Multiple RunAs Accounts in Azure Automation

Question

Is it possible to have multiple runas accounts in Azure Automation?

I researched online including Microsoft Articles and couldn't find an answer.

Answer 1

Doesn't have to be another AzureRunAs account. The runbooks use a combination of connections and certificates to authenticate. So you can add a new connection and have it use a different service principal. First you add a certificate, after that you create the connection and configure the service principal. I have never tested using the same AzureRunAs certificate for different/multiple connections, but its worth testing if that is possible. The code for the runbook authenticating stays mostly the same, apart from having to change the name of the connection and such.

Have a look in the portal:

Automation accounts -> Select the account -> Certificates
Automation accounts -> Select the account -> Connections

My code snippet:

$connectionName = "CustomConnectionNameHere";

            Try {
                # Get the connection "AzureRunAsConnection "
                $servicePrincipalConnection = Get-AutomationConnection -Name $connectionName

                "Logging in to Azure..."
                Add-AzureRmAccount `
                    -ServicePrincipal `
                    -TenantId $servicePrincipalConnection.TenantId `
                    -ApplicationId $servicePrincipalConnection.ApplicationId `
                    -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
            } catch {
                if (!$servicePrincipalConnection)
                {
                    $ErrorMessage = "Connection $connectionName not found."
                    throw $ErrorMessage
                } else{
                    Write-Error -Message $_.Exception
                    throw $_.Exception
                }
            }

Answer 2

不，您只能有两个运行方式帐户。（在CSP订阅中，您可以拥有新的运行方式帐户。）一个用于管理新的ARM资源，另一个用于管理经典资源。