I have created an Azure Run as account in one of my subscriptions. In my PS runbook, how do I access resources in other subscriptions using this run as account.
The run as account
essentially is a service principal in your azure ad tenant. When it was created under a subscription, it will be assigned a Contributor
role under the subscription automatically.
If you want to let it access the resources in other subscriptions, just navigate to the specific subscription in the portal -> Access control (IAM)
-> Add
-> Add role assignment
-> add the service principal(Display name of run as account
) as a role which you want(e.g. Contributor). See this link. Note: Make sure your user account which used to login portal is an Owner
role of the subscription, otherwise you will not have the permission to do that. For more details about azure RBAC, you could refer to this link.
Then in the runbook, you could use Set-AzureRmContext -SubscriptionId "xxxx-xxxx-xxxx-xxxx"
to set the subscription to use, more details see this link.