You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
resource"azuread_custom_directory_role""iam" {
display_name="My Directory Role"description="My Directory Role"enabled=trueversion="1.0"permissions {
allowed_resource_actions=[
"microsoft.directory/applications/basic/update",
"microsoft.directory/applications/create",
"microsoft.directory/applications/standard/read",
]
}
}
resource"azuread_directory_role_eligibility_schedule_request""iam" {
role_definition_id=azuread_custom_directory_role.iam.object_id# principal id (you would need to source one in your own Entra)principal_id="3ed50089-5811-4504-a7c3-d04d64047eb7"directory_scope_id="/"justification="create eligibility schedule request"
}
Debug Output
Panic Output
Expected Behavior
The eligibility role assignment is created
Actual Behavior
The custom role isn't found and the following error fails
Error: Eligibility schedule request for role "1d13bcc2-3044-42df-ac26-0ef2b1b762de" to principal "3ed50089-5811-4504-a7c3-d04d64047eb7", received 404 with error: RoleEligibilityScheduleRequestClient.BaseClient.Post(): unexpected status 404 with OData error: RoleNotFound: The role is not found.
│
│ with azuread_directory_role_eligibility_schedule_request.iam,
│ on directory_role_assignment.tf line 18, in resource "azuread_directory_role_eligibility_schedule_request" "iam":
│ 18: resource "azuread_directory_role_eligibility_schedule_request" "iam" {
│
│ RoleEligibilityScheduleRequestClient.BaseClient.Post(): unexpected status 404 with OData error: RoleNotFound: The role is not found.
Steps to Reproduce
terraform apply
Important Factoids
I have tried adding a wait provisioner to the custom directory role creation
resource "azuread_custom_directory_role" "iam" {
display_name = "My Directory Role"
description = "My Directory Role"
enabled = true
version = "1.0"
permissions {
allowed_resource_actions = [
"microsoft.directory/applications/basic/update",
"microsoft.directory/applications/create",
"microsoft.directory/applications/standard/read",
]
}
# wait 10 minutes for role to be ready
provisioner "local-exec" {
command = "Start-Sleep 600"
interpreter = ["pwsh", "-Command"]
}
}
References
#0000
The text was updated successfully, but these errors were encountered:
Does the same thing happen if you only include the custom role in the initial apply, then add in the azuread_directory_role_eligibility_schedule_request afterwards?
I am now getting a few other issues with the same configuration on every single apply (so initial and adding afterwards):
azuread_directory_role_eligibility_schedule_request using a azuread_custom_directory_role will always force replace the current eligibility assignment. Looks like the role_definition_id keeps changing when using template_id or object_id.
azuread_directory_role_assignment using a azuread_directory_role is always wanting to create a new resource even if it has been imported. When running apply it will error stating a resource already exists.
Working:
azuread_directory_role_assignment using a azuread_custom_directory_role - working as expected and using template_id.
azuread_directory_role_eligibility_schedule_request using a azuread_directory_role - working as expected.
azurerm has some similar issues as well.
azurerm_pim_eligible_role_assignment using a azurerm_role_definition against a azurerm_subscriptions is always wanting to create a new resource even if it has been imported. When running apply it will error stating a resource already exists.
azurerm_pim_eligible_role_assignment using a azurerm_role_definition against a azurerm_management_group
I have imported with the same resource names, no change.
Community Note
Terraform (and AzureAD Provider) Version
Affected Resource(s)
azuread_directory_role_eligibility_schedule_request
Terraform Configuration Files
Debug Output
Panic Output
Expected Behavior
The eligibility role assignment is created
Actual Behavior
The custom role isn't found and the following error fails
Steps to Reproduce
terraform apply
Important Factoids
I have tried adding a wait provisioner to the custom directory role creation
References
The text was updated successfully, but these errors were encountered: