Create Azure AD Application using terraform(Invalid UUID) - azure-devops

Question

I am using terraform to create an Azure AD application, I have tried the default example from the terraform samples https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application also I have customized the code below from the one I created manually(basically, I have created an application manually in AD and got the details from the data resource using terraform for the created application). both the code throws same error
Error: Value must be a valid UUID │ │ with
azuread_application.example, │ on adapp.tf line 3, in resource
"azuread_application" "example": │ 3: resource
"azuread_application" "example" {
This is the code I have customized from the original example
data "azuread_client_config" "current" {}
resource "azuread_application" "example" {
display_name = "example"
identifier_uris = ["api://example-app"]
owners = [data.azuread_client_config.current.object_id]
sign_in_audience = "AzureADMultipleOrgs"
required_resource_access {
resource_app_id = "00000003-0000-0000-c000-000000000000"
resource_access {
id = "..."
type = "Scope"
}
}
web {
redirect_uris = ["https://app.example.net/account"]
implicit_grant {
access_token_issuance_enabled = false
}
}
}
I have validated the "data.azuread_client_config.current.object_id", its not null and it producing the value.
Terraform Config:
Terraform v0.15.4 on windows_amd64
provider registry.terraform.io/hashicorp/azuread v1.6.0

Answer 1

As you are using the resource app id of "Microsoft Graph" (00000003-0000-0000-c000-000000000000) , so you have to provide what delegated permissions you need for your app to have in Microsoft graph like User.read etc.
Some CLI commands that will help you to get the Microsoft Graph resource App Id's and Delegated Permissions Id's:
- az ad sp list --display-name "Microsoft Graph" --query
'[].{appDisplayName:appDisplayName, appId:appId}'
--output table
- az ad sp show --id 00000003-0000-0000-c000-000000000000 --query
"oauth2Permissions[].{Value:value, Id:id}" --output table
So as you are already using the default Microsoft Graph App Id , we need to get the delegated permission ID's to provide in resource access id.
Then your terraform code will be as below :
data "azuread_client_config" "current" {}
resource "azuread_application" "example" {
display_name = "example"
identifier_uris = ["api://example-app"]
owners = [data.azuread_client_config.current.object_id]
sign_in_audience = "AzureADMultipleOrgs"
required_resource_access {
resource_app_id = "00000003-0000-0000-c000-000000000000"# resourceid of microsoft graph
resource_access {
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # User.Read
type = "Scope"
}
}
web {
redirect_uris = ["https://app.example.net/account"]
implicit_grant {
access_token_issuance_enabled = false
}
}
}
Doing a terraform plan :
Note : Default Microsoft Graph App ID is "00000003-0000-0000-c000-000000000000" and Default Windows Active Directory App ID (Azure AD Graph) is "00000002-0000-0000-c000-000000000000". Based on your requirement you can use Microsoft Graph or Azure AD Graph .