document the nested ARM template I created the last few days. Lab With the first template you can create the lab environment itself and configure the following parts of the environment Lab settings; like the st...

At the moment I am middle in the process of writing my ARM templates for deploying an Azure DevTest Lab environment based on an Azure DevOps CI/CD pipeline. Unfortunately not all the options you can configure from the Azure portal are exported by the automation script option of the resource group or are available within the Azure Resource Explorer . So much of the information you need you have to find in the REST API documentation of DevTest Labs. To find out what the results are from the Policies - List GET method I need to query the REST API. I will be using the Postman app for this purpose. To query the Azure REST API you will need to be authenticated. You can do this in two ways: with your own Microsoft/Azure AD account or with a service principal . Because of the ad-hoc character of my research the Microsoft account route is the one I will use. Retrieving bearer token To retrieve the bearer token of my Microsoft account I need to authenticate myself. For this purpose we w...