Microsoft Azure provides a locked-down environment for websites hosted in IIS (web roles) and application services (worker roles). While this hardening significantly eases administration, it also limits the ability to perform certain tasks such as installing software or writing to the registry. Another problem is that any changes to an instance are lost whenever the instance is reimaged or moved to a different server.

The service definition provides the solution to this problem by allowing the creation of startup tasks, which are script files or executable programs that are invoked each time an instance is started. Startup tasks allow a temporary escape from the restrictions of the locked-down web role and worker role while retaining the benefits of these roles.

A startup task must be robust against errors because a failure could cause the instance to recycle. In particular, the effect of a startup task must be idempotent. As a startup task is invoked each time an instance starts, it must not fail when performed repeatedly. For example, when a startup task is used to install software, any subsequent attempt to reinstall the software must be handled gracefully.

Startup tasks are specified with the Startup element in the ServiceDefinition.csdef service definition file. This is a child element of the WebRole or WorkerRole element. The child elements in the Startup element comprise a sequence of one or more individual Task elements, each specifying a single startup task. The following example shows the definition of a single startup task and includes all the attributes for a Task element:

<Startup>
  <TaskcommandLine="Startup.cmd"executionContext="elevated"taskType="simple" />
</Startup>

The commandLine attribute specifies a script or executable and its location relative to the %RoleRoot%\AppRoot\bin folder for the role. The executionContext element takes one of two values: limited, to indicate the startup task runs with the same privileges as the role, or elevated, to indicate the startup task runs with full administrator privileges. It is the capability provided by elevated startup tasks that gives them their power. There are three types of startup tasks, which are as follows:

Windows PowerShell 2 is installed on Microsoft Azure roles that run guest OS 2.x or higher. This provides a powerful scripting language that is ideal for scripting startup tasks.

A PowerShell script named StartupTask.ps1 is invoked from the startup task command file as follows:

C:\Users\Administrator>PowerShell -ExecutionPolicy Unrestricted .\StartupTask.ps1

The ExecutionPolicy parameter specifies that StartupTask.ps1 can be invoked even though it is unsigned.

In startup tasks, we can use AppCmd to manage IIS. We can also use the WebPICmdLine command-line tool, WebPICmdLine.exe, to access the functionality of the Microsoft Web Platform Installer. This allows us to install Microsoft Web Platform components, which includes, for example, PHP.

<Runtime executionContext="elevated"/>

private void SetIdleTimeout(TimeSpan timeout)
{
  using (ServerManager serverManager = new ServerManager())
  {
    serverManager.ApplicationPoolDefaults.ProcessModel.IdleTimeout = timeout;
    serverManager.CommitChanges();
  }
}

start /wait cmd