diff --git a/examples/managed-application/application-with-parameter_values/main.tf b/examples/managed-application/application-with-parameter_values/main.tf
new file mode 100644
index 000000000000..28ed5674a78e
--- /dev/null
+++ b/examples/managed-application/application-with-parameter_values/main.tf
@@ -0,0 +1,129 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+provider "azurerm" {
+  features {}
+}
+
+data "azurerm_client_config" "current" {}
+
+data "azurerm_role_definition" "builtin" {
+  name = "Contributor"
+}
+
+resource "azurerm_resource_group" "example" {
+  name     = "${var.prefix}-resources"
+  location = var.location
+}
+
+resource "azurerm_managed_application_definition" "example" {
+  name                = "${var.prefix}managedappdef"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  lock_level          = "ReadOnly"
+  display_name        = "ExampleManagedAppDefinition"
+  description         = "Example Managed App Definition"
+  package_enabled     = true
+
+  create_ui_definition = <<CREATE_UI_DEFINITION
+    {
+      "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+      "handler": "Microsoft.Azure.CreateUIDef",
+      "version": "0.1.2-preview",
+      "parameters": {
+         "basics": [],
+         "steps": [],
+         "outputs": {}
+      }
+    }
+  CREATE_UI_DEFINITION
+
+  main_template = <<MAIN_TEMPLATE
+    {
+      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+      "contentVersion": "1.0.0.0",
+      "parameters": {
+         "boolParameter": {
+            "type": "bool"
+         },
+         "intParameter": {
+            "type": "int"
+         },
+         "stringParameter": {
+            "type": "string"
+         },
+         "secureStringParameter": {
+            "type": "secureString"
+         },
+         "objectParameter": {
+            "type": "object"
+         }
+      },
+      "variables": {},
+      "resources": [],
+      "outputs": {
+        "boolOutput": {
+          "type": "bool",
+          "value": true
+        },
+        "intOutput": {
+          "type": "int",
+          "value": 100
+        },
+        "stringOutput": {
+          "type": "string",
+          "value": "stringOutputValue"
+        },
+        "objectOutput": {
+          "type": "object",
+          "value": {
+            "nested_bool": true,
+            "nested_array": ["value_1", "value_2"],
+            "nested_object": {
+              "key_0": 0
+            }
+          }
+        }
+      }
+    }
+  MAIN_TEMPLATE
+
+  authorization {
+    service_principal_id = data.azurerm_client_config.current.object_id
+    role_definition_id   = split("/", data.azurerm_role_definition.builtin.id)[length(split("/", data.azurerm_role_definition.builtin.id)) - 1]
+  }
+}
+
+
+resource "azurerm_managed_application" "test" {
+  name                        = "${var.prefix}managedapp"
+  location                    = azurerm_resource_group.example.location
+  resource_group_name         = azurerm_resource_group.example.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "${var.prefix}infraGroup"
+  application_definition_id   = azurerm_managed_application_definition.example.id
+
+  parameter_values = jsonencode({
+    boolParameter = {
+      value = true
+    },
+    intParameter = {
+      value = 100
+    },
+    stringParameter = {
+      value = "value_1"
+    },
+    secureStringParameter = {
+      value = "secure_value_1"
+    },
+    objectParameter = {
+      value = {
+        nested_bool  = true
+        nested_array = ["value_1", "value_2"]
+        nested_object = {
+          key_0 = 0
+        }
+      }
+    }
+  })
+}
diff --git a/examples/managed-application/application-with-parameter_values/variables.tf b/examples/managed-application/application-with-parameter_values/variables.tf
new file mode 100644
index 000000000000..4871f3553dbd
--- /dev/null
+++ b/examples/managed-application/application-with-parameter_values/variables.tf
@@ -0,0 +1,10 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+variable "location" {
+  description = "The Azure location where all resources in this example should be created."
+}
+
+variable "prefix" {
+  description = "The prefix used for all resources used by this Managed Application Definition"
+}
diff --git a/examples/managed-application/application-with-parameters/main.tf b/examples/managed-application/application-with-parameters/main.tf
new file mode 100644
index 000000000000..dc9ab51ff2a3
--- /dev/null
+++ b/examples/managed-application/application-with-parameters/main.tf
@@ -0,0 +1,101 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+provider "azurerm" {
+  features {}
+}
+
+data "azurerm_client_config" "current" {}
+
+data "azurerm_role_definition" "builtin" {
+  name = "Contributor"
+}
+
+resource "azurerm_resource_group" "example" {
+  name     = "${var.prefix}-resources"
+  location = var.location
+}
+
+resource "azurerm_managed_application_definition" "example" {
+  name                = "${var.prefix}managedappdef"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  lock_level          = "ReadOnly"
+  display_name        = "ExampleManagedAppDefinition"
+  description         = "Example Managed App Definition"
+  package_enabled     = true
+
+  create_ui_definition = <<CREATE_UI_DEFINITION
+    {
+      "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+      "handler": "Microsoft.Azure.CreateUIDef",
+      "version": "0.1.2-preview",
+      "parameters": {
+         "basics": [],
+         "steps": [],
+         "outputs": {}
+      }
+    }
+  CREATE_UI_DEFINITION
+
+  main_template = <<MAIN_TEMPLATE
+    {
+      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+      "contentVersion": "1.0.0.0",
+      "parameters": {
+         "stringParameter": {
+            "type": "string"
+         },
+         "secureStringParameter": {
+            "type": "secureString"
+         }
+      },
+      "variables": {},
+      "resources": [],
+      "outputs": {
+        "boolOutput": {
+          "type": "bool",
+          "value": true
+        },
+        "intOutput": {
+          "type": "int",
+          "value": 100
+        },
+        "stringOutput": {
+          "type": "string",
+          "value": "stringOutputValue"
+        },
+        "objectOutput": {
+          "type": "object",
+          "value": {
+            "nested_bool": true,
+            "nested_array": ["value_1", "value_2"],
+            "nested_object": {
+              "key_0": 0
+            }
+          }
+        }
+      }
+    }
+  MAIN_TEMPLATE
+
+  authorization {
+    service_principal_id = data.azurerm_client_config.current.object_id
+    role_definition_id   = split("/", data.azurerm_role_definition.builtin.id)[length(split("/", data.azurerm_role_definition.builtin.id)) - 1]
+  }
+}
+
+
+resource "azurerm_managed_application" "test" {
+  name                        = "${var.prefix}managedapp"
+  location                    = azurerm_resource_group.example.location
+  resource_group_name         = azurerm_resource_group.example.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "${var.prefix}infraGroup"
+  application_definition_id   = azurerm_managed_application_definition.example.id
+
+  parameters = {
+    stringParameter       = "value_1"
+    secureStringParameter = "secure_value_1"g
+  }
+}
diff --git a/examples/managed-application/application-with-parameters/variables.tf b/examples/managed-application/application-with-parameters/variables.tf
new file mode 100644
index 000000000000..4871f3553dbd
--- /dev/null
+++ b/examples/managed-application/application-with-parameters/variables.tf
@@ -0,0 +1,10 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+variable "location" {
+  description = "The Azure location where all resources in this example should be created."
+}
+
+variable "prefix" {
+  description = "The prefix used for all resources used by this Managed Application Definition"
+}
diff --git a/internal/services/managedapplications/managed_application_resource.go b/internal/services/managedapplications/managed_application_resource.go
index 568b6b6971af..24b8041ea5be 100644
--- a/internal/services/managedapplications/managed_application_resource.go
+++ b/internal/services/managedapplications/managed_application_resource.go
@@ -98,32 +98,38 @@ func resourceManagedApplication() *pluginsdk.Resource {
 			"plan": {
 				Type:     pluginsdk.TypeList,
 				Optional: true,
+				ForceNew: true,
 				MaxItems: 1,
 				Elem: &pluginsdk.Resource{
 					Schema: map[string]*pluginsdk.Schema{
 						"name": {
 							Type:         pluginsdk.TypeString,
 							Required:     true,
+							ForceNew:     true,
 							ValidateFunc: validation.StringIsNotEmpty,
 						},
 						"product": {
 							Type:         pluginsdk.TypeString,
 							Required:     true,
+							ForceNew:     true,
 							ValidateFunc: validation.StringIsNotEmpty,
 						},
 						"publisher": {
 							Type:         pluginsdk.TypeString,
 							Required:     true,
+							ForceNew:     true,
 							ValidateFunc: validation.StringIsNotEmpty,
 						},
 						"version": {
 							Type:         pluginsdk.TypeString,
 							Required:     true,
+							ForceNew:     true,
 							ValidateFunc: validation.StringIsNotEmpty,
 						},
 						"promotion_code": {
 							Type:         pluginsdk.TypeString,
 							Optional:     true,
+							ForceNew:     true,
 							ValidateFunc: validation.StringIsNotEmpty,
 						},
 					},
@@ -240,13 +246,18 @@ func resourceManagedApplicationRead(d *pluginsdk.ResourceData, meta interface{})
 		d.Set("managed_resource_group_name", id.ResourceGroup)
 		d.Set("application_definition_id", p.ApplicationDefinitionId)
 
