Plan correctly states resource "will be updated in-place".
On apply this errors:
Error: Could not create assignment schedule request, PrivilegedAccessGroupEligibilityScheduleRequestsClient.BaseClient.Post(): unexpected status 400 with OData error: RoleAssignmentExists: The Role assignment already exists
Steps to Reproduce
Given the two HCL configurations above, first apply 'before' and then attempt to update the resource by applying the 'after' configuration.
On an update operation it is using Action = msgraph.PrivilegedAccessGroupActionAdminAssign which is the same as the Create() operation. Based on the Graph documentation here I believe this should instead be using Action = msgraph.PrivilegedAccessGroupActionAdminUpdate however I've not yet been able to test this.
Community Note
Terraform (and AzureAD Provider) Version
Terraform: 1.8.5 Azure AD Provider: 2.53.1
Affected Resource(s)
azuread_privileged_access_group_eligibility_schedule
Terraform Configuration Files
Before:
After:
Expected Behavior
Properties are updated on existing resource.
Actual Behavior
Plan correctly states resource "will be updated in-place". On apply this errors:
Steps to Reproduce
Given the two HCL configurations above, first apply 'before' and then attempt to update the resource by applying the 'after' configuration.
References
I've had a brief look at the provider code and Graph documentation and I believe the issue may stem from this line: https://github.com/hashicorp/terraform-provider-azuread/blob/6594e1c6cd59ffc7f5e9a881412609d9cde816e7/internal/services/identitygovernance/privileged_access_group_eligiblity_schedule_resource.go#L214
On an update operation it is using
Action = msgraph.PrivilegedAccessGroupActionAdminAssign
which is the same as the Create() operation. Based on the Graph documentation here I believe this should instead be usingAction = msgraph.PrivilegedAccessGroupActionAdminUpdate
however I've not yet been able to test this.