azurerm_azuread_application fails with error 403: Authorization_RequestDenied

[lordgordon]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7
+ provider.azurerm v1.9.0

Affected Resource(s)

• azurerm_azuread_application

Terraform Configuration Files

resource "azurerm_azuread_application" "test" {
  name                       = "test"
  homepage                   = "https://myendpoint.com"
  available_to_other_tenants = false
  oauth2_allow_implicit_flow = false
}

Expected Behavior

Being able to create the resource.

Actual Behavior

Azure returns the following error:

* azurerm_azuread_application.test: 
graphrbac.ApplicationsClient#Create: Failure responding to request: StatusCode=403 -- 
Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" 
Message="Unknown service error" Details=[{"odata.error":
{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient 
privileges to complete the operation."}}}]

Important Factoids

I have only one subscription and I'm authenticated with az login --service-principal with an user having owner role to the main subscription. The Terraform app has "owner" role itself on the mian subscription.

[lordgordon]

My fault, I was not using a Service Principal login.

[kautsig]

I stumbled into exactly that when testing the #1564 branch.

I'm using a SP which is subscription owner. It seems to me that, despite being owner, that the SP can't the azurerm_azuread_application, because of missing permissions.

[tombuildsstuff]

hi @lordgordon

Thanks for opening this issue

I have only one subscription and I'm authenticated with az login --service-principal with an user having owner role to the main subscription. The Terraform app has "owner" role itself on the mian subscription.

Terraform doesn't support authenticating using a Service Principal via the Azure CLI; you need to instead specify the credentials either through Environment Variables or in the Provider block.

In addition as listed on the azurerm_azuread_application page - the Service Principal being used needs to have the appropriate permissions to Azure Active Directory (which is unrelated to the Azure Subscription):

NOTE: If you're authenticating using a Service Principal then it must have permissions to both Read and write all applications and Sign in and read user profile within the Windows Azure Active Directory API.

If you update the permissions on this Service Principal then it should be possible to create applications :)

Thanks!

[kautsig]

Thanks @tombuildsstuff!

I guess that answers my question as well. Apologies for not checking the manual first.

[jabba2324]

For anyone finding this issue now, you need to grant these permissions to the legacy active directory graph API not the new one.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!