Adding Graph API application permission via Terraform shows corrupted IDs instead of scope names

Question

I have made some progress in automation of Enterprise app registration process at my new work using Terraform. However, I am seeing some strange behavior.

When I add Graph API (Application permission) from PORTAL to my Application then I see it like this:

However, when I do the same via Terraform code

# Enterprise Application


resource "azuread_application" "enterprise_app_oidc" {
  display_name = "my-case-app"

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph 

  resource_access {
        id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["AccessReview.Read.All"]
        type = "Role" //Scope or Role
    }

    resource_access {
        id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["Application.Read.All"]
        type = "Role" //Scope or Role
    }
  }
  
}


resource "azuread_service_principal" "enterprise_app_sp_oidc" {
  client_id                     = azuread_application.enterprise_app_oidc.client_id
  owners                        = azuread_application.enterprise_app_oidc.owners
  preferred_single_sign_on_mode = "oidc"
  app_role_assignment_required  = true


  feature_tags {
    enterprise = true
  }

  depends_on = [ azuread_application.enterprise_app_oidc ]

}


## Graph API permissions

resource "azuread_service_principal" "msgraph" {
  client_id    = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph 
  use_existing = true
  
}

data "azuread_application_published_app_ids" "well_known" { 
}

However, with Terraform cide when I go to Portal. It shows like this. And clicking on it shows no details or info.

Answer 1

Adding Graph API application permission via Terraform shows corrupted IDs instead of scope names

Issue seems to be with the way you refer the permission id is not inline with the requirment. As per the terraform configuration for azuread_application we need to refer the id of the role not directly refer from the property.

In order to fetch the required role id follow the command given below

az ad sp list --display-name "Microsoft Graph" --query '[].appRoles[?value==`AccessReview.Read.All` || value==`Application.Read.All`]' -o json | jq

replace the required role name as per the requirement so that it will fetch the properties

configuration:

provider "azurerm" {
  features {}
}

provider "azuread" {
}

data "azuread_client_config" "current" {}

data "azuread_application_published_app_ids" "well_known" {}

output "data_from_well_known" {
  value = data.azuread_application_published_app_ids.well_known.result
}

resource "azuread_service_principal" "msgraph" {
  client_id    = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
  use_existing = true
}

resource "azuread_application" "enterprise_app_oidc" {
  display_name = "demoapp-Ad"
  owners = [data.azuread_client_config.current.object_id]

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph

    resource_access {
      id   = "d07a8cc0-3d51-4b77-b3b0-32704d1f69fa"
       type = "Role"
    }

    resource_access {
      id   = "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30"
      type = "Role"
    }
  }
}