Error for creating 'azuredevops_serviceendpoint_azurerm'

[sorin-united]

Terraform (and Azure DevOps Provider) Version

terraform 1.9.0
azuredevops 1.3.0

Affected Resource(s)

azuredevops_serviceendpoint_azurerm

Terraform Configuration Files

------------------------MODULE----------------------------
resource "azuredevops_serviceendpoint_azurerm" "this" {
for_each = var.service_connection_params
project_id = each.value.project_id
service_endpoint_name = each.value.service_endpoint_name
azurerm_spn_tenantid = each.value.tenant_id
azurerm_subscription_id = each.value.subscription_id
azurerm_subscription_name = each.value.subscription_name
resource_group = each.value.resource_group
}

resource "azuredevops_resource_authorization" "this" {
for_each = var.service_connection_params
project_id = each.value.project_id
resource_id = azuredevops_serviceendpoint_azurerm.this[each.key].id
authorized = true
}

------------------------VARIABLES FILE--------------------
variable "service_connection_params" {
type = map(object({
project_id = string
service_endpoint_name = string
tenant_id = string
subscription_id = string
subscription_name = string
resource_group = string
}))
}

------------------------MODULE CALL-----------------------
module "service_connection" {
source = "../"

service_connection_params = {
ado_service_connnection = {
project_id = data.azuredevops_project.teamproject.project_id
service_endpoint_name = "TEST_SC" #data.azurerm_resource_group.rg-devops-arm-poc.name
tenant_id = "88155c28-f750-4013-91d3"
subscription_id = "d4549b4e-03a6-4b02-a194"
subscription_name = "APPS_EU_POC"
resource_group = data.azurerm_resource_group.rg-devops-arm-poc.name
}
}
}

Debug Output

file attached
trace_logs.txt

Panic Output

n/a

Expected Behavior

Successfully create service connection

Actual Behavior

Error:

│ Error: waiting for service endpoint ready. Looking up service endpoint given ID (bffcc32d-d0a8-4915-abed-e146a7d81124) and project ID (4ff74780-9ca2-4de5-8711-086114d194bb): map[errorCode:1 severity: state:Failed statusMessage:Failed to create an app in Microsoft Entra. Error: Insufficient privileges to complete the operation in Microsoft Graph Ensure that the user has permissions to create a Microsoft Entra Application.]

Steps to Reproduce

terraform apply the above code provided

1. terraform apply

Important Factoids

n/a

References

n/a

• #0000

Mentions:

The error is saying "Insufficient privileges to complete the operation in Microsoft Graph" - but the service principal used HAS the privileges to create service connections - this was separately tested in powershell for Microsoft Graph API.

Looking forward for any feedback, thanks!

[xuzhang3]

@sorin-united PAT is created under a user account, and this account in AAD should have sufficient permissions. For example, the user in AAD has the Contributor role