New Purview Compatibility

Hi there,

We've recently tried migrating from classic Purview to the new Purview by attempting to redeploy our same configuration leveraging azapi_data_plane_resource to deploy our collections, scans, managed vnet, ir, etc. (minus base url change). Microsoft have informed us the api's are supposed to be largely backwards compatible.

When setting the base url to api.purview-service.microsoft.com, the deployment fails with the following error:

RESPONSE 401: 401 Unauthorized
│ ERROR CODE: Unauthenticated
│ --------------------------------------------------------------------------------
│ {
│ "error": {
│ "code": "Unauthenticated",
│ "message": "Invalid token audience provided. Valid audiences: f9ee0641-efe0-4c37-a6b5-07c021b33ba4,73c2949e-da2d-457a-9607-fcc665198967,https://purview.azure.net,https://purview.azure.net/,https://api.purview.microsoft.com,https://api.purview.microsoft.com/,https://database.windows.net,https://database.windows.net/"
│ }
│ }

When setting the base url to https://.purview.azure.com, the deployment fails with the following error:

checking for presence of existing Resource: (ResourceId
│ ".purview.azure.com/collections/my_collection" / Api Version
│ "2019-11-01-preview"): Get
│ "https://.purview.azure.com/collections/my_collection?api-version=2019-11-01-preview":
│ dial tcp: lookup .purview.azure.com: no such host

Using both base urls via Postman works perfectly with a token created using the https://purview.azure.net resource, so I'm assuming there's an incompatibility between the old token authority and new one.

Thanks,

Richard

Start with azapi_data_plane_resource and reproduce the reported requests using both Purview base URLs, checking the token audience and the DNS failure separately. Compare the Postman behavior with the provider's requests and API version 2019-11-01-preview. Done means establishing whether provider compatibility is possible and recording a clear resolution or limitation.

Written by the indexing model from the issue text.