In this video, let us understand what is a Run As account
Azure Automation allows you to automate tasks against Azure resources by means of Runbooks
These tasks can be anything like starting a Virtual Machine or maybe listing all resources in a subscription
In runbooks, all such tasks that you create against Azure resources using Azure Resource Manager and PowerShell commandlets must
authenticate to Azure using Azure Active Directory
For this purpose, we have Run As account
A Run As account is like an on-behalf of identity which is used to provide an
authentication mechanism and access to Azure Resources through runbooks
There are two types of Run As accounts. First, Azure Run As account, which is used to manage access to Azure Resource Manager
resources. Second, Azure Classic Run As account, which is used to manage Azure classic resources based on
Classic deployment model
Let us switch to Azure Portal
From the Azure home page, I go to the Automation Accounts and click on “Add” button
As you can see, at the time of creating an Automation account, you are presented with an option to create an Azure Run As account also
However, you can also create a Run As account later
Let us look at what happens when you create a Run As account
We are on the home page of Azure
I click on my Test Automation account named “AutomationTest”
I select Run As Accounts in the Account Settings section.
If you want to create a Run As account, you can follow this link to the documentation
Permissions required to configure a Run As and Classic Run As account are mentioned on these links
Similarly, you can follow these links for other FAQs related to Run As account
I have already created a Run As and a Classic Run As account in this Automation account
I click on the Azure Run As account to see its properties
When I had created this Run As account, a number of steps were executed in the background:
First, An Azure Active Directory
application with a self-signed certificate and a service principal account for this application were created in Azure
Active Directory
By default, it assigns Contributor role for the account in your current subscription
You can change permissions to Reader or any other role
Second, An Automation certificate asset named Azure Run As Certificate in the specified Automation account was created
The certificate asset holds the certificate private key that the Azure Active Directory application uses
This Self signed certificate is valid for 1 year from the date of creation and must be renewed before that
You can see the expiry date here
Lastly, An Automation connection asset named Azure Run As Connection was created in the specified Automation account
The connection asset holds the Application ID, Certificate Thumbprint, Subscription ID, and Tenant ID
This connection is used in runbooks for the purpose of authentication to access Azure resources
Let us quickly look at an example of how to use a Run As account in a runbook
I go to my test Automation account and select Runbooks under Process Automation section
You can see a few tutorial runbooks which are provided as samples
Let us look at AzureAutomationTutorialScript PowerShell runbook
This example runbook lists all ARM resources using Run As Account to authenticate into Azure
As you can see in the first line of code, we store the name of AzureRun As connection in the variable “connectionName”
Inside the try block, we get AzureRun AsConnection asset in variable “servicePrincipalConnection"
using the Get-AutomationConnection commandlet and connection name
This connection asset is the Azure Run As connection which is stored in the Run As account, as we saw earlier
In the next line, we log in to Azure using the properties of servicePrincipalConnection like
TenantId, ApplicationId and Certificate thumbprint
After we successfully establish a connection, we iterate over all resources in all resource groups using two foreach loops