Start and Stop SAS Viya 2022.10 on Microsoft Azure

[Conor_H]

The latest version of SAS Viya on Microsoft Azure is now available. This version includes all the latest software updates corresponding to the 2022.10 stable release of SAS Viya software plus additional enhancements that are specific to SAS Viya on Microsoft Azure.

To help manage SAS Viya on Azure, a runbook is now available to stop and start the deployment. The runbook is a feature of Azure Automation, and it is automatically created when SAS Viya is deployed. Use the runbook to stop and start the deployment on-demand or to schedule times that meet the needs of your business.

• Because SAS Viya is a pay as you go service, stopping SAS Viya when it is not in use reduces infrastructure and software costs.
• Stopping SAS Viya interrupts service for users. Make sure to notify users if you plan to stop SAS Viya and allow for time for all the infrastructure and services to come back up.
• The Azure Automation stops the AKS cluster, as well as both the jump and nfs virtual machine.

[GopiKondi]

SAS Viya is subscribed on a pay-as-you-go basis on Azure. SAS Viya can be started and stopped on demand as needed. The "...automation/StartStopViya" runbook can only be initiated by the Azure subscription administrator for starting or stopping SAS Viya. I need to grant one of my team members the ability to start and stop SAS Viya using the "...automation/StartStopViya" runbook. How do I grant access to an Azure group or user?

[Conor_H]

To grant access to an Azure group or user to start and stop SAS Viya using the "...automation/StartStopViya" runbook, you can use Azure Role-Based Access Control (Azure RBAC). In Azure Automation, access is granted by assigning the appropriate Azure role to users, groups, and applications at the Automation account scope. You can grant role-based access to users using the Azure portal, Azure Command-Line tools, or Azure Management APIs. For more detailed information, you can refer to the Manage role permissions and security in Azure Automation guide. The following section shows you how to configure Azure RBAC on your Automation account through the Azure portal and PowerShell: Configure Azure RBAC for your Automation account 

[itinteractions]

The required role was assigned to the managed application resource group. However, when assigning the role to the SAS VIYA resource group, a permission error appeared. The error is due to a "System deny assignment created by managed application," which prevents the assigned role or user from performing the automation runbook to start or stop SAS VIYA.

Could you share the steps to follow to allow the SAS VIYA automation tasks, like executing the start and stop runbook?

Failed to add Role assignment
Failed to add User1 as Automation Operator for mrg-sas-viya : The client 'admin@domain.com' with object id 'xxxxxxxxx' has permission to perform action 'Microsoft.Authorization/roleAssignments/write' on scope '/subscriptions/xxxxxxxxxxx/resourceGroups/mrg-sas-viya/providers/Microsoft.Authorization/roleAssignments/xxxxxx'; however, the access is denied because of the deny assignment with name 'System deny assignment created by managed application /subscriptions/xxxxxxxx/resourceGroups/REsourceGroup2/providers/Microsoft.Solutions/applications/sasviya' and Id 'xxxxxxxxx' at scope '/subscriptions/xxxxxxxxx/resourceGroups/mrg-sas-viya'..