Runner prerequisites and Azure requirements

A CloudRadial AutomationAI runner is an execution agent you deploy into your own Azure subscription. Before you install one, you need the right Azure access, the right tooling on the machine, and the registration values the installer asks for. This article is written so you can go from a fresh machine to fully ready even if you have never used PowerShell or Azure before. It is intended for the technician performing the install.

We'll follow five main steps:

1. Confirming your Azure subscription and role
2. Installing PowerShell 7
3. Installing the Az PowerShell module
4. Signing in with Connect-AzAccount
5. Gathering your registration values

Step 1: Confirming Your Azure Subscription and Role

Why are we doing this? The runner deploys into an Azure subscription you own, and the installer both creates resources and grants the runner's managed identity its least-privilege roles. The account you run it as needs permission to create resources and role assignments.

Use one of the following on the subscription:

• Owner, or
• Contributor plus User Access Administrator

The installer also registers any resource providers the deployment needs (for example Microsoft.App, Microsoft.Web, and Microsoft.Network), which requires a subscription-scoped role.

Important -> A resource-group-scoped role is not enough. If your account cannot register a provider, the installer stops early and prints the exact one-time command for a subscription admin to run.

Not sure what role you have? In the Azure portal, go to Subscriptions, select your subscription, open Access control (IAM), and choose View my access. Your assigned roles are listed there.

Step 2: Installing PowerShell 7

Why are we doing this? The installer and the Az module both require PowerShell 7 or later. Windows ships with an older Windows PowerShell (version 5.1), so unless someone installed PowerShell 7 separately, you probably do not have it yet.

First, check what you have. Open a terminal and run:

$PSVersionTable.PSVersion

If the Major number is 7 or higher, you already have PowerShell 7. Skip to Step 3. If it shows 5.1, or the command is not recognized, install it using one of the options below.

Option A, winget (recommended on Windows 10 and 11):

winget install --id Microsoft.PowerShell --source winget

Option B, MSI installer (best for servers, or when winget is not available): download the latest x64 MSI from the PowerShell releases page, double-click it, and follow the prompts.

After it installs, close and reopen your terminal, then launch PowerShell 7 by running:

pwsh

Confirm the version:

$PSVersionTable.PSVersion

Important -> PowerShell 7 installs alongside Windows PowerShell 5.1 rather than replacing it. Run every remaining step, including the Az module install and the runner install, from the PowerShell 7 window you launched with pwsh.

Step 3: Installing the Az PowerShell Module

Why are we doing this? The installer is a PowerShell script that drives Az PowerShell cmdlets, so the module has to be present before you run it.

In your PowerShell 7 window, first check whether the module is already there:

Get-Module Az -ListAvailable

If nothing is returned, install it once for your user:

Install-Module Az -Scope CurrentUser

This pulls in the submodules the install and upgrade scripts use, including Az.Accounts, Az.Resources, Az.Websites, Az.KeyVault, and Az.Functions.

Note: If you are prompted to trust the PSGallery repository, answer Yes. The install can take a few minutes because the Az module is large.

Step 4: Signing In With Connect-AzAccount

Why are we doing this? Az PowerShell keeps its own sign-in state, separate from the Azure CLI, so the installer can only see the session Az PowerShell itself is signed into.

Running az login does not authenticate Az PowerShell. Sign in with:

Connect-AzAccount

If your subscription lives in a specific Entra tenant, sign in to that tenant:

Connect-AzAccount -TenantId <tenant-guid>

A browser window opens for you to sign in. After you complete sign-in and any MFA prompt, return to the terminal.

The installer validates this on startup and prints exact remediation if you are not connected.

Note: You do not have to choose a subscription in advance. The -SubscriptionId parameter is optional, and when you omit it the installer lists the subscriptions your login can access and lets you pick one. Pass it explicitly for unattended runs; a non-interactive session with no -SubscriptionId stops rather than guessing.

Note: If the command is not recognized, you are almost certainly in a Windows PowerShell 5.1 window. Close it, launch PowerShell 7 with pwsh, and try again.

Step 5: Gathering Your Registration Values

Why are we doing this? A runner is registered in AutomationAI before you install it in Azure, and registration mints the two values the installer needs to tie the install back to the right runner.

Registration produces:

• A runner identity (RUNNER_IDENTITY_ID), which the control plane uses to recognize the runner
• A runner secret (RUNNER_SECRET), a one-time secret the runner uses to sign its check-ins

REQUIRED: The runner secret is shown only once, at registration. Copy it into your password manager before you leave the registration dialog. The installer prompts you to paste the secret when you run it, so it is never written to disk.

The setup package you download embeds the runner identity for you. For how a runner is registered in the app, see Registering and managing runners.

Once all five are confirmed, the machine is ready and you can register the runner and run the installer. Next: Installing a runner in your Azure subscription.

If you are still having trouble, we're here to help! Submit a ticket here for assistance, and don't forget to check our status page to ensure there are no outages in your area.