I have a automation account with run as account through which i'm running a powershell runbook. It usually does add/remove a member to a AD group in azure and add/remove user to a WVD hostpool. My issue is run as account doesn't have sufficient permission to do the operations.
What level of access (on my account as well as run as account) required to do these activities?
To perform operations like adding/removing a user from Azure Ad group via PowerShell runbook, your Automation account should have owner/contributor role assigned.
The Owner role allows access to all resources and actions within an Automation account including providing access to other users, groups, and applications to manage the Automation account.
The Contributor role allows you to manage everything except modifying other user’s access permissions to an Automation account.
Based on your requirement you can assign roles as provided in the below MsDoc:
Go to Azure Portal -> Automation Accounts -> Your Account -> Access Control (IAM) -> Add Role
Go to Azure portal -> Azure AD -> Roles and Administrator ->Directory Readers role -> Assign this role to the runbook account name
For more in detail, please refer below links:
https://www.buchatech.com/2018/07/the-argument-is-null-or-empty-error-in-azure-automation-runbook/
https://learn.microsoft.com/en-us/azure/virtual-desktop/delete-host-pool?tabs=azure-portal
