Month: December 2024

Choosing between Azure Automation and Function Apps

Azure Automation and Function Apps offer server-less script execution.

This post explains key differences between Azure Automation and Function Apps, concludes with an opinion on the preferred choice for a Scheduled Task replacement.

Comparing site by site

Usage / Use cases

Both allow the execution of scheduled jobs which themselves are based on scripts. PowerShell is supported on both options.

Azure Automation is triggered either by time or via web-hook. The “result” is like when working with Scheduled tasks. From file-operations to changes in the Azure infrastructure or any other job which is deterministic.

Function Apps also allow time trigger, but also offer a eventgrid integration and some native events, like for instance “on new file in storage account”. Also they can expose web endpoint. That means you could pass in parameters via HTTP Post or in the Query string and get result as JSON for example. There is also the concept of “durable functions” which more or less means that there are always ready to deliver results.

Audience

Azure Automation are targeting IT-Pros, formerly known as System Administrators.

Function Apps on the other hand are more developer focused. SREs or DevOps are also included here.

Manageability

Azure Automation uses “Accounts” as container objects for RunBooks. Settings that apply to all RunBooks such as Environment-Variables, Secrets or shared PowerShell modules.

Activating “Managed Identity” allows granting permissions on other Azure services like for instance allowing starting and stopping of VMs.

A RunBook itself is as dedicated Azure object that contains the script which may bound to a schedule and the execution choice.

Function Apps require an App Server Plan as foundation. The plan defines supported frameworks and dictates the costs. On the other hand, it allows vertical and horizontal scaling!

Dependencies and other settings are defined in *.json files and require little research.

Typically, only one script is stored on a Function App. Multiple scripts are possible but require attention when maintaining them in the different folder structures.

Complexity Level

Azure Automation in general is “simpler” in setting up and maintaining. Mostly because multiple jobs can be managed from one console. Another important aspect is that many aspects configurable via graphical user interface.

Once figured out how they work, using them is convenient.

Function Apps require more considerations when setting up and while maintaining. Most aspects must be done via configuration files. Setting up a schedule for instance requires knowledge of Cron syntax. In my experience PowerShell module dependencies are regular problematic. It is advisable to only import those which are essential for the script to work.

Mastering them have a steeper learning curve.

Various Differences

Azure Automation know the concept of “Hybrid Worker”. Behind that term are ARC enabled Windows Servers which allow the execution of scripts on them. This allows access to resources within the datacenter / the active directory / the private cloud with benefiting for all advantages that Azure technologies brings.

Using Hybrid Woker may also required to overcome limitations that are given such as the amount of available memory or concurrent jobs. – More on: https://github.com/MicrosoftDocs/azure-docs/blob/main/includes/azure-automation-service-limits.md 

Supported languages: PowerShell and Python

GIT integration with bidirectional sync. – Deployment pipeline managed automatically.

Function Apps offer a rich set of integrations with Azure PaaS services. As they run within the context of an App Service Plan there are horizontal and vertical scaling options available to overcome also very demanding jobs.

Supported languages: PowerShell, C#, NodeJS, Python and more.

GIT integration with bidirectional sync and support for complex pipelines within Azure DevOps allow also sophisticated scenarios.

Conclusion

In my opinion is Azure Automation the best fit to be the better alternative to tradition Scheduled Task. Version Control, Change-Tracking, Security, Monitoring, Redundancy options and much more are reason for it.

Evolve from Scheduled Tasks to Azure Automation or Function Apps

Scheduled Tasks have been around since the early days of Windows Server. The task scheduler is the inbuilt component used to plan and execute jobs. Typically, System administrators use them to automate reoccurring activities which are defined in scripts.

While Scheduled Tasks are robust and easy to use, they have a couple of shortcomings.

This blog explains the advantages of Azure Automation or Function App over Scheduled tasks.

Looking on Scheduled Tasks and their opponents in Azure

Storage / Location

Scheduled Tasks are stored on an individual computer. – If the computer requires replacement or decommissioning, the task needs to be migrated.

Azure Services live in the cloud and have no fixed relation to a computer.

Execution

Scheduled Tasks are executed on an individual computer. – In case the computer is unavailable, the task will not run.

Azure Services run typically in the cloud OR on designated computers.


Redundancy

Scheduled Tasks have no redundancy options out of the box. – They are typically stored only on 1 computer.

Azure Services provide different options for been redundant. Even if execution is on computers.

Change Tracking / Versioning

Scheduled Tasks are changed on demand without direct support of managing the change properly.

Azure Services can be connected to a Version Control System, e.g. Azure DevOps and allow tracking on changes and versioning via underlying GIT protocol.

Monitoring

Scheduled Tasks can be monitored on a the individual computer. For centralized monitoring the use of SCOM or an alternative Server-Monitoring system is required.

Azure Services can send diagnostic and performance data via single click to a central Log Analytics Workspace. Kusto queries allow monitoring and alerting.

Security

Scheduled Task run typically under the context of “System” which has the highest level of permissions on the individual server. By using the computer object, permissions on remote locations, like file-shares or others can be granted.

In cases a dedicated User account is created, has to be granted sufficient permissions on the computer to run the task. Typically the password is stored and never changed.

In worst cases, the credentials are stored in plain text within the script.

Azure Services can leverage a “managed identity” which password is neither exposed nor it requires attention. Furthermore, if credentials for different operations within the script are needed, the managed identity can be granted access to a Key Vault to obtain secret information securely.

Costs

Scheduled Tasks are part of the Windows operating system and do not come with extra costs or licenses.

Azure Services offer free tiers or are charged for minimal wages.

Round Up

To conclude, Azure Runbooks and Function Apps outperform the traditional Scheduled Tasks in many aspects.