ちょっと深掘り「Enable-AzVMPSRemoting」

    <#
        .DESCRIPTION
        Enables the Azure PSRemoting

        .PARAMETER Name
        Specifies the computername

        .PARAMETER ResourceGroupName
        Provide the name of the resource group

        .PARAMETER Protocol
        Provide the type of Protocol for nsg rule setup - http/https/ssh

        .PARAMETER OsType
        Option of windows/linux

        .EXAMPLE
        Enable-AzVMPSRemoting -Name vmName -ResourceGroup resourceGroup

        .EXAMPLE
        Enable-AzVMPSRemoting -Name vmName -ResourceGroup resourceGroup -OsType linux
    #>

    param
    (
        [Parameter(Mandatory, ValueFromPipelineByPropertyName)]
        [string]$Name,

        [Parameter(Mandatory, ValueFromPipelineByPropertyName)]
        [string]$ResourceGroupName,
                
        [ValidateSet('http','https','ssh')]
        [string]$Protocol,

        [ValidateSet('windows','linux')]
        [OSType]$OsType
    )

    # Since this is a standalone cmdlet and OsType is optional, it may not be supplied
    # So we make a REST call to retrieve the target OsType
    if (-not $OsType)
    {
        $OsType = Get-OsType -Name $Name -ResourceGroupName $ResourceGroupName
    }

    # Obtain all Network Security Groups associated with the VM (Interface level Nsg, Subnet Level Nsg)
    $azVMNsgs = Get-AzVmNsg -Name $Name -ResourceGroupName $ResourceGroupName

    $parameters = @{NetworkSecurityGroup = $null
                        Protocol = 'Tcp'
                        Direction = 'Inbound'
                        Access = 'Allow'
                        SourcePortRange = '*'
                        SourceAddressPrefix = '*'
                        DestinationAddressPrefix = '*'
                        Priority = (Get-Random -Minimum 100 -Maximum 4096)
        }

    $azureVM = Az.Compute\Get-AzVM -Name $Name -ResourceGroupName $ResourceGroupName

    if ([OStype]::Windows -eq $OsType)
    {
        if (-not $Protocol)
        {
            # Only WinRM_HTTPS protocol is supported for Windows Target
            $Protocol = 'https'
        }

        foreach ($azVMNsg in $azVMNsgs)
        {
            # Get PSRemoting status for a given Nsg
            $psremoting = Get-AzVMPSRemoting -Name $Name -ResourceGroupName $ResourceGroupName -Nsg $azVMNsg
            $parameters['NetworkSecurityGroup'] = $azVMNsg

            # If Https is not enabled, enable it
            if($Protocol -eq 'https')
            {
                if (-not $psremoting.Https)
                {                    
                    $null = Az.Network\Add-AzNetworkSecurityRuleConfig -Name 'allow-winrm-https' -DestinationPortRange 5986 @parameters | Az.Network\Set-AzNetworkSecurityGroup
                }
                
                # Setup WinRM HTTPS based remoting using Self-Signed Certificate
                $runCommandParameters =
                @{
                    commandId = 'RunPowerShellScript'
                    script =
                    @(
                        'Set-Item WSMan:\localhost\Service\Auth\Basic $true -Force;$selfSignedCert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName $env:COMPUTERNAME;Enable-PSRemoting -SkipNetworkProfileCheck -Force;Remove-Item -Path WSMan:\Localhost\listener\Listener* -Recurse -Force;New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $selfSignedCert.Thumbprint -Force;New-NetFirewallRule -DisplayName WindowsRemoteManagement_HTTPS_In -Name WindowsRemoteManagement_HTTPS_In -Profile Any -LocalPort 5986 -Protocol TCP -RemoteAddress Any;'
                    )
                }

                $null = Az.Resources\Invoke-AzResourceAction -ResourceId $azureVM.Id -Action runCommand -Parameters $runCommandParameters -ApiVersion 2017-03-30 -Force
            }

            # Future code path, if we support both http/https protocols for Windows target
            # If Http is not enabled, enable it
            if($Protocol -eq 'http')
            {
                if (-not $psremoting.Http)
                {
                    $null = Az.Network\Add-AzNetworkSecurityRuleConfig -Name 'allow-winrm-http' -DestinationPortRange 5985 @parameters | Az.Network\Set-AzNetworkSecurityGroup
                }

                ###################################################################
                # Enable PowerShell remoting on a target Windows computer
                ###################################################################

                # Enable-PSRemoting -Force
                # Enable-PSRemoting configures the computer to receive Windows PowerShell remote commands that are sent by using WSMan protocol
                # Enable-PSRemoting performs the following operations:
                # 1) Runs the Set-WSManQuickConfig cmdlet, to:
                #      Start the WinRM service.
                #      Set the startup type on the WinRM service to Automatic.
                #      Create a listener to accept requests on any IP address.
                #      Enable a firewall exception for WS-Management communications.
                #      Register the Microsoft.PowerShell and Microsoft.PowerShell.Workflow session configurations, if it they are not already registered.
                #      Register the Microsoft.PowerShell32 session configuration on 64-bit computers, if it is not already registered.
                #      Enable all session configurations.
                #      Change the security descriptor of all session configurations to allow remote access.
                # 2) Restart the WinRM service to make the preceding changes effective.

                # Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name  'LocalAccountTokenFilterPolicy' -Value 1 -Type DWord -Force
                # When using local computer account for remoting, UAC (User Account Control) does not allow access to WinRM service.
                # Setting LocalAccountTokenFilterPolicy to 1 ensures UAC filtering for local accounts is disabled and access to WinRM service is granted.
                # Side Note: When using domain account for remoting, this account needs to be a member of the remote computer Administrators group.

                $runCommandParameters =
                @{
                    commandId = 'RunPowerShellScript'
                    script =
                    @(
                        'Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name LocalAccountTokenFilterPolicy -Value 1 -Type DWord -Force;Enable-PSRemoting -Force;Set-NetFirewallRule -Name WINRM-HTTP-In-TCP-PUBLIC -RemoteAddress Any;'
                    )
                }

                $null = Az.Resources\Invoke-AzResourceAction -ResourceId $azureVM.Id -Action runCommand -Parameters $runCommandParameters -ApiVersion 2017-03-30 -Force
            }
        }
    }
    elseif ([OStype]::Linux -eq $OsType)
    {
        if (-not $Protocol)
        {
            # Only SSH protocol is supported for Linux Target
            $Protocol = 'ssh'
        }

        foreach ($azVMNsg in $azVMNsgs)
        {
            # Get PSRemoting status for a given Nsg
            $psremoting = Get-AzVMPSRemoting -Name $Name -ResourceGroupName $ResourceGroupName -Nsg $azVMNsg
            $parameters['NetworkSecurityGroup'] = $azVMNsg

            # If SSH is not enabled, enable it
            if($Protocol -eq 'ssh')
            {
                if (-not $psremoting.ssh)
                {
                    $null = Az.Network\Add-AzNetworkSecurityRuleConfig -Name 'allow-ssh' -DestinationPortRange 22 @parameters | Az.Network\Set-AzNetworkSecurityGroup
                }

                # ThisRunCommand step does following:
                # 1) Install powershellcore in linux, if not already present
                # 2) backup current sshd_config, configure sshd_config to enable PasswordAuthentication, register powershell subsystem with ssh daemon
                # (#2 is required to support interactive username/password authentication over powershell-ssh)
                # 3) Restart the ssh daemon service to pick up the new config changes            
                $runCommandParameters =
                @{
                    commandId = 'RunShellScript'
                    script =
                    @(
                        'sudo wget -q https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb;sudo dpkg -i packages-microsoft-prod.deb;sudo apt-get update;sudo apt-get install -y powershell;sshdconfigfile=/etc/ssh/sshd_config;sudo sed -re "s/^(\#)(PasswordAuthentication)([[:space:]]+)(.*)/\2\3\4/" -i.`date -I` "$sshdconfigfile";sudo sed -re "s/^(PasswordAuthentication)([[:space:]]+)no/\1\2yes/" -i.`date -I` "$sshdconfigfile";subsystem="Subsystem powershell /usr/bin/pwsh -sshs -NoLogo -NoProfile";sudo grep -qF -- "$subsystem" "$sshdconfigfile" || sudo echo "$subsystem" | sudo tee --append "$sshdconfigfile";sudo service sshd restart'
                    )
                }

                $null = Az.Resources\Invoke-AzResourceAction -ResourceId $azureVM.Id -Action runCommand -Parameters $runCommandParameters -ApiVersion 2017-03-30 -Force
            }
        }     
    }