title: Azure Automation Invoke-Sqlcmd : Login failed for user '<token-identified principal>'
body: <p>I want to run an automation runbook to create a new database for each user and add them as a db_owner on their databases, but after I run the script I got this error <code>&quot;Invoke-Sqlcmd : Login failed for user '&lt;token-identified principal&gt;'. At line:94 char:14 + ... Invoke-Sqlcmd -ServerInstance $databaseServereInstance -D ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [Invoke-Sqlcmd], SqlException + FullyQualifiedErrorId : SqlExceptionError,Microsoft.SqlServer.Management.PowerShell.GetScriptCommand&quot;</code> for all users i tried to add as a db_owner.</p>
  <p>Locally, the same code is working... only in Azure Automation runbook it's not working.</p>
  <p>Below is my code.</p>
  <pre><code>$databaseServereInstance = '' This are filled i only removed it.
  $sourceDatabaseName = ''
  $azureRg = ''
  $sourceServer = ''
  
  # Login to Azure AD PowerShell With Admin Account
  $connectionName = &quot;AzureRunAsConnection&quot; 
  $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName         
  # Now you can login to Azure PowerShell with your Service Principal and Certificate
  
  Connect-AzAccount -TenantId $servicePrincipalConnection.TenantId -ApplicationId $servicePrincipalConnection.ApplicationId -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
  Connect-AzureAD -TenantId $servicePrincipalConnection.TenantId -ApplicationId $servicePrincipalConnection.ApplicationId -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
  
  
  #Get-AzureADGroup
  [String]$groupname = 'fiduciagad'
  [Microsoft.Open.AzureAD.Model.Group]$getGroup = Get-AzureADGroup | Where { $PSItem.DisplayName -eq $groupname }
  Write-Output $getGroup.DisplayName
  
  if($getGroup -ne $null)
  {
    #Get-AzureADGroupMember
    Get-AzureADGroupMember -ObjectId $getGroup.ObjectId | ForEach-Object -Process `
    {
       [String]$userPrincipalName = $PSItem.UserPrincipalName
       Write-Output $userPrincipalName
       [String]$givenName = $PSItem.GivenName
       Write-Output $givenName
       
      
           [String]$devUserPrincipalNameDatabase = &quot;$($sourceDatabaseName)-DevDB-$($givenName)&quot;
           [String]$targetDatabase = (Get-AzSqlDatabase -Name &quot;$devUserPrincipalNameDatabase&quot; -ResourceGroupName $azureRg -ServerName $sourceServer).DatabaseName
           
         
               #Remove source database for each user in a group
               Remove-AzSqlDatabase -ResourceGroupName $azureRg -ServerName $sourceServer -DatabaseName $devUserPrincipalNameDatabase
  
               #Copy source database for each user in a group and make the user db_owner
               
               New-AzSqlDatabaseCopy -ResourceGroupName $azureRg -ServerName $sourceServer -DatabaseName $sourceDatabaseName `
                 -CopyResourceGroupName $azureRg -CopyServerName $sourceServer -CopyDatabaseName $devUserPrincipalNameDatabase
  
               [String]$query = &quot;
                  -- Add contained Azure AD user 
                  CREATE USER [$($userPrincipalName)] FROM EXTERNAL PROVIDER WITH DEFAULT_SCHEMA = dbo;   
                  -- Add user to role(s) in db 
                  ALTER ROLE db_owner ADD MEMBER [$($userPrincipalName)]; 
                  &quot;
               [String]$getDbAzSqlAaccessToken = (Get-AzAccessToken -ResourceUrl 'https://database.windows.net/').Token
               Write-Output $getDbAzSqlAaccessToken    
               Invoke-Sqlcmd -ServerInstance $databaseServereInstance -Database $devUserPrincipalNameDatabase -AccessToken $getDbAzSqlAaccessToken ` -query $query
    }
  } 
  else
  {
    Write-Verbose -Message &quot;AzureAD Group could not be found...&quot;
  }
  </code></pre>