VM Power Management

Prerequisites

Two ways to run this, and two different identities doing the work. Running a command yourself uses your own rights, and how much you need depends on the command. The deployed controller uses an identity the deployment creates, and that one is fixed.

Software

PowerShell 7.2 or later — the module is Core-only
Az.Accounts 2.15 and Az.Compute 7.1.1 or later, installed with the module
Azure CLI with Bicep, for the deployment only

Who needs which role

Option 1

Run commands yourself

Your own account holds these. Nothing is created and nothing is assigned. Each command states what it needs at the top of its own page, because they differ — most of the module needs nothing at all.

Nothing — New-VmPowerSchedule, Show-VmPowerScheduleCalendar and Test-VmPowerSchedule build and check objects in memory
Reader on the subscriptions you want reported on, or a management group above them — Get-VmPowerPlan
Microsoft.Automation/automationAccounts/variables/read, and /write to store one — the *-VmPowerSchedule commands against a deployed account
Microsoft.Compute/virtualMachines/read, /start/action and /deallocate/action — Invoke-VmPowerPlan, the one command that acts. Normally the controller runs this, not a person

Option 2

Deploy the controller

To deploy: Owner on the subscription — or Contributor plus User Access Administrator. It creates a resource group with the Automation Account, the workspace and the workbook, and at the subscription a custom role, its assignment and two policy definitions. The identity it creates holds these four actions, and needs nothing on its own Automation Account:

Microsoft.Compute/virtualMachines/read
Microsoft.Compute/virtualMachines/start/action
Microsoft.Compute/virtualMachines/deallocate/action
Microsoft.Resources/subscriptions/resourceGroups/read

The identity reads its settings through the sandbox's asset cmdlets rather than over ARM, which is why the account itself needs no role. If a command fails against your own account, the line at the top of that command's page says what it wanted: the command reference.

Do not use this for

The repository opens with the argument for using something else. Auto-shutdown is free and built in; if one machine needs one shutdown time and nobody needs it started again, use that instead.

If the machine is	Why not	Do this instead
A domain controller	Replication and time service break in ways that surface days later, on other machines	Leave it running
Holding a quorum — cluster node, etcd, availability group	Stopping a member can cost the quorum, and starting it back does not always heal	Scale the workload, do not power it
Under a customer SLA	An outage you scheduled is still an outage you caused	Keep it out of scope
In production, generally	This is built for development and test estates and its defaults assume that	One resource group, and a month of the workbook first
Being used by somebody right now	Version 1 reads power state and tags, not sessions	Exclude the machine

When not to use this, in full

← Overview·Deploy·Commands