output permanently shows (known after apply) even with disable_default_output = true

we were doing hands-on POC testing of the FortiGate NVA deployment in our DR sandbox, and hit a real problem partway through: terraform plan kept showing a permanent, unexplained diff "~ output = {}" on the FortiGate's Managed Application resource, and trying to "fix" it accidentally triggered a real redeploy that failed (RoleAssignmentExists) — a genuine, reproducible bug in how Azure/Fortinet's Managed Application handles updates.

That led to two parallel threads:

Diagnosing the diff itself — tracing it to a known azapi provider limitation (the output attribute never settling, even with the documented fix applied), confirming there's no clean config-level solution, and landing on an operational workaround (-target around that resource) instead of a real fix.
Exploring whether there's a fundamentally simpler way to deploy the NVA — testing the native Microsoft.Network/networkVirtualAppliances resource type directly (no Managed Application wrapper) as an alternative, learning its vendor/version/scale-unit requirements by trial and error against Azure's own validation errors, and ultimately comparing it against real production config to decide it's not the right move — production itself runs the Managed Application model, and the native path is missing the self-registration/licensing link that model provides.

**After TF Plan:**
Terraform will perform the following actions:

# module.fortigate_nva.data.azurerm_resources.nva will be read during apply
# (depends on a resource or a module with changes pending)
<= data "azurerm_resources" "nva" {
+ id = (known after apply)
+ name = (known after apply)
+ resource_group_name = "rg-poc-dr-cus-001-nva-managed"
+ resources = (known after apply)
+ type = "Microsoft.Network/networkVirtualAppliances"
}

# module.fortigate_nva.azapi_resource.fortigate_nva will be updated in-place
~ resource "azapi_resource" "fortigate_nva" {
id = "/subscriptions/4672cda2-12d9-40d9-88e3-242336425a1c/resourceGroups/rg-poc-dr-cus-001/providers/Microsoft.Solutions/applications/6b2a09aafa7404ee7818d1ee996c4f7f"
name = "6b2a09aafa7404ee7818d1ee996c4f7f"
~ output = {} -> (known after apply)
# (11 unchanged attributes hidden)

# (2 unchanged blocks hidden)
}

**After TF Apply**

│ Error: Failed to create/update resource
│
│ with module.fortigate_nva.azapi_resource.fortigate_nva,
│ on ../../modules/fortigate-nva/main.tf line 36, in resource "azapi_resource" "fortigate_nva":
│ 36: resource "azapi_resource" "fortigate_nva" {
│
│ creating/updating Resource: (ResourceId
│ "/subscriptions/4672cda2-12d9-40d9-88e3-242336425a1c/resourceGroups/rg-poc-dr-cus-001/providers/Microsoft.Solutions/applications/6b2a09aafa7404ee7818d1ee996c4f7f"
│ / Api Version "2021-07-01"): GET
│ https://management.azure.com/subscriptions/4672cda2-12d9-40d9-88e3-242336425a1c/providers/Microsoft.Solutions/locations/CENTRALUS/operationStatuses/84be669e-f8bd-4ed3-b8b5-fffedefde9dc*CEEB2B8A9A0E116DB081F211F716889E0C17F6BB33A92467413FC4642883D60B
│ --------------------------------------------------------------------------------
│ RESPONSE 200: 200 OK
│ ERROR CODE: RoleAssignmentExists
│ --------------------------------------------------------------------------------
│ {
│ "id": "/subscriptions/4672cda2-12d9-40d9-88e3-242336425a1c/providers/Microsoft.Solutions/locations/CENTRALUS/operationStatuses/84be669e-f8bd-4ed3-b8b5-fffedefde9dc*CEEB2B8A9A0E116DB081F211F716889E0C17F6BB33A92467413FC4642883D60B",
│ "name": "84be669e-f8bd-4ed3-b8b5-fffedefde9dc*CEEB2B8A9A0E116DB081F211F716889E0C17F6BB33A92467413FC4642883D60B",
│ "resourceId": "/subscriptions/4672cda2-12d9-40d9-88e3-242336425a1c/resourceGroups/rg-poc-dr-cus-001/providers/Microsoft.Solutions/applications/6b2a09aafa7404ee7818d1ee996c4f7f",
│ "status": "Failed",
│ "startTime": "2026-09-08T14:11:18.1903338Z",
│ "endTime": "2026-09-08T14:26:30.1307411Z",
│ "error": {
│ "code": "RoleAssignmentExists",
│ "message": "The role assignment already exists. The ID of the existing role assignment is c094b1c9f5bc4553aa5f677c3093e7ad."
│ }
│ }

Start with ../../modules/fortigate-nva/main.tf at line 36 and reproduce the azapi_resource behavior with Terraform plan and apply. Trace why output changes from {} to known after apply and how the RoleAssignmentExists failure relates to the update; the issue currently documents a -target workaround rather than a defined fix or acceptance test.

Written by the indexing model from the issue text.