azuread_application: Unable to assign any App owners

[DI-DaveGoodine]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.3.7
on darwin_amd64
+ provider registry.terraform.io/hashicorp/azuread v2.33.0
+ provider registry.terraform.io/hashicorp/vault v3.12.0

Affected Resource(s)

• azuread_application

Terraform Configuration Files

data "vault_generic_secret" "Azure_Service_Principal_Atlantis" {
  path = var.vault_path_azure_service_principal_atlantis
}

provider "azuread" {
  client_id     = data.vault_generic_secret.Azure_Service_Principal_Atlantis.data["ARM_CLIENT_ID"]
  client_secret = data.vault_generic_secret.Azure_Service_Principal_Atlantis.data["ARM_CLIENT_SECRET"]
  tenant_id     = data.vault_generic_secret.Azure_Service_Principal_Atlantis.data["ARM_TENANT_ID"]
}

terraform {
  required_version = ">= 1.0"
  backend "s3" {}
  required_providers {
    azuread = {
      source = "hashicorp/azuread"
    }
    vault = {
      source = "hashicorp/vault"
    }
  }
}

data "azuread_application_template" "github_oidc_template" {
  display_name = "GitHub Enterprise Cloud - Organization"
}

data "azuread_client_config" "current" {}

data "azuread_users" "users" {
  user_principal_names = ["user1@foo.com","user2@foo.com"]
}

resource "azuread_application" "example" {
  display_name     = "Github Org SSO - Example"
  owners           = concat([data.azuread_client_config.current.object_id], data.azuread_users.users.object_ids)
  template_id =  data.azuread_application_template.github_oidc_template.template_id
}

Debug Output

https://gist.github.com/DI-DaveGoodine/be0562e81b6f7a20815a58921d799537

Panic Output

n/a

Expected Behavior

Azure App is created with three App owners.

Actual Behavior

Azure App is created, however:

1. There are no app owners.
2. There are three application registration owners.

Steps to Reproduce

1. terraform apply

Important Factoids

The service principal has these permissions:

References

• #0000

[Threpio]

I have had a quick play around and this is interesting. I have tried it using two different azuread_application_template and it did not create the users for either. If no template is used then the owners are assigned as would be expected.

I will look into the template ID logic to see if there is something there or if this is an API/Logic problem.

[manicminer]

We are working on a new resource azuread_application_from_template along with a host of additional resources including an azuread_application_owner resource, aimed at managing individual components of applications rather than monolithically like the azuread_application resource. I believe these resources together will resolve this issue of application ownership, by allowing you to launch an application from the template gallery and append additional owners as needed. These resources are in flight in #1214 and will land in the next provider release.

Our recommendation will be to adopt these new resource for launching applications from gallery templates, particularly in cases where the existing azuread_application conflicts with the starting properties for the new application. Accordingly, I've marked this issue for closure with #1214.