I have an application which requires a website to be able to make an HTTP call which turns on and logs in to an Azure VM. I am trying to do this with a PowerShell Azure Function. I can successfully turn the VM on/off with the function, using:

$secpasswd = ConvertTo-SecureString $env:SP_PASSWORD -AsPlainText -Force;
$mycreds = New-Object System.Management.Automation.PSCredential ($env:SP_USERNAME, $secpasswd)
Add-AzureRmAccount -ServicePrincipal -Tenant $env:TENANTID -Credential $mycreds;
$context = Get-AzureRmContext;
Set-AzureRmContext -Context $context;
# Start VM
Start-AzureRmVM -ResourceGroupName myResourceGroup -Name  myDevice | Out-String

But I'm getting permission denied errors when trying to log into the VM. I have tried the following methods:

$password = ConvertTo-SecureString "myPassword" -AsPlainText -Force
$cred= New-Object System.Management.Automation.PSCredential ("myUsername", $password )

#Enter-PSSession -ConnectionUri https://<public_ip> -Credential $cred -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck) -Authentication Negotiate


cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
mstsc /v:$Server

When logging in with the standard Remote Desktop GUI, I also need to dismiss the certificate prompts. What do I need to do to log in automatically using an Azure Function?

The VM is running Windows 10.

EDIT: I've set up the ports, made a local certificate and made sure that WinRM is setup for remote management on the VM, and also that it's listening on HTTPS. However, when I try the command on my local machine:

Enter-PSSession -ComputerName -Credential $cred -UseSSL -SessionOption $so

I get the error:

Enter-PSSession : Connecting to remote server failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is acce pting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.

EDIT: I have verified that the port is open and accessible from the Azure Function using

New-Object Net.Sockets.TcpClient "<public-ip>", 5986
  • Are you able to try connecting from another VM inside the Azure vNet, this would prove whether or not it is a firewall issue. Also you don't mention, have you checked your NSG?
    – Sam Cogan
    Jan 25, 2018 at 14:40
  • I've checked all the firewalls and there's no problem there, NSG etc. I think the problem is the certificate, as RM VMs (I think) need to have a certificate from an Azure Key vault as opposed to being allowed to be generated by the VM. At present I'm trying to push a certificate from a Key vault to the VM but getting: "List vaultCertificates contains repeated instances of (https://<certificate_url>, my), which is disallowed. ErrorCode: InvalidParameter" errors, but I'm working on that.
    – Loz
    Jan 25, 2018 at 14:47
  • If your providing the -SkipCACheck -SkipCNCheck flags then it should not be a problem to use the self signed cert that gets issued. I am generally able to use PS Remoting to a brand new VM deployed to Azure, with no changes, so long as firewall and NSG rules are in place.
    – Sam Cogan
    Jan 25, 2018 at 15:06
  • @Loz Do you check this blog, you only need configure a self-signed certificate. Jan 26, 2018 at 8:20
  • @Loz I suggest you could test in your local firstly, please ensure you could access with the command Enter-PSSession -ComputerName -Credential $cred -UseSSL -SessionOption $so. Jan 26, 2018 at 8:21

4 Answers 4


I could never get Invoke-Command to work for the Azure RM VM. The working solution in the end, now successfully implemented, is using Invoke-AzureRmVMRunCommand within an Azure Automation account. Note for interested parties: At present, Azure Powershell Functions only support AzureRM version 1, which does not support Invoke-AzureRmVMRunCommand (even as an imported module), but Azure Automation works very well.


Firstly, have you made sure that your NSG rules allow inbound WINRM traffic to that machine?

Also, your Enter-PsSession command is wrong. Your -connectionURI should just be the public IP or name of the machine, no https, and then you need to use the -useSSL flag.


You should enable winrm service on your Azure VM, also, if you want to login from Azure function, you should set winrm service listen on 5986(https). Http is not working.

First, you should open port 5986 on VM firewall and Azure NSG.

Secondly, you need create a cert.

Thirdly, configure WinRM to listen on 5986.

More information about this please refer to this blog.

  • Hi, I've edited the ask to reflect what I've tried :)
    – Loz
    Jan 25, 2018 at 11:22
  • Hi, do you close the VM, I test in my lab, port 5986,5985,3389 is closed. Jan 26, 2018 at 8:18

With your credential, specify the VM name as part of the username. i.e. if your machine name is vm1 and your user is myusername your credential would look as follows.

$cred= New-Object System.Management.Automation.PSCredential ("vm1\myUsername", $password )

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .