azuread_access_package_resource_catalog_association with SharePointOnline not usable

[pauliusmiskinis]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

provider registry.terraform.io/hashicorp/azuread v3.1.0

Affected Resource(s)

• azuread_access_package_resource_catalog_association
• azuread_access_package_resource_package_association

Terraform Configuration Files

resource "azuread_access_package_resource_catalog_association" "this" {
  catalog_id             = "b1421dc9-1174-49a1-bca3-<MASKED>"
  resource_origin_id     = "https://<MASKED>.sharepoint.com/sites/TestTeam"
  resource_origin_system = "SharePointOnline"
}

Debug Output

azuread_access_package_resource_catalog_association.this: Creating...
azuread_access_package_resource_catalog_association.this: Still creating... [10s elapsed]
azuread_access_package_resource_catalog_association.this: Still creating... [20s elapsed]
╷
│ Error: Failed to parse resource ID "b1421dc9-1174-49a1-bca3-<MASKED>/https://<MASKED>.sharepoint.com/sites/TestTeam"
│
│   with azuread_access_package_resource_catalog_association.this,
│   on main.tf line 10, in resource "azuread_access_package_resource_catalog_association" "this":
│   10: resource "azuread_access_package_resource_catalog_association" "this" {
│
│ specified ID segment #1 ("https://<MASKED>.sharepoint.com/sites/TestTeam") is not a valid UUID: uuid string is wrong length

Expected Behavior

Association successful

Actual Behavior

Provider refuses to accept ed64f87c-f78c-4710-8a36-xxxxxxxxxxxx/https://<REMOVED>.sharepoint.com/sites/TestTeam as a valid ID, even though the association was successful.

Steps to Reproduce

Create any azuread_access_package_resource_catalog_association where resource_origin_system = SharePointOnline

Important Factoids

• resource_origin_id for a SharePoint resource is a URL, not UUID. This can be confirmed by manually adding a SharePoint site to a catalog, then querying it https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/catalogs/b1421dc9-1174-49a1-bca3-<MASKED>/resources:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#identityGovernance/entitlementManagement/catalogs('b1421dc9-1174-49a1-bca3-<MASKED>')/resources",
    "@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET identityGovernance/entitlementManagement/catalogs('<guid>')/resources?$select=attributes,createdDateTime",
    "value": [
        {
            "id": "67880e82-027b-47fe-ac42-<MASKED>",
            "displayName": "Test Team",
            "description": "https://<MASKED>.sharepoint.com/sites/TestTeam",
            "originId": "https://<MASKED>.sharepoint.com/sites/TestTeam",
            "originSystem": "SharePointOnline",
            "createdDateTime": "2025-02-04T19:30:25.473Z",
            "attributes": []
        }
    ]
}

References

Originally the issue was described here, but the merged PR didn't fix the problem. There's a UUID check right under here.

[jsfr]

I've opened a PR for to enable both SharepointOnline and Applications here #1627 so far though no luck getting any reviews of it