Azure Automation Account and Private Endpoints

Question

In our tenant, we have an Automation account with a few runbooks that connect to Exchange Online and run powershell scripts to block Exchange Online Powershell, except for a few users and modify calendar permissions. Recently we received an alert from our eSentire Azure alerting service telling us that the Automation account should be restricted with a private endpoint os that public network access is disabled.

Would setting up a private endpoint block the runbooks from connecting to Exchange Online? I haven't been able to find anything in Microsoft's documentation about how private endpoints can affect connectivity to M365 resources like Exchange Online.

Answer 1

Hi there,

Exchange Online is not Azure.
Azure Private Link endpoints are referred to Azure services only.

On the other hand, Azure IP range is quite dynamic, and Azure changes the public IPs regularly. https://www.microsoft.com/en-us/download/details.aspx?id=56519

In you case, it seems better to:

• create an Azure VM with a public IP address
• allow the IP address in your whitelist in Exchange Online,
• register the VM as a Hybrid Worker Server
• trigger all runbooks in the Hybrid Worker Server

https://learn.microsoft.com/en-us/azure/automation/extension-based-hybrid-runbook-worker-install?tabs=windows%2Carm-template

Answer 2

Thank you for the insight! It sounds like we might be better off scrapping the runbooks if it would involve setting up a VM just for these 2 runbooks.