Azure VM Remote Script Execution Tools Compared

In Azure we have a few different places where we can run our scripts and even more ways to let our scripts access VMs remotely. One of the original methods was to use Hybrid Worker, but that is retiring at the end of this month (August 2024). This time I would like to compare those options.

Methods - Remote Script Execution Tools for Azure VMs

Here are some of the commonly used methods that are easy to setup and use, and do not rely on any third party tools.

PowerShell Remoting (WinRM)

Allows you to remotely run PowerShell commands on Windows VMs using WinRM (Windows Remote Management). It works like a remote PowerShell session — ideal for admins or automation scripts.

Requirements:

• WinRM enabled and configured (HTTPS recommended)
• NSG allows inbound TCP 5986
• Valid credentials

Example:

1
2
3

Invoke-Command -ComputerName "vm.domain.com" -Credential $cred -ScriptBlock {
    Get-Service
}

Extension-based Hybrid Runbook Worker

A VM extension that turns your VM into a local executor of Azure Automation Runbooks. Your runbooks in Azure run inside the VM, securely and on schedule.

Requirements:

• Azure Automation Account
• VM must have system-assigned managed identity
• Install the Hybrid Worker extension

Custom Script VM Extension

Used to run scripts (PowerShell/Bash) on a VM during or after provisioning. The script is pulled from a public or SAS-protected URL and executed once.

Requirements:

• Script hosted on Blob Storage or URL
• Can be applied via ARM, PowerShell, CLI, or portal

Example:

1
2
3

Set-AzVMExtension -ResourceGroupName "rg" -VMName "myVM" `
  -Publisher "Microsoft.Compute" -ExtensionType "CustomScriptExtension" `
  -SettingString "{'fileUris': ['https://myblob/setup.ps1'], 'commandToExecute': 'powershell -File setup.ps1'}"

Invoke-AzVMRunCommand

A direct method to run inline PowerShell (Windows) or Bash (Linux) commands inside a VM via the Azure control plane — no open ports needed. Lightweight and quick.

Requirements:

• Azure VM with the Azure VM Agent installed (default for most)
• IAM permissions on the VM for Automation or identity

Example:

1
2

Invoke-AzVMRunCommand -ResourceGroupName "rg" -VMName "myVM" `
  -CommandId "RunPowerShellScript" -ScriptString @("Get-Process")

Agent-based Hybrid Runbook Worker (Retired)

This older model required the Log Analytics agent and worked similarly to the new Hybrid Worker, but with more manual setup and tighter dependencies. Agent-based Hybrid Runbook Worker is going to be retired at the end of this Month (August 31st, 2024), and therefore I will reffer to it as retired. If you are currently using it, you should migrate to the extension-based Azure Hybrid Worker version.

Comparison - Remote Script Execution Tools for Azure VMs

Purpose & Use Case

Where the Logic Lives

Frequency & Reusability

Security & Identity

Logging & Output

Setup & Management

Summary of Azure VM Script Execution Options

Final thoughts

I’ve been using the Agent based Azure Hybrid Worker for years. But as this technology sunsets, the Azure ecosystem offers multiple modern alternatives for script execution, each with its own strengths and ideal use cases. There’s no one-size-fits-all solution, but it is great that we have a plenty of options.

Thanks for reading and keep clouding around.

Vukasin Terzic