Azure AD - Scoped Assignments for Custom Azure AD roles

[dpowley]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

We would like to see the provider support the ability to assign custom directory roles to a specific scope (i.e. application) instead of assigning the role with the entire directory as a scope.

See https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-create#assign-a-custom-role-scoped-to-a-resource as to what I'm talking about.

New or Affected Resource(s)

• azuread_directory_role_assignment

Potential Terraform Configuration

resource "azuread_app_role_assignment" "example" {
  directory_role_id    = azuread_custom_directory_role.example.object_id
  principal_object_id  = azuread_user.example.object_id
  resource_object_id   = azuread_service_principal.example.object_id
}

References

• #0000

[timothyleung1]

Thinking about working on something like azuread_custom_directory_role_member. Is this request asking for the same thing, but for service principal?

Looks pretty similar to azuread_directory_role_member

I think this could be supported by msgraph and the implementation should be very similar to ce67563

[manicminer]

Hi @timothyleung1, you're welcome to take a look at this. I would prefer to use the existing azuread_directory_role_member resource to avoid resource proliferation and confusion, though that needs some investigation to see if it's feasible. The SDK supports the unified role management endpoints (see https://github.com/manicminer/hamilton/blob/main/msgraph/role_definitions.go and https://github.com/manicminer/hamilton/blob/main/msgraph/role_assignments.go) and this should allow us to manage assignments/memberships at the tenant level (as we do currently for built-in roles) and at all levels for custom roles.

[github-actions]

This functionality has been released in v2.25.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.