Azure Runbooks

Deploy Azure Automation runbooks for scheduled compliance scanning, endpoint vulnerability assessment, and automated remediation.

Overview

TATER uses Azure Automation Account runbooks for hands-free scheduled scanning. Four runbooks handle different workloads:

Runbook	Runtime	Schedule	Purpose
Scan-M365Cloud	PS 5.1	Weekly (Sun 2 AM)	M365 cloud compliance scan
Scan-Endpoints	PS 5.1	Daily (3 AM)	MDE + Intune vulnerability scan
Run-Remediation	PS 7.2	On-demand	Primary remediation runbook
Run-Remediation-EXO	PS 5.1	On-demand	Exchange/Defender remediation

Prerequisites

• Azure Subscription with Automation Account
• Entra ID app registration with required permissions (see Registered Apps)
• Azure Key Vault with authentication certificate
• Managed Identity enabled on the Automation Account
• Storage Account for remediation scripts (if using remediation)

Required PowerShell Modules

The Automation Account must have all of the following modules installed for the PS 5.1 runtime before the cloud scan will run correctly. Install in the order listed - each group depends on the one above it.

Module	Purpose	Note
Az.Accounts	Azure authentication	Install first - others depend on it
Az.Storage	Download control scripts from blob storage
Az.KeyVault	Retrieve certificate from Key Vault
Az.Automation	Parent→child runbook delegation	Required for remediation
Microsoft.Graph.Authentication	Graph API auth	Install before other Graph modules
Microsoft.Graph.* (6 sub-modules)	Users, Groups, Reports, Applications, DirectoryManagement, SignIns
ExchangeOnlineManagement	Exchange Online + Security & Compliance	~80 controls depend on this
MicrosoftTeams	Teams policy queries	Teams Cs* cmdlets require delegated auth - ~36 controls skip
PnP.PowerShell	SharePoint Online (modern module)
Microsoft.Online.SharePoint.PowerShell	SharePoint Online (legacy Get-SPOTenant cmdlets)	Required for SPO_001–SPO_015 controls

Automation Variables

Configure these variables in your Automation Account:

Variable	Purpose
AppClientId	App registration client ID
KeyVaultName	Key Vault name for certificate
CertName	Certificate name in Key Vault
TenantDomain	Tenant domain (e.g., contoso.onmicrosoft.com)
TenantId	Azure AD tenant ID
ApiBaseUrl	TATER API base URL
ApiKey	API key for scan upload authentication
OrganizationId	TATER organization ID
AutomationAccountName	Name of this executing account; required for remediation child delegation
AutomationResourceGroup	Resource group containing this executing account; required for remediation child delegation

Managed Identity Permissions

Azure RBAC

• Automation Operator: Required for Start-AzAutomationRunbook (parent/child delegation)
• Storage Blob Data Reader: Required for remediation script downloads

Microsoft Graph Permissions

Same permissions as the app registration. See Graph API Permissions.

Cloud Scan Runbook

The Scan-M365Cloud runbook authenticates to M365 services using the certificate from Key Vault, evaluates control scripts against your tenant, and uploads results to the TATER API.

Endpoint Scan Runbook

The Scan-Endpoints runbook queries MDE API and Intune for device inventory, vulnerabilities, software, and CISA KEV data. Key technical details:

• Uses Invoke-RestMethod directly (not Invoke-MgGraphRequest which is unavailable in PS 5.1 sandbox)
• MDE API requires a separate OAuth token with api.securitycenter.microsoft.com scope
• Queries vulnerabilities per-machine (not bulk) to avoid memory limits (~400MB sandbox)
• Deduplicates CVEs across all devices

Remediation Runbooks

Two-runbook architecture for automated remediation:

Run-Remediation (PS 7.2)

• Receives webhook trigger from TATER API
• Downloads remediation script from blob storage
• Scans script for Exchange Online cmdlets
• If EXO cmdlets found, delegates to PS 5.1 companion
• Otherwise executes script directly with Graph API token
• Reports status back to TATER API

Result delivery and uncertain outcomes

Both remediation runbooks confirm the Running report before starting an action. If the API cannot confirm it, or the job is already terminal, they start no new action. Final reports retry transient delivery failures within a bounded budget; this retries the report, not the remediation.

If final delivery remains unconfirmed, the runbook performs its normal cleanup and raises a terminating error. The tenant change may already have happened. Check the Automation output and the actual tenant state before deliberately starting another remediation. A stale TATER status or an Automation failure caused by reporting does not prove that the tenant change failed.

This reporting behavior does not impose a new execution deadline on the remediation script and does not apply to Ops cloud scripts.

Run-Remediation-EXO (PS 5.1)

The parent verifies that the configured account contains its current Automation job before starting the companion. Child start, status checks and diagnostic output use this account and the same managed-identity context. Missing account settings, invalid job metadata or a failed lookup refuse delegation. Check the two account variables and the identity's access to its own account when this happens. Setup and the shared runbook publisher configure and verify these nonsecret variables; the publisher stops for an existing mismatch. Publishing does not execute a remediation or verify its effect on the tenant.

• Called by parent runbook via Start-AzAutomationRunbook
• Connects to Exchange Online using certificate auth
• Executes Exchange/Defender/Security & Compliance remediation scripts
• Reports its status to the TATER API; the parent observes child completion and handles delegation failures

Schedules

Schedule Name	Frequency	Time (ET)	Runbook
weekly-m365-scan	Weekly	Sunday 2:00 AM	Scan-M365Cloud
daily-endpoint-scan	Daily	3:00 AM	Scan-Endpoints

Troubleshooting