-		parameterValues, err := flattenManagedApplicationParameterValuesValueToString(p.Parameters)
+		expendedParams, err := expandManagedApplicationParameters(d)
+		if err != nil {
+			return fmt.Errorf("expanding `parameters` or `parameter_values`: %+v", err)
+		}
+
+		parameterValues, err := flattenManagedApplicationParameterValuesValueToString(p.Parameters, *expendedParams)
 		if err != nil {
 			return fmt.Errorf("serializing JSON from `parameter_values`: %+v", err)
 		}
 		d.Set("parameter_values", parameterValues)
 
-		parameters, err := flattenManagedApplicationParametersOrOutputs(p.Parameters)
+		parameters, err := flattenManagedApplicationParameters(p.Parameters, *expendedParams)
 		if err != nil {
 			return err
 		}
@@ -254,7 +265,7 @@ func resourceManagedApplicationRead(d *pluginsdk.ResourceData, meta interface{})
 			return err
 		}
 
-		outputs, err := flattenManagedApplicationParametersOrOutputs(p.Outputs)
+		outputs, err := flattenManagedApplicationOutputs(p.Outputs)
 		if err != nil {
 			return err
 		}
@@ -311,14 +322,15 @@ func expandManagedApplicationParameters(d *pluginsdk.ResourceData) (*map[string]
 		}
 	}
 
-	if v, ok := d.GetOk("parameters"); ok {
-		params := v.(map[string]interface{})
+	// `parameters` will be available in state as well after first apply when `parameter_values` is used, so getting its value only during creation or when it is changed
+	if d.IsNewResource() || d.HasChange("parameters") {
+		if v, ok := d.GetOk("parameters"); ok {
+			params := v.(map[string]interface{})
 
-		for key, val := range params {
-			newParams[key] = struct {
-				Value interface{} `json:"value"`
-			}{
-				Value: val,
+			for key, val := range params {
+				newParamValue := make(map[string]interface{}, 1)
+				newParamValue["value"] = val
+				newParams[key] = newParamValue
 			}
 		}
 	}
@@ -343,7 +355,7 @@ func flattenManagedApplicationPlan(input *applications.Plan) []interface{} {
 	return results
 }
 
-func flattenManagedApplicationParametersOrOutputs(input *interface{}) (map[string]interface{}, error) {
+func flattenManagedApplicationParameters(input *interface{}, localParameters map[string]interface{}) (map[string]interface{}, error) {
 	results := make(map[string]interface{})
 	if input == nil {
 		return results, nil
@@ -354,29 +366,56 @@ func flattenManagedApplicationParametersOrOutputs(input *interface{}) (map[strin
 		for k, val := range attrs.(map[string]interface{}) {
 			mapVal, ok := val.(map[string]interface{})
 			if !ok {
-				return nil, fmt.Errorf("unexpected managed application parameter or output type: %+v", mapVal)
+				return nil, fmt.Errorf("unexpected managed application parameter type: %+v", mapVal)
 			}
 			if mapVal != nil {
 				v, ok := mapVal["value"]
 				if !ok {
-					return nil, fmt.Errorf("missing key 'value' in parameters or output map %+v", mapVal)
-				}
-				switch t := v.(type) {
-				case float64:
-					results[k] = v.(float64)
-				case string:
-					results[k] = v.(string)
-				case map[string]interface{}:
-					// Azure NVA managed applications read call returns empty map[string]interface{} parameter 'tags'
-					// Do not return an error if the parameter is unsupported type, but is empty
-					if len(v.(map[string]interface{})) == 0 {
-						log.Printf("parameter '%s' is unexpected type %T, but we're ignoring it because of the empty value", k, t)
-					} else {
-						return nil, fmt.Errorf("unexpected parameter type %T", t)
+					// Secure values are not returned, thus settings it with local value
+					v = ""
+					if oldValueStruct, oldValueStructOK := localParameters[k]; oldValueStructOK {
+						if oldValue, oldValueOK := oldValueStruct.(map[string]interface{})["value"]; oldValueOK {
+							v = oldValue
+						}
 					}
-				default:
-					return nil, fmt.Errorf("unexpected parameter type %T", t)
 				}
+
+				value, err := extractParameterOrOutputValue(v)
+				if err != nil {
+					return nil, fmt.Errorf("extracting parameters: %+v", err)
+				}
+				results[k] = value
+			}
+		}
+	}
+
+	return results, nil
+}
+
+func flattenManagedApplicationOutputs(input *interface{}) (map[string]interface{}, error) {
+	results := make(map[string]interface{})
+	if input == nil {
+		return results, nil
+	}
+
+	attrs := *input
+	if _, ok := attrs.(map[string]interface{}); ok {
+		for k, val := range attrs.(map[string]interface{}) {
+			mapVal, ok := val.(map[string]interface{})
+			if !ok {
+				return nil, fmt.Errorf("unexpected managed application output type: %+v", mapVal)
+			}
+			if mapVal != nil {
+				v, ok := mapVal["value"]
+				if !ok {
+					return nil, fmt.Errorf("missing key 'value' in output map %+v", mapVal)
+				}
+
+				value, err := extractParameterOrOutputValue(v)
+				if err != nil {
+					return nil, fmt.Errorf("extracting outputs: %+v", err)
+				}
+				results[k] = value
 			}
 		}
 	}
@@ -384,7 +423,7 @@ func flattenManagedApplicationParametersOrOutputs(input *interface{}) (map[strin
 	return results, nil
 }
 
