Remote administration of CHEs with d365fo.tools?

[FH-Inway]

I'm wondering if it is possible to use the d365fo.tools to remotely administer a (or several) cloud hosted environments. Maybe also downloaded VHD local oneboxes.

One way seems to be Windows PowerShell Remoting. Has anyone played around with that or knows of another way?

A sample scenario/user story could be:
As a system administrator, I want to activate a configuration key on several cloud hosted environments. To do that, I want to provide a list of environments to my PowerShell script. The script connects to each environment, enables maintenance mode, runs a runnable class that activates the config key and then disables maintenance mode again.

[Splaxi]

From a technical point of view it should be fairly easy, as LCS does the same.

Personally I never did anything like this and the closest I know anyone got is a pipeline per developer box, with a local agent installed on the box.

That way they could run different repetitive tasks outside business hours.

[FH-Inway]

Not sure how LCS does it, but while PowerShell remoting can be enabled on CHEs, the actual use of it results in some ugly error messages. Seems something of the setup of the environments does not work with PS remoting. For now, it seems the local agent is the way to go, at least for developer topologies.

[Splaxi]

I deep dived into some of the finer details of the network configuration for CHE.

You should be able to allow an external IP, to gain access. Look into the Network Security Group, and see that MS has 5 ip's whitelisted. This is what enables LCS to download packages and install them on the machine.

[FH-Inway]

Thanks for taking another look. When I tried it, I used Enable-AzureVMPSRemoting to enable the access (following this article: https://techcommunity.microsoft.com/t5/itops-talk-blog/powershell-basics-connecting-to-vms-with-azure-psremoting/ba-p/428403). This created an inbound port rule similar to the existing ones that MS created. However, when I then tried to execute a Invoke-AzVMCommand or Enter-AzVM, I got various error messages. Researching those led me to Azure/azure-powershell#9317, which indicates that something is wrong with the VM configuration.

Were you able to connect to a CHE via PowerShell during your dep dive?

[Splaxi]

I didn't get to that part.

But I would really focus on the network side, rather on anything else.

My way of thinking is: LCS utilizes WinRM - so the VM is fully working in regards to WinRM connectivity.

We might be missing certificates and other things, including a network that will accept our connection.

But I'm not going to track it down - I have enough on my hands. But I just wanted to let you know 😉

[FH-Inway]

I gave this another shot - unsuccessfully.

What I found in no particular order:

• Invoke-AzVMCommand and Enter-AzVM are special commands only available in the Azure PowerShell. They can be found here: https://github.com/Azure/CloudShell/blob/aac4334b42e2ae6462c87aa2e97b538f59c904f8/linux/powershell/PSCloudShellUtility/PSCloudShellUtility.psm1 From what I could tell, some parts of them (Get-AzVMPublicIPAddress) are just plain wrong. However, it turns out they are just fancy wrappers for Invoke-Command and Enter-PSSession.
• Using Invoke-Command, I found a whole new barrel of issues, e.g. PowerShell remoting fails because of SSL certificate issues MicrosoftDocs/azure-docs#68262
• In several error messages, https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/remote-tools-troubleshoot-azure-vm-issues and https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_remote_troubleshooting are mentioned, so those are probably the next steps I will try
• Enable-AzureVMPSRemoting uses Invoke-AzResourceAction to execute a PowerShell script on a VM to Enable-PSRemoting

Regarding your suggestions: I don't think it is a network issue, after creating a network rule that allows all incoming call for WinRM on port 5986, there doesn't seem to be much else you can do on that front. Regarding certificate, I'm not sure. Enable-AzureVMPSRemoting is supposed to take care of this by creating and configuring a self-signed certificate.

I'm seeing some differences when I try Invoke-Command in the Azure PowerShell vs. a local PowerShell session, so that's probably another angle for investigation.

For now, I've spent enough hours on it.

[FH-Inway]

One year later: I got this working with Invoke-AzVMRunCommand. Still no luck with Invoke-AzVMCommand and Enter-AzVM.