Hi @Subhash Kumar Mahato , Good day !

To automate your PowerShell script using an Azure Runbook and securely store and pass the Azure App registration Client ID and Client Secret values, follow these steps:

1. Securely Storing and Passing Client ID and Client Secret

a. Store Secrets in Azure Key Vault:

Store your Client ID and Client Secret in Azure Key Vault as secrets.

You can do this via the Azure portal, PowerShell, or CLI.

b. Configure Azure Automation to Access Key Vault:

Create a System-Assigned Managed Identity for your Azure Automation account.

Go to your Azure Automation account in the Azure portal.

Under "Account Settings," select "Identity."

Enable the "System assigned" managed identity.

Grant Access to the Managed Identity:

In the Azure Key Vault where your secrets are stored, go to "Access policies."

Add an access policy that grants "Get" permission to the managed identity of your Azure Automation account.

Retrieve Secrets in Runbook:

In your PowerShell script within the Runbook, retrieve the secrets from the Key Vault using the managed identity.

Authenticate using Managed Identity

Connect-AzAccount -Identity

$vaultName = "your-key-vault-name"

$secretName = "your-secret-name"

Define the function to get the client secret from Key Vault

Function Get-ClientSecretFromKeyVault

{

    param (

                    [Parameter(Mandatory = $true)]

                                [string]$VaultName,

        [Parameter(Mandatory = $true)]

                                [string]$SecretName

    )

                try

    {

                    $secret = Get-AzKeyVaultSecret -VaultName $VaultName -Name $SecretName -AsPlainText -WarningAction SilentlyContinue

                                return $secret

    }

                catch

    {

                    Write-Error "Failed to retrieve the client secret from Key Vault. Details: $_"

                                return $null

    }

}

$clientSecret = Get-ClientSecretFromKeyVault -VaultName $vaultName -SecretName $secretName

Use the retrieved client secret in your script

Write-Host "The retrieved client secret is: " -NoNewline -ForegroundColor Yellow

Write-Host "$clientSecret" -ForegroundColor Green

2. Restrict Key Vault Access to the Runbook’s IP Address

Azure Runbooks run in a dynamic IP environment where IP addresses can change, so it’s not recommended to restrict access to a single IP address. However, you can restrict access to the Azure Virtual Network if your Runbook is running in a virtual network.