Share via

Secure Azure Automation Webhook

Denys Pasternak 40 Reputation points
2025-03-17T19:14:34.63+00:00

Hello,

How can I secure a webhook in Azure Automation if the service using it is outside of Azure?

As far as I understand, I can create a Privet Endpoint, prohibit external access to the Azure Automation Service and configure access to the Privet Endpoint using Azure Firewall.

Is there another scenario possible? So as not to complicate the scheme. After all, non-secret data is transmitted, but I would not like the webhook to be available to everyone. It would be nice to somehow protect it.

It is possible to use EntraID Application, but I do not quite understand how it will transfer parameters and how this can be linked in general.

I would be grateful for help.

Another additional question. For the sake of curiosity, it is off topic, most likely webhook links are not designed for long-term use and the design of their use is such that they should be issued for a short period of time and generated on demand (maybe I'm wrong).

Thank you.

Azure Automation
Azure Automation
An Azure service that is used to automate, configure, and install updates across hybrid environments.
1,366 questions
0 comments
Accepted answer
  1. Stanislav Zhelyazkov 28,186 Reputation points MVP Volunteer Moderator
    2025-03-18T14:29:21.2766667+00:00

    Hi,

    The illustrated scenario is the only one possible. Azure Automation is public service and the webhooks do not have additional authentication. The only authentication is via the webhook url which contains the token that allows the authorization. You can use Azure private endpoint in order to secure the webhook URLs to not be public and thus secure them a little bit more. You can additioanlly code your runbooks in a way that they should expect some parameter with specific value to be passed in order to execute the actions in the runbook. Note that in any way is not authentication mechanism just additional protection in case the webhook is compromised.

    Webhooks can be long term and how you treat them depends on your security requirements. If you can create some automation workflow that creates new webhooks on specific period of time and replaces them in the places where you use them that certainly will increase the security of them. Remember to issue the webhooks for period valid until your next workflow run or delete the old ones once they are replaces.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.