This script contains functions to help you identify potential runbooks still using Run As accounts.

Find-AutomationRunAsAccounts.ps1

<#
This script contains functions to help you identify potential runbooks still using Run As accounts.
If requires that you have the Az modules installed and that you are authenticated to Azure.

Azure Automation Run As Account will retire on September 30, 2023 and will be replaced with Managed Identities. 
Before that date, you'll need to migrate your runbooks to use managed identities. 

However, just the presence of a Run As account doesn’t mean a it is being used. Often these were just created 
during the automation account provisioning. This script help to determine if you are using the Run As account 
by search through the runbooks to find references to the Run As Account actually being called. Then finds the 
last time the runbook was executed. If no date is returned, then the runbook has not executed in the last 30 days. 

Get all connections for current subscription
  PS > Find-AutomationRunAsAccounts

Get all connections for the specified subscription
  PS > Find-AutomationRunAsAccounts -SubscriptionId '94e1d8dd-48b2-4062-a836-89a5ceae8595'

Get connections for a specific automation account
  PS > Get-AutomationRunAsAccounts -ResourceGroupName 'myResourceGroup' -AutomationAccountName 'myAutomationAccount'

#>
Function Get-AutomationAssetCommands {
    [CmdletBinding()]
    param(
        $exportPath,
        $Pattern
    )
    $rbMatches = Select-String -Path $exportPath -Pattern $Pattern

    foreach ($l in $rbMatches) {
        $s = $l.Line.Split()
        $index = $s.ToLower().IndexOf('-name') | Where-Object { $_ -gt $s.ToLower().IndexOf($Pattern.ToLower()) } | Select-Object -First 1
        if ($index -lt 1) {
            $index = $s.ToLower().IndexOf($Pattern.ToLower())
        }
        $index++
        $name = $s[$index]

        if ($name -match '^\$') {
            $variableStrings = Select-String -Path $exportPath -Pattern ([regex]::Escape($name)) | 
            Where-Object { $_.LineNumber -lt $l.LineNumber -and $_.Line -match '=' } | Select-Object -Last 1
            if ($variableStrings) {
                $name = $variableStrings.Line.Split('=')[-1].Trim().Replace('"', '').Replace("'", '')
            }
        }

        $name.Trim('"').Trim("'")
    }
}

Function Get-AutomationRunbookLastExecution {
    [CmdletBinding()]
    param(
        $ResourceGroupName,
        $AutomationAccountName,
        $Runbook
    )
    $Jobs = Get-AzAutomationJob -ResourceGroupName $ResourceGroupName -AutomationAccountName $AutomationAccountName -RunbookName $Runbook
    $Last = $Jobs | Sort-Object LastModifiedTime | Select-Object -ExpandProperty LastModifiedTime -Last 1
    $Last.LocalDateTime
}

Function Get-AutomationAssetUsage {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        $ResourceGroupName,
        [Parameter(Mandatory = $true)]
        $AutomationAccountName,
        [Parameter(Mandatory = $false)]
        [ValidateSet('Connection', 'Credential', 'Variable')]
        $AssetType = $null
    )

    $AutoAccount = @{
        ResourceGroupName     = $ResourceGroupName
        AutomationAccountName = $AutomationAccountName
    }

    $OutputFolder = join-path $env:Temp $AutomationAccountName

    if (-not (test-path $OutputFolder)) {
        New-Item -type directory -Path $OutputFolder | Out-Null
    }

    $AutomationAssetTypes = @(
        'Get-AutomationConnection'
        'Get-AutomationPSCredential'
        'Get-AutomationCertificate'
        'Get-AutomationVariable'
        'Set-AutomationVariable'
    )

    if ($AssetType) {
        $AutomationAssetTypes = @($AutomationAssetTypes | Where-Object { $_ -match $AssetType })
    }

    $Runbooks = Get-AzAutomationRunbook @AutoAccount | Where-Object { $_.State -ne 'New' }
    $wp = 0
    [System.Collections.Generic.List[PSObject]] $FoundItems = @()
    Foreach ($RB in $Runbooks) {
        Write-Progress -Activity "Runbook : $($rb.Name)" -Status "$wp of $($Runbooks.count)" -PercentComplete $(($wp / $($Runbooks.count)) * 100) -id 10; $wp++
        $export = Export-AzAutomationRunbook @AutoAccount -Name $RB.Name -Slot "Published" -OutputFolder $OutputFolder -Force
        $exportPath = Join-Path $OutputFolder $export.Name
    
        foreach ($Pattern in $AutomationAssetTypes) {
            Get-AutomationAssetCommands -exportPath $exportPath -Pattern $Pattern | ForEach-Object {
                $FoundItems.Add([pscustomobject]@{
                        Runbook               = $RB.Name
                        Type                  = $Pattern.Substring(14).Replace('PS', '')
                        Name                  = $_
                        ResourceGroupName     = $ResourceGroupName
                        AutomationAccountName = $AutomationAccountName
                    })
            }
        }
        Remove-Item -LiteralPath $exportPath -Force
    }
    Write-Progress -Activity "Done" -Id 10 -Completed
    $FoundItems
}

Function Get-AutomationRunAsAccounts {
    <#
.SYNOPSIS
Gets all of the connection calls from an automation account

.PARAMETER ResourceGroupName
The name of the resource group

.PARAMETER AutomationAccountName
The name of the automation account

.EXAMPLE
Get-AutomationRunAsAccounts -ResourceGroupName 'myResourceGroup' -AutomationAccountName 'myAutomationAccount'


#>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        $ResourceGroupName,
        [Parameter(Mandatory = $true)]
        $AutomationAccountName
    )
    $Results = Get-AutomationAssetUsage -ResourceGroupName $ResourceGroupName -AutomationAccountName $AutomationAccountName -AssetType Connection
    $ResultsWithTime = $Results | Select-Object -Property *, @{l = 'LastRun'; e = { $null } }
    foreach ($rb in $Results | Select-Object -ExpandProperty Runbook -Unique) {
        $LastRun = Get-AutomationRunbookLastExecution -ResourceGroupName $ResourceGroupName -AutomationAccountName $AutomationAccountName -Runbook $rb
        $ResultsWithTime | Where-Object { $_.Runbook -eq $rb } | ForEach-Object { $_.LastRun = $LastRun }
    }
    $ResultsWithTime
}

Function Find-AutomationRunAsAccounts {
    <#
.SYNOPSIS
Searches all automation account in a subscription for potential Run As account connections

.PARAMETER SubscriptionId
The GUID of the subscription you want to check

.EXAMPLE
Find-AutomationRunAsAccounts

Gets all connections for current subscription

.EXAMPLE
Find-AutomationRunAsAccounts -SubscriptionId '94e1d8dd-48b2-4062-a836-89a5ceae8595'

Gets all connections for the specified subscription

#>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $false)]    
        $SubscriptionId = $null
    )

    if ($SubscriptionId) {
        Set-AzContext -SubscriptionId $SubscriptionId -WarningAction SilentlyContinue | Out-Null
    }
    Write-Host "Searching Automation Accounts for subscription: $($(Get-AzContext).Subscription.Name)"
    $wp = 0
    $AutomationAccounts = Get-AzAutomationAccount
    $Results = foreach ($aa in $AutomationAccounts) {
        Write-Progress -Activity "$($aa.AutomationAccountName)" -Status "Automation Account : $wp of $($AutomationAccounts.count)" -PercentComplete $(($wp / $($AutomationAccounts.count)) * 100) -id 1; $wp++
        Get-AutomationRunAsAccounts -ResourceGroupName $aa.ResourceGroupName -AutomationAccountName $aa.AutomationAccountName
    }
    Write-Progress -Activity "Done" -Id 1 -Completed

    $Results
}