Managed identity lets an Azure Automation runbook authenticate as an Azure-managed identity assigned to its Automation account. The runbook can then access permitted Azure resources without storing passwords or secrets, much like a scheduled task’s run-as account. section 8.2.4
Configure the identity and its access deliberately:
- Create a system-assigned managed identity on the Automation account. section 8.2.4
- Assign the identity permissions on the required Azure resource, such as Contributor access scoped to a storage account. section 8.2.4
- Authenticate the runbook with Connect-AzAccount -Identity instead of credential assets or passed secrets. section 8.4.2
- Review Automation permissions carefully because runbook creators can access stored assets, credentials, and managed identities. section 8.6
Uploading ZIP archives without runbook secrets
A PowerShell runbook accepts a folder path and container name, reads configuration through Automation variables, connects with Connect-AzAccount -Identity, finds ZIP files on a hybrid worker, uploads them to Azure Blob storage, and removes local copies. Test the runbook on the selected hybrid worker before publishing and scheduling it. section 8.4 section 8.4.2
$AzStorageAccount = @{
ResourceGroupName = $ResourceGroupName
AccountName = $StorageAccountName
}
$storage = Get-AzStorageAccount @AzStorageAccount
$AzAutomationAccount = @{
ResourceGroupName = $ResourceGroupName
AutomationAccountName = $AutomationAccountName
AssignSystemIdentity = $true
}
$Identity = Set-AzAutomationAccount @AzAutomationAccount
$AzRoleAssignment = @{
ObjectId = $Identity.Identity.PrincipalId
Scope = $storage.Id
RoleDefinitionName = "Contributor"
}
New-AzRoleAssignment @AzRoleAssignment
Inspect the PowerShell provisioning sequence that retrieves the storage account, assigns a system identity, and grants it scoped access. section 8.2.4
