Automation runbook fails with 'this.Client.SubscriptionId' cannot be null. ('this.Client.SubscriptionId' cannot be null.)

Hello Denis Abramov

Greetings! Thanks for raising this question in Q&A forum.

Given that this started suddenly at 8am UTC today and affects all your Automation accounts in West US region with no code changes on your end, the first and most important thing to do is check for a regional platform issue — because this pattern is a classic sign of a service-side disruption rather than a configuration problem. Let me walk you through this step by step.

Step 1: Check Azure Service Health immediately

1. Go to the Azure Portal and search for "Service Health"
2. Filter by your subscription, region (West US), and service (Azure Automation)
3. Also check the public Azure status page at azure.status.microsoft for any active incidents in West US affecting Automation or Managed Identity services
4. If there is an active incident, this confirms the root cause and you simply need to wait for Microsoft to resolve it

Step 2: Understand why this error appears The 'this.Client.SubscriptionId' cannot be null error on Get-AzAutomationJob means the Az PowerShell context inside the runbook does not have a subscription ID populated after authentication. This can happen when the Managed Identity used in the runbook hasn't been granted any permissions to access the subscription — when Connect-AzAccount -Identity runs but cannot successfully obtain a token or subscription context, all subsequent Az cmdlets fail with this null subscription error.

Since this is hitting all your Automation accounts simultaneously starting at a specific time with no changes made, it is almost certainly a transient Managed Identity token endpoint or Automation service issue in West US rather than a permissions problem.

Step 3: Verify the Managed Identity token endpoint is responding Add a quick diagnostic step to one of your runbooks to test the authentication context:

$AzureContext = (Connect-AzAccount -Identity).context
Write-Output "Subscription: $($AzureContext.Subscription)"
Write-Output "Tenant: $($AzureContext.Tenant)"

If the output shows the SubscriptionId populated after Connect-AzAccount -Identity, then the managed identity is working and the problem lies elsewhere in the runbook. If SubscriptionId is empty or null, the Managed Identity token endpoint itself is not returning subscription context.

Step 4: Explicitly set the subscription context as a workaround While the regional issue resolves, you can add an explicit Set-AzContext call right after authentication in your runbook as a temporary workaround:

$AzureContext = (Connect-AzAccount -Identity).context
$AzureContext = Set-AzContext -SubscriptionId "<your-subscription-id>" -DefaultProfile $AzureContext

Then pass -DefaultProfile $AzureContext to all subsequent Az cmdlets including Get-AzAutomationJob. This bypasses the implicit subscription resolution that is currently failing.

Step 5: Verify Managed Identity role assignments have not changed While unlikely to affect all accounts at once, it is worth a quick sanity check. Go to Azure Portal > Subscriptions > Access Control (IAM) and confirm the System Managed Identity of each Automation account still has its role assignments (typically Contributor or a custom role). By default, a new System or User Managed Identity does not have rights to the subscription — no subscription value returns when Connect-AzAccount -Identity runs, and no subscription ID will be populated in the context. If role assignments were accidentally removed, this would explain the sudden failure across all accounts.

Step 6: Open a support ticket right away Since this is production-impacting and affects all accounts in a region simultaneously, raise a Technical support ticket immediately:

1. Go to Azure Portal > Help + Support > New Support Request
2. Service: Azure Automation
3. Describe the issue: all Automation accounts in West US failing with this.Client.SubscriptionId cannot be null starting at 08:00 UTC today
4. Include your subscription ID, the Automation account names, and the exact error with line numbers
5. Ask the support team to check for any active West US Automation or Managed Identity service degradation against your subscription

The simultaneous failure across all accounts starting at a specific time is the key evidence that this is platform-side — please include that detail prominently in your ticket.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.

Hello Denis Abramov,

Thank you for reaching out to the Microsoft Q&A forum.  

The error indicates the subscription context is not being initialized (SubscriptionId cannot be null), which impacts all runbooks consistently. Given the cross-account and regional nature, this appears to be a platform-side issue rather than a runbook or configuration problem. We are validating on this issue.

I ended up here as Azure portal doesn't allow support ticket creation unless sev A is selected.

Regarding the issue - Yes, I'm almost certain that it's platform side issue. It might be as well gradual rollout - first it starts in single region and later expands to others - I saw this pattern many times.

Also, issue is not 100% - it happens randomly, so it's not related to lost permissions.