title: Azure Automation: Runbook, RunAs Account: How to allow access to AAD (e.g. for Get-AzADUser)?
body: <p>Good afternoon</p>
  
  <p>I have selected stackoverflow for this question because probably mainly programmers are confronted with this question:</p>
  
  <h3>This is the issue:</h3>
  
  <p>If we call <code>Get-AzADUser</code> to get all AAD Users in the Azure Automation Runbook, then we get: <code>Error 'Insufficient privileges'</code></p>
  
  <h3>We do it like this:</h3>
  
  <ol>
  <li>We have an Automation Account with an "Azure Run As Account"</li>
  <li>In the PowerShell Runbook we call:</li>
  </ol>
  
  <pre><code>    # Connect to AAD
      $Conn = Get-AutomationConnection -Name AzureRunAsConnection
      $account = Connect-AzAccount -ServicePrincipal `
                 -TenantId $Conn.TenantID  `
                 -ApplicationId $Conn.ApplicationID  `
                 -CertificateThumbprint $Conn.CertificateThumbprint
      # Get All AAD Users
      $AllADUsers = Get-AzADUser
  </code></pre>
  
  <ol start="3">
  <li>If we start the Runbook, we get the Error:</li>
  </ol>
  
  <pre><code>&gt; Get-AzADUser : Insufficient privileges to complete the operation.
  &gt; FullyQualifiedErrorId :
  &gt; Microsoft.Azure.Commands.ActiveDirectory.GetAzureADUserCommand
  </code></pre>
  
  <h3>This is the permissions configuration:</h3>
  
  <ol>
  <li>The <code>Automation Account</code> has set <code>Run as accounts</code> » <code>Azure Run As Account</code> (and not an Azure Classic Run As Account)</li>
  <li>In fact, <code>Azure Run As Account</code> is misleading, it is a Registered App and can be found in Azure <code>App registrations</code></li>
  <li>The Registered App has these settings:</li>
  </ol>
  
  <p>» A custom role with <em>all</em> permissions.</p>
  
  <p>» API Permissions:</p>
  
  <pre><code>Microsoft Graph (6)
  Delegated    Directory.AccessAsUser.All
  Delegated    Directory.ReadWrite.All
  Delegated    User.ReadWrite.All
  Application  Directory.ReadWrite.All
  Application  User.Export.All
  Application  User.ReadWrite.All
  </code></pre>
  
  <p>» All API Permissions are Granted for our Tenant</p>
  
  <p>Unfortunately, we still get the Error 'Insufficient privileges'</p>
  
  <p>Thanks a lot for any help!</p>
  
  <p>Kind regards,
  Thomas</p>