This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 57.00000000000001%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHO%3C/text%3E%3C/svg%3E)
Hello,
A customer requires VPN to their on-prem resources. It's possible to configure VPN from the VNet where Automation Account (AA) is. I would like to avoid Hybrid Runbook Workers.
I would like to initiate a job from a resource, for example Logic Apps, from my own Azure subscription and the job (worker) would access the customer through VPN.
I suppose this is not possible as workers are shared by AAs and the connection is not from my AAs private endpoint, but from the worker which uses AA platform's IP-addresses?
Best regards,
Hannu
Hi there,
Quick answer is no.
Azure Automation sandboxes are quite dynamic. If you need non-public access to the service, HRW servers or private link only.
Thank you.
Access to the Automation Account may be public and the target resources accessed by the sandbox workers may require VPN or IP whitelisting. Also I may not be allowed to install HRW to the target resources.
What I could do is install HRWs to VMs of my control, which has VPN and/or static Public IP, and the VMs would access the target resources. In short, use a proxy.
Azure Automation Accounts have IP-addresses based on a region and a type of service. But the range is huge and it's not static.
An actual file with the IP addresses is published here and is being updated regularly
https://www.microsoft.com/en-us/download/details.aspx?id=56519
Actually, you found a right workaround (IMHO) where you can use Azure VM as an HRW machine, and this solves your problem.