How to connect Azure AD from runbook

Question

How do I connect Azure AD from runbook. Normally connect-AzureAD works fine after giving credentials from powershell. But I'm not sure how to do from runbook. I could see the parameters like thumbprint, application ID which I'm not sure how to generate. Is there way to connect without using these parameters. Please advise.

Answer 1

@Subhash B As @Luke Murray mentioned, Azure AD PowerShell is being deprecated, its recommended to use Microsoft Graph. Below is the sample script for your reference on how to connect to Azure AD using Microsoft Graph v1 and v2 written by a community member. Ref : https://gist.github.com/AlexFilipin/daace2f2d7989545e8ab0b969de2aaed

# Assign Graph application permissions to managed identity (outside of Azure Automation)

$spID = "c3bfc803-bc8a-47af-a8a4-eed98dce8bca" #Managed Identity SP

$PermissionName = "User.Read.All"

$GraphServicePrincipal = Get-MgServicePrincipal -Filter "startswith(DisplayName,'Microsoft Graph')" | Select-Object -first 1 #Graph App ID: 00000003-0000-0000-c000-000000000000

$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains "Application"}

New-MgServicePrincipalAppRoleAssignment -AppRoleId $AppRole.Id -ServicePrincipalId $spID -ResourceId $GraphServicePrincipal.Id -PrincipalId $spID

$AppRoleAssignments = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $spID

# Please note you can also give an managed identity permissions via:

# Role assignments, such as User Administrator scoped to an Administrative Unit

# Ownership, such as owner of a group to manage the membership with the MI

# This can be done via UI and in many cases allows you to better follow the concept of least privilege

# Connect to Microsoft Graph within Azure Automation (Microsoft Graph PowerShell v1)

Connect-AzAccount -Identity

$token = Get-AzAccessToken -ResourceUrl "https://graph.microsoft.com"

Connect-MgGraph -AccessToken $token.Token

# Connect to Microsoft Graph within Azure Automation (Microsoft Graph PowerShell v2 - see https://devblogs.microsoft.com/microsoft365dev/microsoft-graph-powershell-v2-is-now-in-public-preview-half-the-size-and-will-speed-up-your-automations/)

# System-assigned managed identity

Connect-MgGraph -Identity

# User-assigned managed identity

Connect-MgGraph -Identity -ClientId "User_Assigned_Managed_identity_Client_Id"

Some references articles to get you started with Microsoft Graph within azure automation.

• https://cloudid.space/ms-graph-sdk-powershell-v2-and-azure-automation/
• https://devblogs.microsoft.com/microsoft365dev/microsoft-graph-powershell-v2-is-now-in-public-preview-half-the-size-and-will-speed-up-your-automations/

Answer 2

Hi, Subhash

You can still pass credentials through, by adding your credentials as variables on the Azure Automation account and pulling them in: https://learn.microsoft.com/en-us/powershell/module/az.automation/get-azautomationcredential?view=azps-10.0.0

https://www.sharepointdiary.com/2021/07/how-to-connect-to-azure-ad-using-powershell.html

That should get you going with Connect-AzureAD.

Having said that, these cmdlets are being deprecated, in favor of Microsoft Graph. If your developing a new script, then look at using Microsoft Graph, and you can use Application authentication - using the same azure automation credentials processes.