How to realistically use azuread_invitation?

[timon-michel-scopevisio]

I'm currently trying to implement the "azuread_invitation" resource to invite a user if it not already exists.

I managed to get it working like this:

locals {
  external_users: ["[email protected]"]
}

data "azuread_users" "all" {
  return_all = true
}

resource "azuread_invitation" "guests" {
  for_each = {
    for username in local.external_users:
        username => username
    if !contains(data.azuread_users.all.users.*.mail, username)
  }

  user_email_address = each.key
  redirect_url       = "https://example.com"
}

This way if the specified user in locals.external_users is not found in AD, an invitation is created. If i, however run another time without changing the code, it tries to delete the user as it is now invited into the organization.
If i delete the "invitation" using terraform, it deletes the whole user instead:

terraform-provider-azuread/internal/services/invitations/invitation_resource.go

Line 233 in bf65f5d

return tf.ErrorDiagPathF(err, "id", "Deleting invited user with object ID %q, got status %d with error: %+v", userID, status, err)

I understand that the "invitations" endpoint of MS Graph is POST-Only so there is no real way to "delete" an invitation. But deleting the whole user instead is not what i expected. How can i create an invitation without deleting the freshly invited user afterwards?

There is probably no ideal solution to this as Microsoft will probably not change their API for this - so is there any workaround? I would be fine with Terraform just making the invitation a "submit-and-forget".

[manicminer]

Hi @timon-michel-scopevisio, thanks for raising this. We understand the implementation of the azuread_invitation resource is limiting and we have plans to improve this by incorporating invite functionality into the azuread_user resource instead. This should allow for more robust user maangement - guest, member, invited, or homed - or a combination of these!

Whilst there is no specific ETA at this time, this is on our roadmap and is being tracked in #650.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.