-
Notifications
You must be signed in to change notification settings - Fork 285
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cannot assign groups to application via service principal #1378
Comments
Hi @zemirco, thanks for reporting this issue. I couldn't say why the DELETE request is being sent without seeing a copy of the plan for this apply, however you will need to assign the |
It finally works. Here is how we did it 🥳 The permission Wow :) I'm so glad this finally works as we've spent so many hours on this topic. Thank you for maintaining the |
Ah that's great, thanks for reporting back! This is easily missed and I'll see if we can call this out more clearly in the docs. |
Glad that it is sorted @zemirco. :) |
Community Note
Terraform (and AzureAD Provider) Version
Affected Resource(s)
azuread_app_role_assignment
azuread_service_principal
azuread_application
Terraform Configuration Files
Debug Output
https://gist.github.com/zemirco/07a36d90f68ac65f4ebcbfa420f8a94f
Panic Output
Expected Behavior
I'm able to add / remove groups to my Enterprise Application (so that the group members are able to login via SAML SSO) via my CI/CD pipeline using GitHub Actions by authenticating as a service principal.
This is how it should look like in the end.
The app registration has the
Application.ReadWrite.OwnedBy
permission.The service principal uses OIDC to connect to our Azure AD.
Actual Behavior
It all works locally when I run the command as a user.
It does not work when the command runs inside our CI/CD pipeline which is GitHub Actions. Here we're getting the following error.
Steps to Reproduce
terraform apply
References
The text was updated successfully, but these errors were encountered: