The Custom Script Settings dialog provides the following options.

Script

Select an existing script from the list, or click Add New Script to create a new script.

Log Debug Information

When enabled, additional diagnostic information is written to the task run logs.

Enable this option when troubleshooting script execution or when requested by Technical Support. Additional logging may increase task log size.

Execution Timeout (sec)

Specifies the maximum amount of time the script is allowed to run before execution is terminated. Increase this value for scripts that perform long-running operations.

Runner Mode

Runner mode determines how the script is executed.

  • Secure: Secure mode is the default execution mode. Scripts are restricted to the Automate MFT custom cmdlets and the supported subset of PowerShell cmdlets documented in this guide. This mode is recommended for most workflows.
  • Unrestricted: Unrestricted mode allows execution of standard PowerShell functionality using the permissions of the self-hosted agent service account. This mode can be used when a workflow requires functionality that is not available in Secure mode, such as:
    • Loading PowerShell modules.
    • Calling external executables.
    • Accessing local and network resources outside the Automate MFT scripting environment subject to service account permissions and firewall settings.
    • Performing advanced PowerShell operations not available in Secure mode.
    To enable unrestricted scripting:
    1. Navigate to System > Tenant Settings > Allow Unrestricted Scripting.
    2. Enable the setting.
    3. Click Save.

    Important

    • Unrestricted scripting is disabled by default.
    • A tenant administrator must enable unrestricted scripting before this option becomes available.
    • Each script must be explicitly configured to use Unrestricted mode.
    • Unrestricted scripts can run only on self-hosted agents.
    • Progress-hosted agents do not support unrestricted script execution.
    Warning: Unrestricted scripts execute with the permissions of the account running the self-hosted agent service. As a result, scripts may have access to local files, network locations, external applications, and other system resources depending on the permissions granted to the service account and any applicable network or firewall restrictions.

    Review all scripts carefully before enabling unrestricted execution.

    External dependencies: When a script uses Unrestricted runner mode, Automate MFT does not automatically distribute external dependencies. Ensure that all required resources are available on every self-hosted agent that may execute the task, including:
    • PowerShell modules
    • Third-party executables
    • Custom directories
    • Additional runtime resources

    If a task uses an agent pool, all agents in the pool should be configured consistently.

    Disable unrestricted scripting: If a task contains one or more scripts configured to use Unrestricted runner mode and Allow Unrestricted Scripting is later disabled at the tenant level:

    • Existing script configurations are retained.
    • Tasks containing unrestricted scripts cannot start.
    • Task validation fails before the task is sent to an agent.
    • The script is not executed.

    This behavior allows administrators to immediately prevent execution of unrestricted scripts throughout the tenant when required for security or operational reasons.

Filter only specific files

This option allows users to limit script execution to files that match defined filter criteria. File filters are applied first to narrow down the list of candidate files. After filtering, the match type is applied using AND logic. This means that a file must match the filter and satisfy the defined conditions to be selected for download. For more detailed information, see file wildcards and globs.
  • File Filters: Users can list custom filters, such as file name, extension, and size, to limit the files that are downloaded.
  • Match Type: Users can define rules for filtering files based on specific attributes. These rules are evaluated using logical conditions, and at least one condition must be added for the filter to be active.
    • Match All: Uses AND logic. All conditions must be true for the file to be selected.
    • Match Any: Uses OR logic. A file is selected if any one of the conditions is true.