Encrypt All Azure Automation Variables 
$ResourceGroupName = ''
$AutomationAccountName = ''

# Get all variables
$variables = Get-AzureRMAutomationVariable -ResourceGroupName $ResourceGroupName -AutomationAccountName $AutomationAccountName

# parse through each unencrypted variable
Foreach($var in $variables | Where-Object{$_.Encrypted -ne $True}){
    
    # remove the unencrypted variable
    Remove-AzureRMAutomationVariable -ResourceGroupName $var.ResourceGroupName -AutomationAccountName $var.AutomationAccountName -Name $var.Name
    
    # recreate the variable, with the same values and encrypt it
    New-AzureRMAutomationVariable -ResourceGroupName $var.ResourceGroupName -AutomationAccountName $var.AutomationAccountName -Name $var.Name -Encrypted $True -Value $var.Value -Description $var.Description
}
Details
It is best practices to encrypt all of your Azure Automation Account variables. However, it is not possible to convert an unencrypted variable to an encrypted one. So this snippet will return all variables and if any are unencrypted, it will remove them, the recreate it as an encrypted variable.
  |  
Find and Load the Azure Automation Hybrid Registration Module 
$installPath = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\System Center Operations Manager\12\Setup\Agent").InstallDirectory
$modulePath = Get-ChildItem (Join-Path $installPath "AzureAutomation") -Recurse -Include 'HybridRegistration.psd1' | Select-Object -ExpandProperty FullName
Import-Module $modulePath
Details
The module to setup an Azure Automation Hybrid Runbook Worker is included in the install directory of the Microsoft Monitoring Agent. Since install directories can change, and since this module will include a version number in the path, you cannot hard code the path into a script. Instead you can query the registry for the install path, then lookup the modules psd1 file, bypassing the need to manually check the path every time you want to onboard a hybrid worker.
  |