Enhancing the security of Azure Automation Webhooks in an Azure DevSecOps context

Hi,

This is interesting, but I think it leads to a "chicken and egg" scenario:

As I understand it, a webhook is only really attractive in scenarios where we cannot use native Azure AD authentication for some reason.

But if my calling application/process is in fact able to use Azure AD and Azure RBAC, then... wouldn't I just use this instead of a webhook?

https://learn.microsoft.com/en-us/rest/api/automation/job/create?tabs=HTTP

I am genuinely curious, and will be trying the "Job - Create - REST API" approach today.

Apologies if the REST API method became available after your post!