Secure Access Service Edge:Run scripts

Key concepts

Script policy — A scheduling blueprint that defines what to run, which devices to target, and when to run it. A policy is a persistent configuration rule that governs how and when tasks are generated.

Task — A specific execution instance generated by a policy at a scheduled time. A single policy can generate one or more tasks depending on its execution mode (run once, weekly, or at an interval).

How it works

Understanding this execution model helps you predict task behavior and avoid misconfiguration.

Task generation

• When a policy is created and enabled, the first task is immediately generated with a status of Pending Scheduling or Running, depending on whether the execution window has started.

• For policies that run multiple times, each new task is generated after the previous one completes. The new task's status is Pending Scheduling.

Offline device behavior

• Offline devices check the policy scope after coming back online. If the device falls within the scope and the current time is within the execution window, the task runs.

Policy status

Policy status reflects the state of its most recently generated task:

Prerequisites

Before you begin, make sure you have:

• Administrator access to the SASE console

• For macOS devices running file management scripts: Full Disk Access permission granted to SASE

• For macOS devices running the Replace Desktop Wallpaper script: both Automation and Full Disk Access permissions granted to SASE

Quick start: change the desktop wallpaper on a device

This example walks through the end-to-end flow — from preparing the asset to confirming the result on the device.

1. Prepare the wallpaper image. Upload it to a publicly accessible Object Storage Service (OSS) bucket or any HTTP/HTTPS-accessible location. Copy the image URL (for example, https://aliyundoc.com/wallpaper.png).

2. Create the policy.

   1. Go to the Execute Script page and click Create Script Policy.

   2. In the Create Policy Configuration pane, set the following parameters:

      • Policy Name: Test wallpaper replacement

      • Script Template: Replace Desktop Wallpaper

      • Enabled: Enabled

      • Execution Mode: Run Once

      • Wallpaper Download URL: The image URL from step 1

      • Effective Scope: Specific Device, then select the test device

   3. Click OK.

3. Verify the result. After the policy is created, its status shows as Pending Scheduling or Running on the Execute Script page. Switch to the Task Management tab to find the corresponding task. Once the task completes, log in to the test device to confirm the wallpaper has changed.

Create a script policy

1. Go to the Execute Script page and click Create Script Policy.

2. In the Create Policy Configuration pane, configure the following parameters, then click OK.

If a Run Once policy has a status of Paused, it cannot be re-enabled. Create a new policy instead.

Manage script policies

On the Execute Script page, perform the following operations:

• View details — Find the policy and click Details in the Actions column.

• Delete — Find the policy, click Delete in the Actions column, and follow the on-screen prompts.

• Stop a single policy — Find the policy and click Stop in the Actions column.

• Stop policies in batches — Select multiple policies, then click Batch Stop.

• Enable a single policy — Find the policy and click Enable in the Actions column.

• Enable policies in batches — Select multiple policies, then click Batch Enable.

Batch Enable is not available if any selected policy has an Execution Mode of Run Once.

Monitor and manage tasks

On the Task Management page, find a task to perform the following operations:

• View task status — The Status column shows the current state: Pending Scheduling, Running, or Stopped.

• View effective scope — Click the link in the Effective Scope column to see scope details.

• Preview execution results — Hover over the Execution Result column to see a summary of device statuses: All, Running, Execution Successful, and Execution Failed.

• View task details — Click Details in the Actions column to open the task details page.

  • Overview: Shows counts for Total Devices, Completed Devices, Executing Devices, and Failed Devices.

  • Device Details: Lists per-device execution results.

• View or download logs — In the device list on the task details page, find the device and click:

  • View Logs — View the script execution log online.

  • Download — Download the log for offline analysis or auditing.

Template library

Templates define the specific operation a policy runs. Before creating a policy, review the template's function, required permissions, and parameters.

Security and compliance

• Follow the principle of least privilege. In Effective Scope, select only the devices or user groups the policy needs to target. Overly broad scope amplifies the impact of misconfigured or accidental operations.

• Review high-risk operations before running. For Delete File, Remote Logout, Remote Restart, and Remote Shutdown, establish an internal approval process. Confirm the necessity and accuracy of the operation before executing.

Troubleshooting