Skip to content

Self-deallocation of an Azure Windows VM on shutdown.🔗︎

I've used this Gist and adapted it for Windows.

One's first thought on getting this to work on Windows might be to use Task Scheduler, but there is no "Begin the task" on shutdown option. One can use on event, and interrogate the event logs, but this seems to be hit and miss. Probably because the order in which services shutdown. In this solution, I use local group policy to configure a shutdown script. I'm using Windows 11, Enterprise (24H2), but be aware that not all editions of Windows have local group policy, although the same should be achievable via the registry.

There are other ways to achieve the same goal. Policy, Automation Accounts, etc, but this solution lives on the VM to be deallocated. What happens when there is an update, remains to be seen...

Steps🔗︎

  1. Follow Gist to set up System Assigned Identity.
  2. Install AzCli (winget install Microsoft.AzureCLI).
  3. Launch Local Group Policy editor (Start > Run > gpedit.msc).
  4. Navigate to Computer Configuration -> Policies -> Windows Settings -> Scripts (Startup / Shutdown).
  5. Double-click Shutdown.
  6. Click Show Files... button
    The Shutdown directory will open with the path: C:\Windows\System32\GroupPolicy\Machine\Scripts\Shutdown
  7. Create a new text file named: self-deallocate.ps1.
  8. Open the file in a text editor and paste in the code provided below.
  9. Replace <virtual_machine_name> and <resource_group> with your values.
  10. Save and close the script.
  11. Ensure you're on the Scripts tab (not PowerShell Scripts).
  12. Click the Add... button.

  13. Provide the following:

    Property Value
    Script Name "%ProgramFiles%\PowerShell\7\pwsh.exe"
    Script Parameters -Noninteractive -ExecutionPolicy Bypass -Noprofile -File self-deallocate.ps1

Note

Here, I am using PowerShell Core. When %ProgramFiles% expands, it contains a space, so it most be wrapped in single of double speech marks.
You can alternatively use Windows PowerShell with:
%windir%\System32\WindowsPowerShell\v1.0\powershell.exe
Which doesn't need quotes as the expanded form doesn't contain a space.

self-deallocate.ps1
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
# Create the directory.
Start-Transcript -Path C:\Temp\Self-Deallocate\Self-Deallocate.log -Append -IncludeInvocationHeader -Force
$VerbosePreference  = 'Continue'

az account set -s <subscription_id> #if your MSI can access more than one subscription.


Write-Verbose "Logging in with Azure CLI..."
az login --identity

Write-Verbose "Deallocating VM..."
az vm deallocate -n <virtual_machine_name> -g <resource_group_name>

Stop-Transcript

References:🔗︎