Azure AD Authentication (Connect-AzureAD) in Azure Automation

Microsoft Azure

It is now (has been for a while) possible to modify Azure AD via the Azure Automation. The example below uses the Run As Automation Account to first Connect to Azure AD and then run the appropriate commands. You can also create a dedicated Run As account if you want, as well as use a username and password (less secure).

Before you write your code make sure that you:

  • Add the “AzureAD” module to the Automation Account
  • Give the Azure Automation Run As account the appropriate permission as show at the end of this article

Automation Code example (list all the groups in AD):

Give the Azure Automation Run As account the appropriate permissions:

  • Go to Azure Active Directory -> App registrations -> The Run Ass Account.
  • Then go to the API access as show:

  • Give the appropriate access, example below:

Don’t forget to click grant permissions!

2 thoughts on “Azure AD Authentication (Connect-AzureAD) in Azure Automation

  1. Is this still working for you? Executed verbatim, I get the following output:

    Failed
    Error occurred while executing GetGroups
    Code: Authorization_RequestDenied
    Message: Insufficient privileges to complete the operation.
    HttpStatusCode: Forbidden
    HttpStatusDescription: Forbidden
    HttpResponseStatus: Completed
    (Error occurred while executing GetGroups
    Code: Authorization_RequestDenied
    Message: Insufficient privileges to complete the operation.
    HttpStatusCode: Forbidden
    HttpStatusDescription: Forbidden
    HttpResponseStatus: Completed
    )

    This is after assigning the “Read and write directory data” permission, as well as a 2nd attempt to just grant it all access for temporary testing.

    I did have a brief consultation with Microsoft Suport on this, and they mentioned that service principals have some limitations. For example, “you can’t retrieve things like role assignments using a service principal”.

    Just curious if this is still working for you – and if so, were there any other setups or configurations needed that were maybe not covered here?

    Thanks!

Leave a Reply

Your email address will not be published. Required fields are marked *