Runner prerequisites and Azure requirements

A CloudRadial AutomationAI runner is an execution agent you deploy into your own Azure subscription. Before you install one, confirm the Azure access, tooling, and registration values described here. This article is for the technician performing the install.

• Azure Subscription and Role
• The Az PowerShell Module
• Signing In With Connect-AzAccount
• Your Registration Values

Azure Subscription and Role

The runner deploys into an Azure subscription you own. The installer creates resources and grants the runner's managed identity its least-privilege roles, so the account you run it as needs permission to create both resources and role assignments. Use one of:

• Owner on the subscription
• Contributor plus User Access Administrator on the subscription

The installer also registers any resource providers the deployment needs (for example Microsoft.App, Microsoft.Web, and Microsoft.Network), which requires a subscription-scoped role. A resource-group-scoped role is not enough. If your account cannot register a provider, the installer stops early and prints the exact one-time command for a subscription admin to run.

The Az PowerShell Module

The installer is a PowerShell script that drives Az PowerShell cmdlets, so install the Az module once for your user:

Install-Module Az -Scope CurrentUser

This pulls in the submodules the install and upgrade scripts use, including Az.Accounts, Az.Resources, Az.Websites, Az.KeyVault, and Az.Functions. PowerShell 7 or later is required.

Signing In With Connect-AzAccount

Az PowerShell keeps its own sign-in state, separate from the Azure CLI. Running az login does not authenticate Az PowerShell. Sign in with:

Connect-AzAccount

If your subscription lives in a specific Entra tenant, sign in to that tenant:

Connect-AzAccount -TenantId <tenant-guid>

The installer validates this on startup and prints exact remediation if you are not connected. You do not have to choose a subscription in advance: the -SubscriptionId parameter is optional, and when you omit it the installer lists the subscriptions your login can access and lets you pick one. Pass it explicitly for unattended runs; a non-interactive session with no -SubscriptionId stops rather than guessing.

Your Registration Values

A runner is registered in AutomationAI before you install it in Azure. Registration mints two values you need for the install:

• A runner identity (RUNNER_IDENTITY_ID) — the runner's identity, which the control plane uses to recognize it
• A runner secret (RUNNER_SECRET) — a one-time secret the runner uses to sign its check-ins

The runner secret is shown only once, at registration. Copy it into your password manager before you leave the registration dialog. The installer prompts you to paste the secret when you run it, so it is never written to disk. The setup package you download embeds the runner identity for you. For how a runner is registered in the app, see the article on registering and managing runners.