How to log in to Azure VM automatically from Azure Function?

Question

I have an application which requires a website to be able to make an HTTP call which turns on and logs in to an Azure VM. I am trying to do this with a PowerShell Azure Function. I can successfully turn the VM on/off with the function, using:

$secpasswd = ConvertTo-SecureString $env:SP_PASSWORD -AsPlainText -Force;
$mycreds = New-Object System.Management.Automation.PSCredential ($env:SP_USERNAME, $secpasswd)
Add-AzureRmAccount -ServicePrincipal -Tenant $env:TENANTID -Credential $mycreds;
$context = Get-AzureRmContext;
Set-AzureRmContext -Context $context;
# Start VM
Start-AzureRmVM -ResourceGroupName myResourceGroup -Name  myDevice | Out-String

But I'm getting permission denied errors when trying to log into the VM. I have tried the following methods:

$password = ConvertTo-SecureString "myPassword" -AsPlainText -Force
$cred= New-Object System.Management.Automation.PSCredential ("myUsername", $password )

#Enter-PSSession -ConnectionUri https://<public_ip> -Credential $cred -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck) -Authentication Negotiate

and

$Server="<public_ip>"
$User="myUsername"
$Password="myPassword"
cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
mstsc /v:$Server

When logging in with the standard Remote Desktop GUI, I also need to dismiss the certificate prompts. What do I need to do to log in automatically using an Azure Function?

The VM is running Windows 10.

EDIT: I've set up the ports, made a local certificate and made sure that WinRM is setup for remote management on the VM, and also that it's listening on HTTPS. However, when I try the command on my local machine:

Enter-PSSession -ComputerName 52.166.161.93 -Credential $cred -UseSSL -SessionOption $so

I get the error:

Enter-PSSession : Connecting to remote server 52.166.161.93 failed with the following error message : The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is acce pting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: "winrm quickconfig". For more information, see the about_Remote_Troubleshooting Help topic.

EDIT: I have verified that the port is open and accessible from the Azure Function using

New-Object Net.Sockets.TcpClient "<public-ip>", 5986

Answer 1

I could never get Invoke-Command to work for the Azure RM VM. The working solution in the end, now successfully implemented, is using Invoke-AzureRmVMRunCommand within an Azure Automation account. Note for interested parties: At present, Azure Powershell Functions only support AzureRM version 1, which does not support Invoke-AzureRmVMRunCommand (even as an imported module), but Azure Automation works very well.

Answer 2

Firstly, have you made sure that your NSG rules allow inbound WINRM traffic to that machine?

Also, your Enter-PsSession command is wrong. Your -connectionURI should just be the public IP or name of the machine, no https, and then you need to use the -useSSL flag.

Answer 3

You should enable winrm service on your Azure VM, also, if you want to login from Azure function, you should set winrm service listen on 5986(https). Http is not working.

First, you should open port 5986 on VM firewall and Azure NSG.

Secondly, you need create a cert.

Thirdly, configure WinRM to listen on 5986.

More information about this please refer to this blog.

Answer 4

With your credential, specify the VM name as part of the username. i.e. if your machine name is vm1 and your user is myusername your credential would look as follows.

$cred= New-Object System.Management.Automation.PSCredential ("vm1\myUsername", $password )