Terraform Import is not working as expected

[SuryenduB]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

terraform -v Terraform v1.5.5 on windows_386

• provider registry.terraform.io/hashicorp/azuread v2.45.0

Your version of Terraform is out of date! The latest version is 1.6.3. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• azuread_conditional_access_policy
• azuread_authentication_strength_policy

Terraform Configuration Files

import {
    to = azuread_conditional_access_policy.mfa_for_databricks_and_cloudflare
    id = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}

import {
    to = azuread_conditional_access_policy.sensitive_users_require_FIDO2_for_Sign_In
    id = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}

import {
   to =  azuread_authentication_strength_policy.fido
   id =  "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}

Debug Output

https://gist.github.com/SuryenduB/3f36659227e599c54fb1ef1c3eeadcc8

Panic Output

Expected Behavior

Conditional Access Policy and Authentication Strength Policy should have been imported

Actual Behavior

• Authentication Strength Policy is not Imported
• Conditional Access Policies are imported with errors

Steps to Reproduce

1.terraform plan -generate-config-out azuread_conditional_access_policy.tf

1. terraform apply

Important Factoids

References

• 0000

[manicminer]

Thanks for reporting @SuryenduB. There are some challenges around importing/managing CAPs created outside of Terraform although we aim to resolve these were possible. Would you be able to post the affected CAP in full? You can retrieve it using the MS Graph API with the URI https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/{id}

For the authentication strength policy, it looks like you have specified an invalid policy ID. Like with CAPs, you can list these using MS Graph using the URI https://graph.microsoft.com/v1.0/policies/authenticationStrengthPolicies.