Automating the provisioning of Application Registrations (i.e. App Registrations) can be a very useful way of organizing your application’s Infrastructure as Code. Keeping track of all these disparate app registrations, who they belong to, what they are for, can be very tedious and challenging. It can get messy very quickly as well and a wary Azure AD administrator might be tempted to delete first and ask questions later. However, improper deletion of an Azure AD app registration can be crippling to an application or service.

Terraform has a provider specifically for managing Azure Active Directory resources. Users, Groups and even App Registrations are supported.

The official provider documentation gives an explanation of how to setup a service principal for Terraform that can provision these resources and authorize that account to manage users. However, managing app registrations is a different function.

Without taking the proper steps to authorize my service principal, if I try to create some app registrations I get the following error:

Error: graphrbac.ApplicationsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2019-08-28T12:03:36","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"6d3fee2b-327d-48e5-b7f6-c56de13afa65"}}]

Alt

The official documentation mentions “Company Administrator” using PowerShell. I’m not sure if this is an alias for the “User Administrator” role but if you want Azure AD to be able to manage users and groups then you should assign your service principal to this role.

Alt

However, we want our terraform service principal to be able to create app registrations, therefore we need to assign it to the “Cloud application administrator” role.

Alt

After that you can provision “azuread_application” resources to your hearts content!

Alt