Open philmph opened 1 month ago
Hi @philmph, thanks for reporting this. I suspect an API bug here since the Portal tends to use the $batch API which we do not support. The API should not be erroring in this case, since the premise is clearly false (it's not the last owner). I am not sure that we work around this in the short term, since we don't support the $batch API and it's unlikely that we will in the near future.
@manicminer Thanks. I've somewhat expected this to be out of scope for the provider.
Do you have a hint where I can raise this issue directly with Microsoft? Happy to follow along there.
@philmph You could raise an issue at https://github.com/microsoftgraph/msgraph-metadata/issues, this is the most likely place I've found outside of Azure tech support.
@manicminer I've raised the Issue at the suggested repo. I don't think anything further can be done here since this provider depends on the Graph API implementation.
@philmph Great, thanks.
Thinking about it, I have encountered this same bug in the past and it did go away at one point. At that previous time, it seemed to be related to unified groups - additional validation had just been added to the API for unified groups (not allowed to remove the last user owner) and it was inadvertently affecting security groups. I see that your example config is not creating a unified groups, perhaps the same is happening again.
Community Note
Terraform (and AzureAD Provider) Version
Affected Resource(s)
azuread_group
Terraform Configuration Files
Notes:
When a group is
role_assignable = true
it is possible to remove allOwner
objects but one remaining via Terraform and the Portal in all test cases.When a group is
role_assignable = false
it is NOT possible to remove allOwner
objects but one remaining via Terraform. Terraform removes all untilcount = 2
and errors on one random last remaining one.Within the Portal the request also errors if
Owner
objectscount = 2
but works ifcount = 3
and two are removed with multiple select.-> Single object remove works fine with
role_assignable = true
but fails withrole_assignable = false
. Multiple object remove is not implemented in Terraform but works in the Portal. Always requires acount = 3
or higher.Also worth noting that I haven't seen any highlights towards this only being the case in
role_assignable = false
groups thats why I open this issue.Debug Output
Here Terraform tries to remove two
Owner
from a group withrole_assignable = false
. Outcome is that oneOwner
from 3 is removed and the error raised when the 2ndOwner
is to be removed (resulting in only oneOwner
left).Steps to repoduce described in
Run 5 - Removing the 2nd and 3rd Owner from group (-2 Owner in one plan / apply)
Panic Output
Not relevant.
Expected Behavior
All objects but one remaining
Owner
can be removed from the group.Actual Behavior
All objects but two
Owner
remain. Terraform errors on the last one it wants to remove beforecount = 1
.Steps to Reproduce
Note: I am running the configuration with an SPN with
Group.Create
andDirectory.Read.All
. Thats whySPN as Owner
is stated in the runs. Therole_assignable = true
group was state imported since the Graph API permissions are not sufficient to create such a group. The behavior does not change if running with User context.Run 1
Creation with no additional Owners -> SUCCESS: Both groups exist with SPN as Owner
Run 2
Adding a 2nd Owner to both groups -> SUCCESS: Both groups exist with SPN and 2nd as Owner
Run 3
Removing the 2nd Owner from both groups -> SUCCESS: for Group with assignable_to_role = true -> FAIL: for Group with assignable_to_role = false
Error: GroupsClient.BaseClient.Delete(): unexpected status 400 with OData error: Request_BadRequest: The group must have at least one owner, hence this owner cannot be removed.
Portal 1
Removing the 2nd Owner from both groups -> SUCCESS: for Group with assignable_to_role = true -> FAIL: for Group with assignable_to_role = false
Error: Failed to remove group owner. The group must have at least one owner.
Below only the group with assignable_to_role = false is tested further
Run 4
Adding a 3rd Owner to group -> SUCCESS: Group exist with SPN, 2nd and 3rd as Owner
Run 5
Removing the 2nd and 3rd Owner from group (-2 Owner in one plan / apply) -> FAIL: Removes one and errors on the 2nd
Error: GroupsClient.BaseClient.Delete(): unexpected status 400 with OData error: Request_BadRequest: The group must have at least one owner, hence this owner cannot be removed.
Portal 2
Removing the 2nd and 3rd Owner from group (-2 Owner selected in the UI) -> SUCCESS: Removes both Owners successfully at once
Important Factoids
Not relevant.
References
464