Azure Automation Fails to Start Machine

I have an Azure virtual machine running Server 2012 R2. I use Azure Automation to start the machine weekdays at 6am and shut it down at 10pm. I just realized the machine hasn’t started all week.

When I logged in to the Azure dashboard, no warnings were displayed.

I clicked on my Automation account and saw this at the top of the page:

Azure Automation failure 1

The automation Job History shows all green “Success” check marks:

Azure Automation failure 2

However if you click on an individual job, you can see that in fact it is failing with error AADSTS50012:

Azure Automation failure 3

Clicking on the error reveals these details:

RunbookFlow : AADSTS70002: Error validating credentials. AADSTS50012: Client assertion contains an invalid signature. 
[Reason - The key used is expired., Thumbprint of key used by client: '502E811...B2FFE', Found 
key 'Start=06/10/2016, End=06/11/2017, Thumbprint=502E811...B2FFE', Configured keys: 
[Key0:Start=06/10/2016, End=06/11/2017, Thumbprint=502E811...B2FFE;]]
Trace ID: ab2b557e-1573-4634-9bd1-36fb937f0700
Correlation ID: 71561595-be47-4af6-88c6-bd212d526324
Timestamp: 2017-06-14 13:01:05Z
At line:9 char:57
+ <#-- Enable activity tracing to see error location -->; RunbookFlow `
+                                                         ~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Invoke-RunbookFlow], AdalServiceException
    + FullyQualifiedErrorId : Orchestrator.GraphRunbook.Cmdlets.InvokeRunbookFlowCommand

I went back to the first error and clicked where it said “Click here to renew the certificate(s).” This took me to Run As Accounts. After clicking on the Azure Run As Account, there was a link to Renew certificate:

 

Azure Automation failure 4

This message is displayed:

Azure Automation failure 5

After clicking Yes, a new, one-year certificate is issued:

Azure Automation failure 6

Back on the main Automation account overview page, I now have this message:

Azure Automation failure 7

Huh? Why would it tell me that it will be using the “latest modules” three days from now? The “Learn More” link only goes to the document on scheduling runbooks. Maybe this message is coincidental and not related to the certificate issue.

I started the StartAzureV2Vm runbook manually. This time, it completed without errors and the machine was started.

Note to Microsoft

This is extremely poorly implemented. There is no advance warning that a certificate is near expiration, and failing jobs show as successful.

  • If a certificate is about to expire, notify the account owner via email.
  • If the StartAzureV2Vm job fails to start the VM, fail the job; do not show a green “success” check mark just because the job completed.
  • If an automation job fails, notify the account owner via email.

Update November 27, 2018

This year, it seems the certificate auto-renewed without intervention. In the Automation account, under Shared Resources > Certificates, the certificate shows an effective date of June 14, 2018.

3 thoughts on “Azure Automation Fails to Start Machine

  1. Stephen Ballon

    Note to Microsoft update: still no notification about expiring certs, the job ain’t failed when it failed to start the VM, no automation fail notification. Anyway, thank’s for this article, good to know I ain’t the only one to “enjoy” this experience ;-)

  2. Mark Berry Post author

    @Stephen, did you recently have a certificate expire without being auto-renewed? I just noticed last week that my cert did auto-renew in June 2018 (see update at the bottom of the article).

  3. Tosolini Maxime

    I got an expired certificate as well. And no notification as well.

Leave a Reply

Your email address will not be published. Required fields are marked *

Notify me of followup comments via e-mail. You can also subscribe without commenting.

This site uses Akismet to reduce spam. Learn how your comment data is processed.