identity synchronization/provisioning not working as expected

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.5.4 azuread version 2.41.0

Affected Resource(s)

azuread_service_principal

Terraform Configuration Files

resource "azuread_application" "example" {
  display_name = "example"
  feature_tags {
    enterprise = true
    gallery    = false
  }
}

resource "azuread_service_principal" "example" {
  application_id = azuread_application.example.application_id
  use_existing   = true
}

resource "azuread_synchronization_secret" "example" {
  service_principal_id = azuread_service_principal.example.id

  credential {
    key   = "BaseAddress"
    value = "https://exampleapp.net/api/2.0/preview/scim"
  }
  credential {
    key   = "SecretToken"
    value = "some-token"
  }
}

resource "azuread_synchronization_job" "example" {
  service_principal_id = azuread_service_principal.example.id
  template_id          = "scim"
  enabled              = true
}

Expected Behavior

The deployment creates a SCIM provisioning job on the non-gallery application.

Actual Behavior

The deployment fails with the error that the "scim" template can not be found.

Steps to Reproduce

terraform init
terraform apply

Important Factoids

Feature was implemented in https://github.com/hashicorp/terraform-provider-azuread/pull/830 However, for this in order to work the actual "scim" template need to exist on the API (https://graph.microsoft.com/v1.0/servicePrincipals/%3cprincipal-object-id/synchronization/templates) which it does not. To make it actually work the templates on the app needs to be initiated https://learn.microsoft.com/en-us/graph/api/applicationtemplate-instantiate?view=graph-rest-1.0&tabs=http. Apparently none of the resources is doing that and there is no other resource that does it.

hashicorp / terraform-provider-azuread

identity synchronization/provisioning not working as expected #1165