Azure Automation Runbook jobs randomly failing with error "The decryption operation failed, see inner exception."

Question

Azure Automation Runbook jobs randomly failing with error "The decryption operation failed, see inner exception."

REAutomation 0

Powershell automation jobs are randomly Failing with an exception "The decryption operation failed, see inner exception". No way to gather any details about what the inner exception is. Details below.

Fails in azure when starting jobs manually or queued via schedule. PS 7.2 runtime environment, fails on azure, fails on hybrid worker. Created a PS 7.4 environment with newest modules and also getting the same random failures. Same input parameters sometimes fail, sometimes execute. Some jobs fail with no parameters even required, just starting -> failed. Nothing in logs of course, as the execution failed before start with the only message in the Exception tab is "The decryption operation failed, see inner exception". When I dig further into the Azure Automation account logs I don't see any details relating to this issue. I am getting some delayed queue jobs in my automation account as well, not sure if those are related.

Thanks for any help or guidance.

Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-03-26T12:59:50.91+00:00
Hello REAutomation, thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates. We have few follow-ups question on you issue, could you please help us with the below details.

Are your runbooks referencing any credentials, certificates, or variables marked as encrypted? If yes, have you tried recreating one of them to see if the error persists?

Have you rotated the encryption keys for the Automation account recently? If not, would you be able to test whether rotating them resolves the decryption error?

Do failures occur across all runbooks or only specific ones? If you create a new runbook with no parameters and no asset references, does it still fail?

On the hybrid worker, are you seeing any event logs (Windows Event Viewer > Application and Services Logs > Microsoft > AzureAutomation)?

You mentioned delayed queue jobs. Do those correlate with the failures, or do some jobs eventually succeed after delay?

Thanks,
REAutomation 0 Reputation points

2026-03-26T19:29:19.02+00:00
Thanks Barath!

In my most common failure, I have an email script that receives parameters for sending an MgEmail, no credentials are used, but I am doing both a Connect-AzAccount -Identity and Connect-MgGraph -Identity. I don't think I need the Connect-AzAccount in there, just a legacy from when I first wrote it. Not trying to lead the direction of the troubleshooting, it's just the only auth-based command going on that I can think of that might have anything to do with encryption.

I'm not familiar with that process. I am using the default managed Identity attached to the Automation Account to run these.

Across 8 different seemingly unrelated runbooks. The most frequent failure though is my email script.

I am seeing events, mostly informational. No errors or critical.

No, the job that is delayed is primarily one that runs every 5 minutes across two workers in a machine group. It's relatively light and should execute in under a minute.

Thank you!

1 answer

Your answer

Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-03-26T12:59:50.91+00:00

Hello REAutomation, thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates. We have few follow-ups question on you issue, could you please help us with the below details.

Are your runbooks referencing any credentials, certificates, or variables marked as encrypted? If yes, have you tried recreating one of them to see if the error persists?

Have you rotated the encryption keys for the Automation account recently? If not, would you be able to test whether rotating them resolves the decryption error?

Do failures occur across all runbooks or only specific ones? If you create a new runbook with no parameters and no asset references, does it still fail?

On the hybrid worker, are you seeing any event logs (Windows Event Viewer > Application and Services Logs > Microsoft > AzureAutomation)?

You mentioned delayed queue jobs. Do those correlate with the failures, or do some jobs eventually succeed after delay?

Thanks,
REAutomation 0 Reputation points

2026-03-26T19:29:19.02+00:00

Thanks Barath!

In my most common failure, I have an email script that receives parameters for sending an MgEmail, no credentials are used, but I am doing both a Connect-AzAccount -Identity and Connect-MgGraph -Identity. I don't think I need the Connect-AzAccount in there, just a legacy from when I first wrote it. Not trying to lead the direction of the troubleshooting, it's just the only auth-based command going on that I can think of that might have anything to do with encryption.

I'm not familiar with that process. I am using the default managed Identity attached to the Automation Account to run these.

Across 8 different seemingly unrelated runbooks. The most frequent failure though is my email script.

I am seeing events, mostly informational. No errors or critical.

No, the job that is delayed is primarily one that runs every 5 minutes across two workers in a machine group. It's relatively light and should execute in under a minute.

Thank you!

Answer 1

It seems the failure is not caused by your runbook code, authentication logic, or managed identity. The error occurs before PowerShell is initialized. Connect-AzAccount -Identity and Connect-MgGraph -Identity do not decrypt Automation assets.

Azure Automation job execution has two phases: service‑side and customer‑side.

service‑side: Job metadata and parameters are loaded, Automation account assets are decrypted and Worker slot is allocated. Your failure occurs here

If this phase fails:

No PowerShell host is created
No runbook code runs
No logs or streams are generated
Only a generic .NET exception is shown

Runbook execution (customer‑side):

PowerShell starts
Connect-AzAccount / Connect-MgGraph execute
Your email logic runs

It seems you never reach this phase, Because managed identity authentication does not use stored secrets, it is not involved in Automation encryption. If auth were the issue, you would see a PowerShell error stream which you do not.

The email runbook fails more often only because it runs more frequently, increasing the chance of hitting an unhealthy backend instance.

Delayed/queued jobs further confirm Automation backend instability, not script problems.

What you can try now:

Remove legacy Connect-AzAccount -Identity: The command is not required for Graph email functionality. Removing it prevents token request collisions at job start.

__Test a minimal auth runbook:__Create a runbook that does only Managed Identity token acquisition

Connect-MgGraph -Identity

Run this repeatedly on the same schedule/parallelism as your production email script.
Purpose: simulate the failure condition without other variables.
If failures appear here, it confirms token acquisition collisions are the root cause.

Reduce concurrency / staggering schedules: For high-frequency jobs, consider:

Staggering start times across multiple workers.
Ensuring jobs do not overlap.
Introducing short random delays at job start if possible.

This mitigates token contention at the Automation platform level.

Monitor job queue delays: Use this as a signal of token pressure:

Automation Account > Jobs > filter status = Queued

Long queues in your every-5-minute job indicate platform token pressure.
This is expected if multiple -Identity calls occur concurrently.

Diagnostic Logging: You can keep JobLogs enabled.

Don’t expect inner exception details; the failure occurs before script execution, so logs are limited.
Still, logs confirm which jobs fail and under what schedule, helping with frequency adjustments.

This might be intermittent Managed Identity token acquisition failures during job initialization under high-frequency or concurrent runs, leading to payload decryption errors.

We have reached out to you in Private messages, could you please take a look into it? Thanks

REAutomation 0 Reputation points

2026-03-28T11:21:35.4033333+00:00

Thank you much Bharath. I will go ahead and disable the connect-azaccount from the graph email send, it was a legacy command I had there before.

I can also split some of the frequently repeating automations to another automation account if need be if the queuing is getting too frequent.

I also submitted the support ticket. Thank you very much for your help!
Siva shunmugam Nadessin 7,645 Reputation points Microsoft External Staff Moderator

2026-03-30T01:18:17.4633333+00:00

Hello REAutomation,

If the answer was helpful, kindly Accept Answer & and "up-vote" this can be beneficial to other community members.
Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-03-31T08:48:53.7933333+00:00

We have escalated your case for the further assistance from the backend team. Thanks

Share via

Azure Automation Runbook jobs randomly failing with error "The decryption operation failed, see inner exception."

1 answer

Your answer