azure automation: create user\groups in on-promise AD with runbook

Question

azure automation: create user\groups in on-promise AD with runbook

Arif Usman 496

Hi folks,

I have a hybrid identity setup with on-premises Active Directory synchronized to Azure AD via Azure AD Connect. I'm exploring options to automate the creation of users and groups in the on-prem AD using Azure Automation Runbooks.

Specifically, I’m trying to understand what methods are available to interact with on-prem AD from Azure Automation. I've come across some YouTube videos demonstrating hybrid runbook workers using Azure Arc-enabled servers and an on-prem AD service account.

A few questions:

If I have a domain-joined VM in Azure (joined to on-prem AD via VPN or ExpressRoute), can this VM function as an Azure Arc-enabled hybrid worker?

Is using a hybrid runbook worker the most efficient and secure way to manage on-prem AD objects from Azure?

Are there alternative architectures or best practices recommended for this use case?

Just trying to connect the dots and identify the most reliable and maintainable option moving forward.

Thanks in advance!

Best regards,

1 answer

Your answer

Answer 1

Hello Arif Usman,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to use azure automation to create user\groups in on-premise AD with runbook.

Regarding your scenarios and questions:

If I have a domain-joined VM in Azure (joined to on-prem AD via VPN or ExpressRoute), can this VM function as an Azure Arc-enabled hybrid worker?

Yes, and here’s how: https://learn.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker

Is using a hybrid runbook worker the most efficient and secure way to manage on-prem AD objects from Azure?

Yes, especially the extension-based HRW.

Check this link: https://practical365.com/how-to-manage-on-premises-infrastructure-using-azure-automation-hybrid-worker/ it helps you in hybrid runbook worker the most efficient and secure method.

Are there alternative architectures or best practices recommended for this use case?

I will recommend these Architectures:

Azure Automation Account
Extension-based Hybrid Runbook Worker on Azure VM
Azure Key Vault for storing AD service account credentials
Azure Monitor / Log Analytics for logging and alerting

For best practices:

Use PowerShell runbooks with ActiveDirectory module.
Secure credentials using Managed Identity or Key Vault.
Monitor execution via Azure Monitor and Log Analytics Workspace as stated in the link above.

Finally, avoid the followings:

Agent-based HRW (retired).
Exposing AD via public APIs.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Arif Usman 496 Reputation points

2025-07-30T19:29:58.5233333+00:00

Thanks for your detail description @Sina Salam,

So, i am running automation account as system managed identity because it will also create some groups\users in entraid.

What do you recommend to run in automation account as?

For example I have privilege account in AD call 'createaccount'. how can i run this in azure automation to create groups\users in Active Directory on prem.
Naveena Patlolla 4,805 Reputation points Microsoft External Staff Moderator

2025-08-04T08:00:44.65+00:00

Hi Arif Usman
Hybrid Runbook Worker on a server in your on-prem AD.

It must be domain-joined. It must have PowerShell access to AD (Install RSAT or ensure Active Directory module is present). Register the Hybrid Worker Group with your Azure Automation Account.

Create a Credential Asset in Azure Automation Go to your Automation Account.

Under Shared Resources > Credentials, add a domain user with rights to create users and groups in AD.

What do you recommend to run in automation account as?
Below is the recommendation

# Get credentials from Automation Account $cred = Get-AutomationPSCredential -Name "ADAdminCred" # Import AD module (ensure it exists on the hybrid worker) Import-Module ActiveDirectory

Please let me know if you face any challenge here, I can help you to resolve this issue further

Share via

azure automation: create user\groups in on-promise AD with runbook

1 answer

Your answer