Find user who kicked off a SQL Agent job at runtime I have inherited a breakglass procedure that allows certain users to kick off a SQL Agent job that inflates their privileges on the instance.

It currently sends an email to say that it has been invoked, waits for 4 hours then revokes the privileges, sending an email out to say that it has been revoked.

But I just can't find a way to capture who kicked the Agent job off. 

Is there a way that the user id details can be captured or is it always going to take the SQL Agent users details?
This seems to be available in the msdb.dbo.sysjobhistory table under the message column.

We can use some code to extract the text based on the "Executed as user" text:

SELECT          [j].[name] AS [JobName],
                CASE
                    WHEN LEFT([h].[message], 17) = 'Executed as user:' THEN
                        SUBSTRING([h].[message], 19, CHARINDEX('.', [h].[message], 1) - 18)
                    WHEN [h].[message] LIKE '%invoked by%' THEN
                        SUBSTRING(
                                     [h].[message],
                                     CHARINDEX('invoked by ', [h].[message]) + 11,
                                     CHARINDEX(
                                                  '.',
                                                  SUBSTRING(
                                                   [h].[message],
                                                   CHARINDEX('invoked by ', [h].[message]) + 11,
                                                   99
                                                   )
                                              ) - 1
                                 )
                    ELSE
                        [h].[message]
                END,
                [h].[message]
FROM            [msdb].[dbo].[sysjobs]       AS [j]
    INNER JOIN  [msdb].[dbo].[sysjobhistory] AS [h]
                ON
                [j].[job_id] = [h].[job_id]
WHERE           [j].[enabled] = 1   --Only Enabled Jobs
ORDER BY        [JobName];