Azure Automation jobs sharing subscription context

Question

I have an Azure Automation runbook that kicks off a child runbook for each subscription.

foreach ($sub in $subscriptions)
{
    $ChildRunbookInputParams = @{"SubscriptionId"="$($sub.SubscriptionId)"}

    $job = Start-AzureRmAutomationRunbook `
            -Name $ChildRunbookName `
            -Parameters $ChildRunbookInputParams `
            -ResourceGroupName $AutomationAccountResourceGroup `
            -AutomationAccountName $AutomationAccountName 
}

The parent and child runbooks both use the same run-as account.

The problem I'm running into is that the runbooks seem to be sharing contexts, even though they are running as independent jobs.
The parent runbook does a Set-AzureRmContext to the subscription containing the automation account so that it can Start-AzureRmAutomationRunbook. The child runbook does a Set-AzureRmContext to the subscription ID that it is passed so it can process resources in that subscription.
After the first child runbook starts, subsequent Start-AzureRmAutomationRunbook calls in the parent runbook fail because it can no longer find the specified runbook. And as additional child runbooks are started (the parent runbook gets several child jobs kicked off before the first one changes subscriptions) the previously started child jobs start processing resources for the last subscription.

Is this the expected behavior? Working with multiple subscriptions seems like a common requirement; what's the recommended pattern for this?

Related feedback item: feedback.azure.com/forums/246290-automation/suggestions/… — BenV
Related GitHub issue: github.com/Azure/azure-powershell/issues/1257 — BenV

H Boyce H Boyce · Accepted Answer · 2018-05-24T00:16:32

We ran into this issue as well and had to open a support case with Microsoft to resolve. It may only have been possible since Sept 2017 as Azure PowerShell modules/cmdlets began supporting the ability pass in a profile (AzureRM context) as a parameter; this ensures that AzureRM commands running in parallel -- via workflow or by starting a new child automation job using Start-AzureRMAutoRunbookJob -- execute against the specified context.

The reason for this issue is because using Azure-managed automation workers, under high job volume, Azure reuses workers to conserve resources and context may be lost.

Example of this is available on GitHub (https://github.com/jefffanjoy/DemoCode/tree/master/Runbooks/Azure%20Automation)

Azure Automation jobs sharing subscription context

1 Answers