Azure Automation backdoor

New-AzAutomationRunbook -Name Backdoor -Type PowerShell

Creates a runbook in Azure Automation that executes your code under the service identity: persistence in the tenant that survives password changes.

Run it when you have credentials with permissions over Automation (or subscription Contributor) and you want persistence in Azure that does not depend on the user account: the runbook runs with Managed Identity and a schedule executes it on its own. It is one of the most convenient cloud persistence methods: it is created with three cmdlets.

If the tenant has resource creation alerts (Sentinel with Azure Activity analytics) the creation triggers immediately. Runbooks that call the internet leave traces in Automation logs. For one-off access, a user with a persistent role is simpler and less visible.