Open zemirco opened 1 month ago
Hi @zemirco, thanks for reporting this issue. I couldn't say why the DELETE request is being sent without seeing a copy of the plan for this apply, however you will need to assign the AppRoleAssignment.ReadWrite.All
app role to your Terraform service principal in order to manage app role assignments. Unfortunately Application.ReadWrite.xyz
is not sufficient - as this is a privileged API that technically permits you to add any API permission for any application.
It finally works. Here is how we did it π₯³
The permission Application.ReadWrite.OwnedBy
is enough but the owner has to be set at the App Registration as well as the Enterprise Application.
Wow :) I'm so glad this finally works as we've spent so many hours on this topic.
Thank you for maintaining the azuread
provider.
Ah that's great, thanks for reporting back! This is easily missed and I'll see if we can call this out more clearly in the docs.
Glad that it is sorted @zemirco. :)
Community Note
Terraform (and AzureAD Provider) Version
Affected Resource(s)
azuread_app_role_assignment
azuread_service_principal
azuread_application
Terraform Configuration Files
Debug Output
https://gist.github.com/zemirco/07a36d90f68ac65f4ebcbfa420f8a94f
Panic Output
Expected Behavior
I'm able to add / remove groups to my Enterprise Application (so that the group members are able to login via SAML SSO) via my CI/CD pipeline using GitHub Actions by authenticating as a service principal.
This is how it should look like in the end.![image](https://github.com/hashicorp/terraform-provider-azuread/assets/1132354/8225038f-a47d-4fb3-bd28-d13e25857f28)
The app registration has the![image](https://github.com/hashicorp/terraform-provider-azuread/assets/1132354/e0b9942d-14a6-42aa-9245-f817dad63451)
Application.ReadWrite.OwnedBy
permission.The service principal uses OIDC to connect to our Azure AD.![image](https://github.com/hashicorp/terraform-provider-azuread/assets/1132354/d6f5202b-28b7-472c-8d31-e58793e52a62)
Actual Behavior
It all works locally when I run the command as a user.
It does not work when the command runs inside our CI/CD pipeline which is GitHub Actions. Here we're getting the following error.
Steps to Reproduce
terraform apply
References