Azure Automation: Runbook, RunAs Account: How to allow access to AAD (e.g. for Get-AzADUser)?

0
votes

Good afternoon

I have selected stackoverflow for this question because probably mainly programmers are confronted with this question:

This is the issue:

If we call Get-AzADUser to get all AAD Users in the Azure Automation Runbook, then we get: Error 'Insufficient privileges'

We do it like this:

  1. We have an Automation Account with an "Azure Run As Account"
  2. In the PowerShell Runbook we call:
    # Connect to AAD
    $Conn = Get-AutomationConnection -Name AzureRunAsConnection
    $account = Connect-AzAccount -ServicePrincipal `
               -TenantId $Conn.TenantID  `
               -ApplicationId $Conn.ApplicationID  `
               -CertificateThumbprint $Conn.CertificateThumbprint
    # Get All AAD Users
    $AllADUsers = Get-AzADUser
  1. If we start the Runbook, we get the Error:
> Get-AzADUser : Insufficient privileges to complete the operation.
> FullyQualifiedErrorId :
> Microsoft.Azure.Commands.ActiveDirectory.GetAzureADUserCommand

This is the permissions configuration:

  1. The Automation Account has set Run as accounts » Azure Run As Account (and not an Azure Classic Run As Account)
  2. In fact, Azure Run As Account is misleading, it is a Registered App and can be found in Azure App registrations
  3. The Registered App has these settings:

» A custom role with all permissions.

» API Permissions:

Microsoft Graph (6)
Delegated    Directory.AccessAsUser.All
Delegated    Directory.ReadWrite.All
Delegated    User.ReadWrite.All
Application  Directory.ReadWrite.All
Application  User.Export.All
Application  User.ReadWrite.All

» All API Permissions are Granted for our Tenant

Unfortunately, we still get the Error 'Insufficient privileges'

Thanks a lot for any help!

Kind regards, Thomas

1
azureazure-active-directoryazure-powershellazure-automationazure-runbook

1 Answers

1
votes

According to some test, you need to add the permissions of Azure AD but not Micorsoft Graph. It seems the Get-AzADUser command use Azure AD graph in the backend but not microsoft graph. So we need to do the operations as below: enter image description here

enter image description here

After that we can use the command Get-AzADUser successfully(if you test the command in powershell, when you add the Azure AD permission, please close the powershell and reopen it and re-connect to avoid the impact of cache)

I test it in my side, it shows same error with yours' and it can get the users successful after adding this permission. Hope it helps~

enter image description here