Document Details

Automation Secure Asset Encryption
Home / Scan #2 / Automation Secure Asset Encryption
Sad Tux - Windows bias detected
This page contains Windows bias

About This Page

This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
GitHub View on GitHub 📚 View on Microsoft Learn

Bias Analysis

Detected Bias Types
powershell_heavy
windows_first
missing_linux_example
windows_tools
Summary
The documentation page demonstrates a strong Windows and PowerShell bias. All command-line examples are provided exclusively using Azure PowerShell cmdlets, with no equivalent examples for Azure CLI, Bash, or other cross-platform tools. The PowerShell sections are always presented first and in detail, while Linux-native or cross-platform approaches are either omitted or only briefly mentioned (e.g., Azure CLI is only referenced in passing for revocation). The documentation assumes the user is familiar with PowerShell and Windows tooling, and there is no guidance for users working on Linux or macOS environments.
Recommendations
  • Provide Azure CLI examples for all PowerShell command sequences, including creating and assigning managed identities, configuring Key Vault access policies, and updating Automation account encryption settings.
  • Include Bash shell script examples where appropriate, especially for REST API calls using curl.
  • Explicitly mention cross-platform compatibility and note any differences in behavior or prerequisites between Windows and Linux/macOS environments.
  • Reorganize sections to present PowerShell and CLI examples side-by-side, or clearly label them as 'Windows/PowerShell' and 'Linux/macOS/CLI' to improve discoverability for non-Windows users.
  • Expand the 'Revocation of access' section to include full Azure CLI command examples, not just a reference link.
  • Add a note early in the document clarifying that all operations can be performed from any OS using Azure CLI or REST, not just PowerShell.
GitHub Create Pull Request

Scan History

Date Scan Status Result
2026-02-19 00:00 #398 in_progress Biased Biased
2026-02-18 00:00 #394 in_progress Biased Biased
2026-02-17 00:00 #390 in_progress Biased Biased
2026-02-16 00:00 #386 in_progress Biased Biased
2026-02-15 00:00 #382 in_progress Biased Biased
2026-02-14 00:00 #378 in_progress Biased Biased
2026-01-14 00:00 #250 in_progress Biased Biased
2026-01-13 00:00 #246 completed Biased Biased
2026-01-12 00:00 #243 cancelled Biased Biased
2026-01-11 00:00 #240 completed Biased Biased
2026-01-10 00:00 #237 completed Biased Biased
2026-01-09 00:34 #234 completed Biased Biased
2026-01-08 00:53 #231 completed Clean Clean
2026-01-06 18:15 #225 cancelled Clean Clean
2025-08-17 00:01 #83 cancelled Clean Clean
2025-07-13 21:37 #48 completed Biased Biased
2025-07-09 13:09 #3 cancelled Clean Clean
2025-07-08 04:23 #2 cancelled Biased Biased

Flagged Code Snippets

$principalID = (Get-AzAutomationAccount `
    -ResourceGroupName $resourceGroup `
    -Name $automationAccount).Identity.PrincipalId

$principalID

# Revise variables with your actual values.
$resourceGroup = "ResourceGroupName"
$automationAccount = "AutomationAccountName"
$vaultName = "KeyVaultName"
$keyName = "KeyName"

Set-AzAutomationAccount `
    -ResourceGroupName $resourceGroup `
    -Name $automationAccount `
    -AssignSystemIdentity

Set-AzKeyVaultAccessPolicy `
    -VaultName $vaultName `
    -ObjectId $principalID `
    -PermissionsToKeys Get, Recover, UnwrapKey, WrapKey

Add-AzKeyVaultKey `
    -VaultName $vaultName `
    -Name $keyName `
    -Destination 'Software'

$vaultURI = (Get-AzKeyVault -VaultName $vaultName).VaultUri
$keyVersion = (Get-AzKeyVaultKey -VaultName $vaultName -KeyName $keyName).Version

Set-AzAutomationAccount `
    -ResourceGroupName $resourceGroup `
    -Name $automationAccount `
    -AssignSystemIdentity `
    -KeyName $keyName `
    -KeyVaultUri $vaultURI `
    -KeyVersion $keyVersion `
    -KeyVaultEncryption 

(Get-AzAutomationAccount `
    -ResourceGroupName $resourceGroup `
    -Name $automationAccount).Encryption `
    |  ConvertTo-Json