Configuring AzureAD provider in Terraform to manage App Registrations

Automating the provisioning of Application Registrations (i.e. App Registrations) can be a very useful way of organizing your application’s Infrastructure as Code. Keeping track of all these disparate app registrations, who they belong to, what they are for, can be very tedious and challenging. It can get messy very quickly as well and a wary Azure AD administrator might be tempted to delete first and ask questions later. However, improper deletion of an Azure AD app registration can be crippling to an application or service.

Terraform has a provider specifically for managing Azure Active Directory resources. Users, Groups and even App Registrations are supported.

The official provider documentation gives an explanation of how to setup a service principal for Terraform that can provision these resources and authorize that account to manage users. However, managing app registrations is a different function.

Without taking the proper steps to authorize my service principal, if I try to create some app registrations I get the following error:

Error: graphrbac.ApplicationsClient#Create: Failure responding to request: StatusCode=403 — Original Error: autorest/azure: Service returned an error. Status=403 Code=”Unknown” Message=”Unknown service error” Details=[{“odata.error”:{“code”:”Authorization_RequestDenied”,”date”:”2019-08-28T12:03:36″,”message”:{“lang”:”en”,”value”:”Insufficient
privileges to complete the operation.”},”requestId”:”6d3fee2b-327d-48e5-b7f6-c56de13afa65″}}]

The official documentation mentions “Company Administrator” using PowerShell. I’m not sure if this is an alias for the “User Administrator” role but if you want Azure AD to be able to manage users and groups then you should assign your service principal to this role.

However, we want our terraform service principal to be able to create app registrations, therefore we need to assign it to the “Cloud application administrator” role.

After that you can provision “azuread_application” resources to your hearts content!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s