azuread_conditional_access_policy resource with external_tenants is not accepted by Graph API

[sdx-jkataja]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform version: 1.9.5

Terraform Azure AD provider version 3.0.2

Affected Resource(s)

• azuread_conditional_access_policy

Terraform Configuration Files

My intention is to create a Conditional Access Policy that excludes an external tenant

resource "azuread_conditional_access_policy" "example" {
..
  conditions {
..
    users {
 ..
     excluded_guests_or_external_users {
        guest_or_external_user_types = ["serviceProvider"]
        external_tenants {
          membership_kind = "enumerated"
          members = ["aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"]
        }
      }
    }
  }
}

Debug Output

Part of request body which Terraform AzureAD sends to Microsoft Graph API

{
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
...
    "users": {
      "excludeGuestsOrExternalUsers": {
        "externalTenants": {
          "members": [
            "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
          ],
          "membershipKind": "enumerated"
        },
        "guestOrExternalUserTypes": "serviceProvider"
      },
...

Response body which Terraform AzureAD receives from Microsoft Graph API

{
  "error": {
    "code": "BadRequest",
    "message": "1007: Incoming ConditionalAccessPolicy object is null or does not match the schema of ConditionalAccessPolicy type. For examples, please see API documentation at https://docs.microsoft.com/en-us/graph/api/conditionalaccessroot-post-policies?view=graph-rest-1.0.",
    "innerError": {
      "date": "2024-10-29T16:10:00",
      "request-id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
      "client-request-id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
    }
  }
}

Panic Output

Expected Behavior

Conditional Access Policy is created

Actual Behavior

Conditional Access Policy results in Microsoft Graph API returning HTTP 400 Bad Request

Steps to Reproduce

1. terraform apply

Important Factoids

References