-func flattenManagedApplicationParameterValuesValueToString(input *interface{}) (string, error) {
+func flattenManagedApplicationParameterValuesValueToString(input *interface{}, localParameters map[string]interface{}) (string, error) {
 	if input == nil {
 		return "", nil
 	}
@@ -394,21 +433,51 @@ func flattenManagedApplicationParameterValuesValueToString(input *interface{}) (
 		for k, v := range attrs.(map[string]interface{}) {
 			if v != nil {
 				delete(attrs.(map[string]interface{})[k].(map[string]interface{}), "type")
+
+				// Secure values are not returned, thus settings it with local value
+				value := attrs.(map[string]interface{})[k].(map[string]interface{})
+				if _, ok := value["value"]; !ok {
+					value["value"] = ""
+					if localParam, localParamOK := localParameters[k]; localParamOK {
+						if localParamValue, localParamValueOK := localParam.(map[string]interface{})["value"]; localParamValueOK {
+							value["value"] = localParamValue
+						}
+					}
+				}
 			}
 		}
 
-		result, err := json.Marshal(input)
-		if err != nil {
-			return "", err
-		}
+		return compactParameterOrOutputValue(input)
+	}
 
-		compactJson := bytes.Buffer{}
-		if err := json.Compact(&compactJson, result); err != nil {
-			return "", err
-		}
+	return "", nil
+}
 
-		return compactJson.String(), nil
+func extractParameterOrOutputValue(v interface{}) (string, error) {
+	switch t := v.(type) {
+	case bool:
+		return fmt.Sprintf("%t", v.(bool)), nil
+	case float64:
+		// use precision 0 since this comes from an int
+		return fmt.Sprintf("%.f", v.(float64)), nil
+	case string:
+		return v.(string), nil
+	case map[string]interface{}:
+		return compactParameterOrOutputValue(v)
+	default:
+		return "", fmt.Errorf("unexpected type %T", t)
 	}
+}
 
-	return "", nil
+func compactParameterOrOutputValue(v interface{}) (string, error) {
+	result, err := json.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+
+	compactJson := bytes.Buffer{}
+	if err = json.Compact(&compactJson, result); err != nil {
+		return "", err
+	}
+	return compactJson.String(), nil
 }
diff --git a/internal/services/managedapplications/managed_application_resource_test.go b/internal/services/managedapplications/managed_application_resource_test.go
index 92c531a1ae5d..d6871404f175 100644
--- a/internal/services/managedapplications/managed_application_resource_test.go
+++ b/internal/services/managedapplications/managed_application_resource_test.go
@@ -7,9 +7,12 @@ import (
 	"context"
 	"fmt"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/go-azure-helpers/lang/pointer"
+	"github.com/hashicorp/go-azure-helpers/lang/response"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/managedapplications/2021-07-01/applications"
+	"github.com/hashicorp/go-azure-sdk/resource-manager/marketplaceordering/2015-06-01/agreements"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance/check"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
@@ -27,6 +30,10 @@ func TestAccManagedApplication_basic(t *testing.T) {
 			Config: r.basic(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("outputs.boolOutput").HasValue("true"),
+				check.That(data.ResourceName).Key("outputs.intOutput").HasValue("100"),
+				check.That(data.ResourceName).Key("outputs.objectOutput").HasValue("{\"nested_array\":[\"value_1\",\"value_2\"],\"nested_bool\":true,\"nested_object\":{\"key_0\":0}}"),
+				check.That(data.ResourceName).Key("outputs.stringOutput").HasValue("stringOutputValue"),
 			),
 		},
 		data.ImportStep(),
@@ -48,34 +55,49 @@ func TestAccManagedApplication_requiresImport(t *testing.T) {
 	})
 }
 
-func TestAccManagedApplication_sequential(t *testing.T) {
-	testCases := map[string]map[string]func(t *testing.T){
-		"Resource": {
-			"complete": testAccManagedApplication_complete,
-			"update":   testAccManagedApplication_update,
-		},
-	}
+func TestAccManagedApplication_switchBetweenParametersAndParameterValues(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
+	r := ManagedApplicationResource{}
 
-	for group, m := range testCases {
-		m := m
-		t.Run(group, func(t *testing.T) {
-			for name, tc := range m {
-				tc := tc
-				t.Run(name, func(t *testing.T) {
-					tc(t)
-				})
-			}
-		})
-	}
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.basic(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.parameterValues(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.basic(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
+	})
 }
 
-func testAccManagedApplication_complete(t *testing.T) {
+func TestAccManagedApplication_parameters(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
 	r := ManagedApplicationResource{}
 
-	data.ResourceSequentialTest(t, r, []acceptance.TestStep{
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.basic(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
 		{
-			Config: r.complete(data),
+			Config: r.basicWithParametersUpdated(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
 			),
@@ -84,80 +106,111 @@ func testAccManagedApplication_complete(t *testing.T) {
 	})
 }
 
-func testAccManagedApplication_update(t *testing.T) {
+func TestAccManagedApplication_parameterValues(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
 	r := ManagedApplicationResource{}
 
-	data.ResourceSequentialTest(t, r, []acceptance.TestStep{
+	data.ResourceTest(t, r, []acceptance.TestStep{
 		{
-			Config: r.basic(data),
+			Config: r.parameterValues(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
-				check.That(data.ResourceName).Key("kind").HasValue("ServiceCatalog"),
 			),
 		},
 		data.ImportStep(),
 		{
-			Config: r.complete(data),
+			Config: r.parameterValuesUpdated(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
-				check.That(data.ResourceName).Key("kind").HasValue("MarketPlace"),
 			),
 		},
 		data.ImportStep(),
+	})
+}
+
+func TestAccManagedApplication_allSupportedParameterValuesTypes(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
+	r := ManagedApplicationResource{}
+
+	data.ResourceTest(t, r, []acceptance.TestStep{
 		{
-			Config: r.basic(data),
+			Config: r.allSupportedParameterValuesTypes(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
-				check.That(data.ResourceName).Key("kind").HasValue("ServiceCatalog"),
 			),
 		},
 		data.ImportStep(),
 	})
 }
 
-func TestAccManagedApplication_updateParameters(t *testing.T) {
+func TestAccManagedApplication_parametersSecureString(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
 	r := ManagedApplicationResource{}
 
 	data.ResourceTest(t, r, []acceptance.TestStep{
 		{
-			Config: r.basic(data),
+			Config: r.parametersSecureString(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
-				check.That(data.ResourceName).Key("parameters.%").HasValue("3"),
-				check.That(data.ResourceName).Key("parameter_values").Exists(),
 			),
 		},
-		data.ImportStep(),
+		data.ImportStep("parameters.secureStringParameter", "parameter_values"),
+	})
+}
+
+func TestAccManagedApplication_parameterValuesSecureString(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
+	r := ManagedApplicationResource{}
+
+	data.ResourceTest(t, r, []acceptance.TestStep{
 		{
-			Config: r.parameterValues(data),
+			Config: r.parameterValuesSecureString(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
-				check.That(data.ResourceName).Key("parameters.%").Exists(),
-				check.That(data.ResourceName).Key("parameter_values").Exists(),
 			),
 		},
-		data.ImportStep(),
+		data.ImportStep("parameters.secureStringParameter", "parameter_values"),
+	})
+}
+
+func TestAccManagedApplication_plan(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
+	r := ManagedApplicationResource{}
+	publisher := "cisco"
+	offer := "cisco-meraki-vmx"
+	plan := "cisco-meraki-vmx"
+
+	data.ResourceTest(t, r, []acceptance.TestStep{
 		{
-			Config: r.basic(data),
+			Config: r.empty(),
+			Check: acceptance.ComposeTestCheckFunc(
+				data.CheckWithClientWithoutResource(r.cancelExistingAgreement(publisher, offer, plan)),
+			),
+		},
+		{
+			Config: r.plan(data, publisher, offer, plan),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
-				check.That(data.ResourceName).Key("parameters.%").HasValue("3"),
-				check.That(data.ResourceName).Key("parameter_values").Exists(),
 			),
 		},
 		data.ImportStep(),
 	})
 }
 
-func TestAccManagedApplication_parameterValues(t *testing.T) {
+func TestAccManagedApplication_tags(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_managed_application", "test")
 	r := ManagedApplicationResource{}
 
 	data.ResourceTest(t, r, []acceptance.TestStep{
 		{
-			Config: r.parameterValues(data),
+			Config: r.tags(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.tagsUpdated(data),
 			Check: acceptance.ComposeTestCheckFunc(
 				check.That(data.ResourceName).ExistsInAzure(r),
 			),
@@ -182,23 +235,42 @@ func (ManagedApplicationResource) Exists(ctx context.Context, clients *clients.C
 
 func (r ManagedApplicationResource) basic(data acceptance.TestData) string {
 	return fmt.Sprintf(`
-%s
+%[1]s
 
 resource "azurerm_managed_application" "test" {
-  name                        = "acctestManagedApp%d"
+  name                        = "acctestManagedApp%[2]d"
   location                    = azurerm_resource_group.test.location
   resource_group_name         = azurerm_resource_group.test.name
   kind                        = "ServiceCatalog"
-  managed_resource_group_name = "infraGroup%d"
+  managed_resource_group_name = "infraGroup%[2]d"
+  application_definition_id   = azurerm_managed_application_definition.test.id
+
+  parameters = {
+    stringParameter       = "value_1"
+    secureStringParameter = ""
+  }
+}
+`, r.templateStringParameter(data), data.RandomInteger)
+}
+
+func (r ManagedApplicationResource) basicWithParametersUpdated(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%[1]s
+
+resource "azurerm_managed_application" "test" {
+  name                        = "acctestManagedApp%[2]d"
+  location                    = azurerm_resource_group.test.location
+  resource_group_name         = azurerm_resource_group.test.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "infraGroup%[2]d"
   application_definition_id   = azurerm_managed_application_definition.test.id
 
   parameters = {
-    location                 = azurerm_resource_group.test.location
-    storageAccountNamePrefix = "store%s"
-    storageAccountType       = "Standard_LRS"
+    stringParameter       = "value_2"
+    secureStringParameter = ""
   }
 }
-`, r.template(data), data.RandomInteger, data.RandomInteger, data.RandomString)
+`, r.templateStringParameter(data), data.RandomInteger)
 }
 
 func (r ManagedApplicationResource) requiresImport(data acceptance.TestData) string {
@@ -215,29 +287,29 @@ resource "azurerm_managed_application" "import" {
 `, r.basic(data), data.RandomInteger)
 }
 
-func (r ManagedApplicationResource) complete(data acceptance.TestData) string {
+func (r ManagedApplicationResource) plan(data acceptance.TestData, publisher string, offer string, plan string) string {
 	return fmt.Sprintf(`
 provider "azurerm" {
   features {}
 }
 
 resource "azurerm_resource_group" "test" {
-  name     = "acctestRG-mapp-%d"
-  location = "%s"
+  name     = "acctestRG-mapp-%[2]d"
+  location = "%[1]s"
 }
 
 resource "azurerm_marketplace_agreement" "test" {
-  publisher = "cisco"
-  offer     = "cisco-meraki-vmx"
-  plan      = "cisco-meraki-vmx"
+  publisher = "%[3]s"
+  offer     = "%[4]s"
+  plan      = "%[5]s"
 }
 
 resource "azurerm_managed_application" "test" {
-  name                        = "acctestCompleteManagedApp%d"
+  name                        = "acctestManagedApp%[2]d"
   location                    = azurerm_resource_group.test.location
   resource_group_name         = azurerm_resource_group.test.name
   kind                        = "MarketPlace"
-  managed_resource_group_name = "completeInfraGroup%d"
+  managed_resource_group_name = "infraGroup%[2]d"
 
   plan {
     name      = azurerm_marketplace_agreement.test.plan
@@ -259,38 +331,238 @@ resource "azurerm_managed_application" "test" {
     virtualNetworkResourceGroup = "acctestVnetRg"
     vmName                      = "acctestVM"
   }
+}
+`, data.Locations.Primary, data.RandomInteger, publisher, offer, plan)
+}
+
+func (r ManagedApplicationResource) parameterValues(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%[1]s
+
+resource "azurerm_managed_application" "test" {
+  name                        = "acctestManagedApp%[2]d"
+  location                    = azurerm_resource_group.test.location
+  resource_group_name         = azurerm_resource_group.test.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "infraGroup%[2]d"
+  application_definition_id   = azurerm_managed_application_definition.test.id
+
+  parameter_values = jsonencode({
+    stringParameter = {
+      value = "value_1_from_parameter_values"
+    },
+    secureStringParameter = {
+      value = ""
+    }
+  })
+}
+`, r.templateStringParameter(data), data.RandomInteger)
+}
+
+func (r ManagedApplicationResource) parameterValuesUpdated(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%[1]s
+
+resource "azurerm_managed_application" "test" {
+  name                        = "acctestManagedApp%[2]d"
+  location                    = azurerm_resource_group.test.location
+  resource_group_name         = azurerm_resource_group.test.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "infraGroup%[2]d"
+  application_definition_id   = azurerm_managed_application_definition.test.id
+
+  parameter_values = jsonencode({
+    stringParameter = {
+      value = "value_1_from_parameter_values_updated"
+    },
+    secureStringParameter = {
+      value = ""
+    }
+  })
+}
+`, r.templateStringParameter(data), data.RandomInteger)
+}
+
+func (r ManagedApplicationResource) allSupportedParameterValuesTypes(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%[1]s
+
+resource "azurerm_managed_application" "test" {
+  name                        = "acctestManagedApp%[2]d"
+  location                    = azurerm_resource_group.test.location
+  resource_group_name         = azurerm_resource_group.test.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "infraGroup%[2]d"
+  application_definition_id   = azurerm_managed_application_definition.test.id
+
+  parameter_values = jsonencode({
+    boolParameter = {
+      value = true
+    },
+    intParameter = {
+      value = 100
+    },
+    stringParameter = {
+      value = "value_1"
+    },
+    secureStringParameter = {
+      value = ""
+    },
+    objectParameter = {
+      value = {
+        nested_bool  = true
+        nested_array = ["value_1", "value_2"]
+        nested_object = {
+          key_0 = 0
+        }
+      }
+    }
+  })
+}
+`, r.templateAllSupportedParametersTypes(data), data.RandomInteger)
+}
+
+func (r ManagedApplicationResource) parametersSecureString(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%[1]s
+
+resource "azurerm_managed_application" "test" {
+  name                        = "acctestManagedApp%[2]d"
+  location                    = azurerm_resource_group.test.location
+  resource_group_name         = azurerm_resource_group.test.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "infraGroup%[2]d"
+  application_definition_id   = azurerm_managed_application_definition.test.id
+
+  parameters = {
+    stringParameter       = "value_1"
+    secureStringParameter = "secure_value_1"
+  }
+}
+`, r.templateStringParameter(data), data.RandomInteger)
+}
+
+func (r ManagedApplicationResource) parameterValuesSecureString(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%[1]s
+
+resource "azurerm_managed_application" "test" {
+  name                        = "acctestManagedApp%[2]d"
+  location                    = azurerm_resource_group.test.location
+  resource_group_name         = azurerm_resource_group.test.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "infraGroup%[2]d"
+  application_definition_id   = azurerm_managed_application_definition.test.id
+
+  parameter_values = jsonencode({
+    boolParameter = {
+      value = true
+    },
+    intParameter = {
+      value = 100
+    },
+    stringParameter = {
+      value = "value_1"
+    },
+    secureStringParameter = {
+      value = "secure_value_1"
+    },
+    objectParameter = {
+      value = {
+        nested_bool  = true
+        nested_array = ["value_1", "value_2"]
+        nested_object = {
+          key_0 = 0
+        }
+      }
+    }
+  })
+}
+`, r.templateAllSupportedParametersTypes(data), data.RandomInteger)
+}
+
+func (r ManagedApplicationResource) tags(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%[1]s
+
+resource "azurerm_managed_application" "test" {
+  name                        = "acctestManagedApp%[2]d"
+  location                    = azurerm_resource_group.test.location
+  resource_group_name         = azurerm_resource_group.test.name
+  kind                        = "ServiceCatalog"
+  managed_resource_group_name = "infraGroup%[2]d"
+  application_definition_id   = azurerm_managed_application_definition.test.id
+
+  parameters = {
+    stringParameter       = "value_1"
+    secureStringParameter = ""
+  }
 
   tags = {
     ENV = "Test"
   }
 }
-`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger)
+`, r.templateStringParameter(data), data.RandomInteger)
 }
 
-func (r ManagedApplicationResource) parameterValues(data acceptance.TestData) string {
+func (r ManagedApplicationResource) tagsUpdated(data acceptance.TestData) string {
 	return fmt.Sprintf(`
-%s
+%[1]s
 
 resource "azurerm_managed_application" "test" {
-  name                        = "acctestManagedApp%d"
+  name                        = "acctestManagedApp%[2]d"
   location                    = azurerm_resource_group.test.location
   resource_group_name         = azurerm_resource_group.test.name
   kind                        = "ServiceCatalog"
-  managed_resource_group_name = "infraGroup%d"
+  managed_resource_group_name = "infraGroup%[2]d"
   application_definition_id   = azurerm_managed_application_definition.test.id
 
-  parameter_values = <<VALUES
-	{
-        "location": {"value": "${azurerm_resource_group.test.location}"},
-        "storageAccountNamePrefix": {"value": "store%s"},
-        "storageAccountType": {"value": "Standard_LRS"}
-	}
-  VALUES
+  parameters = {
+    stringParameter       = "value_1"
+    secureStringParameter = ""
+  }
+
+  tags = {
+    ENV = "Test2"
+  }
+}
+`, r.templateStringParameter(data), data.RandomInteger)
 }
-`, r.template(data), data.RandomInteger, data.RandomInteger, data.RandomString)
+
+func (r ManagedApplicationResource) templateStringParameter(data acceptance.TestData) string {
+	parameters := `
+         "stringParameter": {
+            "type": "string"
+         },
+         "secureStringParameter": {
+            "type": "secureString"
+         }
+`
+	return r.template(data, parameters)
+}
+
+func (r ManagedApplicationResource) templateAllSupportedParametersTypes(data acceptance.TestData) string {
+	parameters := `
+         "boolParameter": {
+            "type": "bool"
+         },
+         "intParameter": {
+            "type": "int"
+         },
+         "stringParameter": {
+            "type": "string"
+         },
+         "secureStringParameter": {
+            "type": "secureString"
+         },
+         "objectParameter": {
+            "type": "object"
+         }
+`
+	return r.template(data, parameters)
 }
 
-func (ManagedApplicationResource) template(data acceptance.TestData) string {
+func (ManagedApplicationResource) template(data acceptance.TestData, parameters string) string {
 	return fmt.Sprintf(`
 provider "azurerm" {
   features {}
@@ -303,24 +575,113 @@ data "azurerm_role_definition" "test" {
 }
 
 resource "azurerm_resource_group" "test" {
-  name     = "acctestRG-mapp-%d"
-  location = "%s"
+  name     = "acctestRG-mapp-%[2]d"
+  location = "%[1]s"
 }
 
 resource "azurerm_managed_application_definition" "test" {
-  name                = "acctestManagedAppDef%d"
+  name                = "acctestManagedAppDef%[2]d"
   location            = azurerm_resource_group.test.location
   resource_group_name = azurerm_resource_group.test.name
   lock_level          = "ReadOnly"
-  package_file_uri    = "https://github.com/Azure/azure-managedapp-samples/raw/master/Managed Application Sample Packages/201-managed-storage-account/managedstorage.zip"
   display_name        = "TestManagedAppDefinition"
   description         = "Test Managed App Definition"
   package_enabled     = true
 
+  create_ui_definition = <<CREATE_UI_DEFINITION
+    {
+      "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+      "handler": "Microsoft.Azure.CreateUIDef",
+      "version": "0.1.2-preview",
+      "parameters": {
+         "basics": [],
+         "steps": [],
+         "outputs": {}
+      }
+    }
+  CREATE_UI_DEFINITION
+
+  main_template = <<MAIN_TEMPLATE
+    {
+      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+      "contentVersion": "1.0.0.0",
+      "parameters": {
+%[3]s
+      },
+      "variables": {},
+      "resources": [],
+      "outputs": {
+        "boolOutput": {
+          "type": "bool",
+          "value": true
+        },
+        "intOutput": {
+          "type": "int",
+          "value": 100
+        },
+        "stringOutput": {
+          "type": "string",
+          "value": "stringOutputValue"
+        },
+        "objectOutput": {
+          "type": "object",
+          "value": {
+            "nested_bool": true,
+            "nested_array": ["value_1", "value_2"],
+            "nested_object": {
+              "key_0": 0
+            }
+          }
+        }
+      }
+    }
+  MAIN_TEMPLATE
+
   authorization {
     service_principal_id = data.azurerm_client_config.test.object_id
     role_definition_id   = split("/", data.azurerm_role_definition.test.id)[length(split("/", data.azurerm_role_definition.test.id)) - 1]
   }
 }
-`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
+`, data.Locations.Primary, data.RandomInteger, parameters)
+}
+
+func (ManagedApplicationResource) empty() string {
+	return `
+provider "azurerm" {
+  features {}
+}
+`
+}
+
+func (ManagedApplicationResource) cancelExistingAgreement(publisher string, offer string, plan string) acceptance.ClientCheckFunc {
+	return func(ctx context.Context, clients *clients.Client, state *pluginsdk.InstanceState) error {
+		client := clients.Compute.MarketplaceAgreementsClient
+		subscriptionId := clients.Account.SubscriptionId
+		ctx, cancel := context.WithDeadline(ctx, time.Now().Add(15*time.Minute))
+		defer cancel()
+
+		idGet := agreements.NewOfferPlanID(subscriptionId, publisher, offer, plan)
+		idCancel := agreements.NewPlanID(subscriptionId, publisher, offer, plan)
+
+		existing, err := client.MarketplaceAgreementsGet(ctx, idGet)
+		if err != nil {
+			return err
+		}
+
+		if model := existing.Model; model != nil {
+			if props := model.Properties; props != nil {
+				if accepted := props.Accepted; accepted != nil && *accepted {
+					resp, err := client.MarketplaceAgreementsCancel(ctx, idCancel)
+					if err != nil {
+						if response.WasNotFound(resp.HttpResponse) {
+							return fmt.Errorf("marketplace agreement %q does not exist", idGet)
+						}
+						return fmt.Errorf("canceling %s: %+v", idGet, err)
+					}
+				}
+			}
+		}
+
+		return nil
+	}
 }
diff --git a/website/docs/r/managed_application.html.markdown b/website/docs/r/managed_application.html.markdown
index 7cecccf8ea0d..eea733038922 100644
--- a/website/docs/r/managed_application.html.markdown
+++ b/website/docs/r/managed_application.html.markdown
@@ -77,9 +77,11 @@ The following arguments are supported:
 
 * `parameters` - (Optional) A mapping of name and value pairs to pass to the managed application as parameters.
 
+~> **NOTE:** `parameters` only supports values with `string` or `secureString` type. If the template has other parameter types, please use `parameter_values` instead.
+
 * `parameter_values` - (Optional) The parameter values to pass to the Managed Application. This field is a JSON object that allows you to assign parameters to this Managed Application.
 
-* `plan` - (Optional) One `plan` block as defined below.
+* `plan` - (Optional) One `plan` block as defined below. Changing this forces a new resource to be created.
 
 * `tags` - (Optional) A mapping of tags to assign to the resource.
 
@@ -87,15 +89,15 @@ The following arguments are supported:
 
 The `plan` block exports the following:
 
-* `name` - (Required) Specifies the name of the plan from the marketplace.
+* `name` - (Required) Specifies the name of the plan from the marketplace. Changing this forces a new resource to be created.
 
-* `product` - (Required) Specifies the product of the plan from the marketplace.
+* `product` - (Required) Specifies the product of the plan from the marketplace. Changing this forces a new resource to be created.
 
-* `publisher` - (Required) Specifies the publisher of the plan.
+* `publisher` - (Required) Specifies the publisher of the plan. Changing this forces a new resource to be created.
 
-* `version` - (Required) Specifies the version of the plan from the marketplace.
+* `version` - (Required) Specifies the version of the plan from the marketplace. Changing this forces a new resource to be created.
 
-* `promotion_code` - (Optional) Specifies the promotion code to use with the plan.
+* `promotion_code` - (Optional) Specifies the promotion code to use with the plan. Changing this forces a new resource to be created.
 
 ~> **NOTE:** When `plan` is specified, legal terms must be accepted for this item on this subscription before creating the Managed Application. The `azurerm_marketplace_agreement` resource or AZ CLI tool can be used to do this.