Azure Automation
An Azure service that is used to automate, configure, and install updates across hybrid environments.
1,353 questions
TLS 1.3 Support in Azure Automation Sandbox
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(259.20000000000005, 88%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMD%3C/text%3E%3C/svg%3E)
Matthew Dowst
0
Reputation points MVP
I was wondering if anyone has any insight on when Azure Automation Sandboxes will support TLS 1.3 for PowerShell runbooks. Microsoft and by extension Defender are pushing TLS 1.3 across all Azure resources, but I can’t connect to them using runbooks because the sandboxes are still running Windows 10 on the backend. Unfortunately, I don’t have an option to use a hybrid worker. I’m not seeing anything on the Azure Updates feed about this.
Azure Automation
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 63%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAG%3C/text%3E%3C/svg%3E)
Ashok Gandhi Kotnana 6,680 Reputation points Microsoft External Staff Moderator2025-04-18T07:04:57.17+00:00 Hi @Matthew Dowst,
Thanks for writing to us,
It looks like Microsoft has been encouraging the use of TLS 1.3 across Azure resources, but Azure Automation Sandboxes, which may be causing compatibility issues for PowerShell runbooks. While I couldn't find a direct announcement about TLS 1.3 support for Azure Automation Sandboxes, Microsoft does emphasize that older versions of TLS (such as 1.0 and 1.1) will no longer be supported for Hybrid Runbook Workers starting March 1, 2025.
For now, Microsoft advises against explicitly setting your agent to only use TLS 1.2, as this could prevent automatic upgrades to newer protocols like TLS 1.3 when they become available. If you're looking for official updates, keeping an eye on Microsoft's Azure Automation documentation or the Azure Updates feed might be your best bet.
Reference: https://learn.microsoft.com/en-us/azure/automation/automation-managing-data#tls-for-azure-automation
Please let me know if you face any challenge here, I can help you to resolve this issue further
-
Ashok Gandhi Kotnana 6,680 Reputation points Microsoft External Staff Moderator
2025-04-21T02:12:23.96+00:00 Hi @Matthew Dowst ,
Just want to check if the above answer worked for you or else please let us know if any help, we are always here to help whenever you need us.
-
Ashok Gandhi Kotnana 6,680 Reputation points Microsoft External Staff Moderator
2025-04-22T07:56:03.5233333+00:00 Hi @Matthew Dowst ,
We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.
-
Matthew Dowst 0 Reputation points MVP
2025-04-22T17:24:48.6766667+00:00 This is not really an answer. The question is when will Microsoft start support TLS 1.3 in Azure Sandboxes? This is a big deal because either you can't use Automation runbooks to talk to Functions App or you can't be compliant with Defender, NIST, or CMMC.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(297.6, 79%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMJ%3C/text%3E%3C/svg%3E)
Madugula Jahnavi 495 Reputation points Microsoft External Staff Moderator2025-04-28T15:10:54.4566667+00:00 Matthew Dowst, Can you check this Blog once if it works for you!
-
Madugula Jahnavi 495 Reputation points Microsoft External Staff Moderator
2025-04-29T12:57:54.1533333+00:00 Matthew Dowst, Could you respond to the above comment if the provided blog worked for you!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 8%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPV%3C/text%3E%3C/svg%3E)
Philipp von dem Bussche 0 Reputation points2025-05-06T12:47:05.5633333+00:00 So I could find a working configuration running my runbook on Azure without hybrid workers. The following blob article was quite helpful: https://blog.icewolf.ch/archive/2024/12/31/azure-automation-runtime-environments-preview/ It describes how to use the new environment experience in the Azure portal in which it allows you to create a Powershell 7.4 runtime. You can then hookup your Powershell runbook to that 7.4 runtime and set the TLS version to be used in your script to TLS 1.3 like this:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls13Btw. you can change the runtime to be used for your runbook in at least two places. But I was not succesful trying so through editing my runbook in the portal but if you try it like described here it will actually change the runtime type: https://learn.microsoft.com/en-us/azure/automation/manage-runtime-environment?tabs=create-runtime-portal%2Clist-runtime-portal%2Cdelete-runtime-portal%2Cupdate-runtime-portal%2Ccreate-runbook-portal%2Cupdate-runbook-portal%2Ctest-update-portal%2Ccreate-cloud-job-portal#update-runbook
Hope this helps.
Sign in to comment
Sign in to answer