identity synchronization/provisioning not working as expected

[magic-happenz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.5.4
azuread version 2.41.0

Affected Resource(s)

azuread_service_principal

Terraform Configuration Files

resource "azuread_application" "example" {
  display_name = "example"
  feature_tags {
    enterprise = true
    gallery    = false
  }
}

resource "azuread_service_principal" "example" {
  application_id = azuread_application.example.application_id
  use_existing   = true
}

resource "azuread_synchronization_secret" "example" {
  service_principal_id = azuread_service_principal.example.id

  credential {
    key   = "BaseAddress"
    value = "https://exampleapp.net/api/2.0/preview/scim"
  }
  credential {
    key   = "SecretToken"
    value = "some-token"
  }
}

resource "azuread_synchronization_job" "example" {
  service_principal_id = azuread_service_principal.example.id
  template_id          = "scim"
  enabled              = true
}

Expected Behavior

The deployment creates a SCIM provisioning job on the non-gallery application.

Actual Behavior

The deployment fails with the error that the "scim" template can not be found.

Steps to Reproduce

1. terraform init
2. terraform apply

Important Factoids

Feature was implemented in #830
However, for this in order to work the actual "scim" template need to exist on the API (https://graph.microsoft.com/v1.0/servicePrincipals/%3cprincipal-object-id/synchronization/templates) which it does not. To make it actually work the templates on the app needs to be initiated https://learn.microsoft.com/en-us/graph/api/applicationtemplate-instantiate?view=graph-rest-1.0&tabs=http. Apparently none of the resources is doing that and there is no other resource that does it.

[magic-happenz]

This bug still exists in version 3 of the provider. I wonder why it has not been addressed yet?

[enorlando]

any update on this?