Shows how we can use a Service Principal identity in an Azure Automation Runbook.

sample-runbook-service-principal-credentials.ps1

param (
    [Parameter(Mandatory=$false)] 
    [String]$AzureCredentialAssetName = "VMPowerServicePrincipal",
	
    [Parameter(Mandatory=$false)] 
    [String]$AzureSubscriptionIDAssetName = "VMShutdownTargetSubscription",
	
    [Parameter(Mandatory=$false)] 
    [String]$AzureTenantIDAssetName = "VMShutdownTargetTenant"
)

# Setting error and warning action preferences
$ErrorActionPreference = "SilentlyContinue"
$WarningPreference = "SilentlyContinue"

# Read in Creds and Variables
$TenantId = Get-AutomationVariable -Name $AzureTenantIDAssetName
$Cred = Get-AutomationPSCredential -Name $AzureCredentialAssetName -ErrorAction Stop
$SubsciptionId = Get-AutomationVariable -Name $AzureSubscriptionIDAssetName

# Connecting to Azure using Service Principal
$null = Login-AzureRmAccount -ServicePrincipal -Tenant $TenantId -SubscriptionId $SubsciptionId -Credential $Cred -ErrorAction Stop

# Read all VMs in the current Subscription
$vmList = Get-AzureRmVM

$stoppedVMCount = 0

# Iterate over each VM to get detailed status
foreach($vmEntry in $vmList)
{
	# get the power state of the VM
  	$vmDetail = Get-AzureRmVM -Name $vmEntry.Name -ResourceGroupName $vmEntry.ResourceGRoupName -Status -WarningAction $WarningPreference -ErrorAction $ErrorActionPreference

	# If this string is present then the VM is on.
	if($vmDetail.StatusesText.Contains("PowerState/running"))
	{
		Stop-AzureRmVM -Name $vmDetail.Name -ResourceGroupName $vmDetail.ResourceGRoupName -Force -WarningAction $WarningPreference -ErrorAction $ErrorActionPreference	
		$stoppedVMCount++	
	}
}
Write-Output "Stopped $($stoppedVMCount) Virtual Machine(s)."