msgraph_resource identityGovernance/entitlementManagement/assignmentPolicies fails on destroy leaving broken state

Hi,

Defining a msgraph_resource to manage an Access Package Assignment Policy works fine when creating or updating assignment policies, however, when removing resources the destroy step fails, since while waiting for deletion an unexpected response is returned (403). The user making the request is catalog owner (Service Principal). Using the portal I can see that the policy is indeed gone. Given that a 201 or 200 is returned by the delete request prior to the GET, could you please allow for a response 403 as a valid response?:

resource "msgraph_resource" "access_package_policy" {
  for_each      = var.access_package_catalog_id != null ? toset([var.access_package_catalog_id]) : toset([])
  url           = "identityGovernance/entitlementManagement/assignmentPolicies"
  api_version   = "v1.0"
  update_method = "PUT"

  body = {
     ...
  }
}

Error:

│ Error: Error waiting for deletion
│ 
│ retrieving resource: GET
│ https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentPolicies/XXX
│ --------------------------------------------------------------------------------
│ RESPONSE 403: 403 Forbidden
│ ERROR CODE: UnAuthorized
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "UnAuthorized",
│     "message": "User is not authorized to perform the operation. Reason: Unauthorized",
│     "details": [],
│     "innerError": {
│       "date": "2026-09-07T17:46:12",
│       "request-id": "XXX",
│       "client-request-id": "XXX"
│     }
│   }
│ }
│ --------------------------------------------------------------------------------
│ 
╵

Future plans fail on reading the data source:

│ Error: Failed to read data source │ │ with module.sql_ad_groups["XXX"].msgraph_resource.access_package_policy["XXX"], │ on ../shared/ad-groups/main.tf line 128, in resource "msgraph_resource" "access_package_policy": │ 128: resource "msgraph_resource" "access_package_policy" { │ │ GET │ https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentPolicies/XXX │ -------------------------------------------------------------------------------- │ RESPONSE 403: 403 Forbidden │ ERROR CODE: UnAuthorized │ -------------------------------------------------------------------------------- │ { │ "error": { │ "code": "UnAuthorized", │ "message": "User is not authorized to perform the operation. Reason: Unauthorized", │ "details": [], │ "innerError": { │ "date": "2026-09-07T18:00:52", │ "request-id": "XXX", │ "client-request-id": "XXX" │ } │ } │ } │ -------------------------------------------------------------------------------- │

"Current workaround"

We must manually create moved+removed blocks when removing access package assignment policies after the first terraform apply attempt. This is a very frustrating process.