Error while trying to do App Registration using Terraform Azure AD Provider 2.0

Question

I am trying to do app registration using Terraform Azure AD 2.0 provider and i get the below error while apply. The Object ID is that for Microsoft Graph. All the well known IDs are provided below :

https://github.com/manicminer/hamilton/blob/main/environments/published.go https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application_published_app_ids

│

Error: Updating service principal with object ID: "a2f717fe-bc5d-42e5-b0b4-801562508280"
│ 
│   with azuread_service_principal.msgraph,
│   on resources.application.tf line 220, in resource "azuread_service_principal" "msgraph":
│  220: resource "azuread_service_principal" "msgraph" {
│ 
│ ServicePrincipalsClient.BaseClient.Patch(): unexpected status 403 with
│ OData error: Authorization_RequestDenied: Insufficient privileges to
│ complete the operation.

Below is my code :

data "azuread_application_published_app_ids" "well_known" {}

data "azuread_service_principal" "msgraph" {
  application_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
}

resource "azuread_service_principal" "msgraph" {
  application_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
  use_existing   = true
}

resource "azuread_application" "app-api" {
  display_name = format("app-%s-api-%s", var.project.name, var.project.environment.name)
  owners       = [data.azuread_client_config.default.object_id]

  api {
    oauth2_permission_scope {
      admin_consent_description  = "Allows the app to read and write data"
      admin_consent_display_name = local.oauth2_permissions.read-and-write.admin_consent_display_name
      enabled                    = true
      id                         = random_uuid.opsys-gw.result
      type                       = "User"
      value                      = "read-and-write"
    }
  }

  app_role {
    allowed_member_types = ["User", "Application"]
    description          = "Application administrators have the ability to administer the application."
    display_name         = local.app_roles.application-administrator.display_name
    enabled              = true
    id                   = data.azuread_client_config.default.object_id
    value                = "application-administrator"
  }

  web {
    logout_url    = format("https://%s.azurewebsites.net/.auth/logout", module.name_app_service_api.location.app_service.name_unique)
    redirect_uris = [format("https://%s.azurewebsites.net/.auth/login/aad/callback", module.name_app_service_api.location.app_service.name_unique)]

    implicit_grant {
      access_token_issuance_enabled = true
      id_token_issuance_enabled     = true
    }
  }

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph # Microsoft Graph

   

     resource_access {
          id   = azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
          type = "Role"
        }
    
        resource_access {
          id   = random_uuid.opsys-gw.result # User.Read.All
          type = "Scope"
        }
      }
    }

Azure AD API Service Principal Resource

resource "azuread_service_principal" "api-sp" {
  application_id               = azuread_application.app-api.application_id
  app_role_assignment_required = false
  owners                       = [data.azuread_client_config.default.object_id]
}

Azure AD API App Service Principal Secret

resource "azuread_application_password" "api-app-sp-secret" {
  application_object_id = azuread_application.app-api.object_id
}

My Terraform Service Principal Application already has been assigned the required permissions in Azure AD as shown in the attachment

user_15969334 · Answer

When i tried with your above code as a normal user was getting the same error(as i didn't know i should require a priviledge of Application Administator Or Global AdminStrator Role in my tenant.

Once I got the above one of roles and adminsitator permission so then able to run the code.

Also you need to Remove this statement from your code.

 data "azuread_service_principal" "msgraph" {
      application_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
    }

Terraform Code:

# Configure the Azure Active Directory Provider
provider "azuread" {
  
}

data "azuread_client_config" "current" {}

data "azuread_application_published_app_ids" "well_known" {}

resource "azuread_service_principal" "msgraph" {
  application_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
  use_existing = true
}


resource "azuread_application" "app-api" {
  display_name = "example3724"
  owners       = [data.azuread_client_config.current.object_id]
  

  api {
     oauth2_permission_scope {
      admin_consent_description  = "Allow the application to access example on behalf of the signed-in user."
      admin_consent_display_name = "Access example"
      enabled                    = true
      id                         = "96183846-204b-4b43-82e1-5d2222eb4b9b"
      type                       = "User"
      user_consent_description   = "Allow the application to access example on your behalf."
      user_consent_display_name  = "Access example"
      value                      = "user_impersonation"
    }
  }

  app_role {
    allowed_member_types = ["User", "Application"]
    description          = "Admins can manage roles and perform all task actions"
    display_name         = "Admin"
    enabled              = true
    id                   = data.azuread_client_config.current.object_id
    value                = "application-administrator"
  }

  web {
    homepage_url  = "https://app.example.net"
    logout_url    = "https://app.example.net/logout"
    redirect_uris = ["https://app.example.net/account"]

    implicit_grant {
      access_token_issuance_enabled = true
      id_token_issuance_enabled     = true
    }
  }

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph # Microsoft Graph

   

     resource_access {
          id   = azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
          type = "Role"
        }
    
        resource_access {
          id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.ReadWrite"]# User.Read.All
          type = "Scope"
        }
      }
    }

OutPut--

Error while trying to do App Registration using Terraform Azure AD Provider 2.0

Azure AD API Service Principal Resource

Azure AD API App Service Principal Secret

1 Answers