Ansible microsoft.scom Module Example: Alert Routing to EDA

At Red Hat Tech Day Netherlands 2026 (Bunnik, 3 June 2026), Red Hat announced microsoft.scom as one of 12 new content collections landing for AAP 2.7. It covers System Center Operations Manager infrastructure automation plus alert routing into Event-Driven Ansible (EDA), so a SCOM alert can trigger a remediation rulebook instead of just paging a human.

Example playbook

---
- name: Route critical SCOM alerts to Event-Driven Ansible
  hosts: scom_management_servers
  gather_facts: false

  vars:
    scom_subscription_name: "eda-critical-alerts"
    eda_webhook_url: "https://eda-controller.example.com:5000/endpoint/scom-alerts"
    eda_webhook_token: "{{ lookup('ansible.builtin.env', 'EDA_WEBHOOK_TOKEN') }}"

  tasks:
    - name: Ensure SCOM alert subscription exists for critical severity
      microsoft.scom.alert_subscription:
        name: "{{ scom_subscription_name }}"
        severity:
          - critical
        resolution_state: new
        state: present

    - name: Configure SCOM connector to forward alerts to EDA webhook
      microsoft.scom.notification_channel:
        name: "eda-webhook-channel"
        channel_type: webhook
        endpoint_url: "{{ eda_webhook_url }}"
        auth_token: "{{ eda_webhook_token }}"
        subscription: "{{ scom_subscription_name }}"
        state: present

    - name: Verify SCOM management group health before enabling routing
      microsoft.scom.management_group_info:
      register: scom_health

    - name: Fail early if any management server is unreachable
      ansible.builtin.fail:
        msg: "SCOM management group has unreachable servers, check before enabling EDA routing"
      when: scom_health.unreachable_servers | default([]) | length > 0

    - name: Enable the alert-to-EDA routing rule
      microsoft.scom.routing_rule:
        name: "critical-to-eda"
        subscription: "{{ scom_subscription_name }}"
        channel: "eda-webhook-channel"
        enabled: true
        state: present

What it does

The playbook targets SCOM management servers and builds the full alert path in four steps: create a subscription that filters for critical, unresolved alerts; configure a webhook notification channel pointed at an EDA controller endpoint; check management group health so you don't wire up routing against a degraded SCOM deployment; and finally enable the routing rule that ties the subscription to the channel.

On the EDA side, a corresponding rulebook listens on that webhook source and matches on alert fields (severity, monitoring object, alert name) to fire remediation actions — restart a service, run a validated role from infra.windows_ops, or open an incident in splunk.itsi for closed-loop tracking. The pattern mirrors what Red Hat showed for hashicorp.vault and splunk.itsi EDA integrations in the same announcement: SCOM stays the source of truth for monitoring, EDA becomes the decision engine.

Notes

microsoft.scom was announced at Red Hat Tech Day Netherlands 2026 alongside microsoft.mecm as the two new Microsoft-focused collections for AAP 2.7; treat exact module names and parameters as illustrative until the collection docs ship.
Run playbooks against SCOM from a Windows management server or a host with the SCOM PowerShell/SDK connectivity the collection depends on — plain WinRM to an arbitrary Windows box is not sufficient.
Store eda_webhook_token in AAP credentials or Vault (see the hashicorp.vault collection's EDA integration) rather than a plain environment variable in production.
Gate the routing rule behind a health check, as shown above, so a partially down management group doesn't get treated as a working alert pipeline.
Keep the EDA rulebook's condition matching narrow at first (critical + specific alert names) and widen it once you trust the automated responses.

Takeaway

microsoft.scom turns SCOM from a passive alert board into an active trigger for Ansible automation, closing the loop between detection and remediation without custom glue code.