The resource is successfully created, but it is not written to the Terraform state.

Recently, I attempted to use the msgraph Terraform provider to provision the /identityGovernance/entitlementManagement/accessPackages/{accessPackageId}/accessPackageResourceRoleScopes resource via the Microsoft Graph Beta API.

Aside from the fact that the Microsoft Graph Beta API returns an invalid URL in the Location header during resource creation (in this specific case), there also appears to be an issue with how the msgraph Terraform provider handles the 201 Created HTTP status code.

Based on my limited experience, the msgraph Terraform provider appears to assume that every resource supports the GET by ID operation
and constructs the verification request using the original request URL and the resource ID returned in the POST response.
However, in reality, many resources in the Microsoft Graph API only support the LIST operation — as was the case in my situation — which leads to resource creation verification failures.

As a result, the resource is successfully created, but it is not written to the Terraform state.

Possible solutions:

1. Preferably, a response with 201 Created status code should always include a valid URL in the Location header, so it can be used as intended. Therefore, we should report any invalid Location header issues to the upstream.
2. If possible, implement client-side logic to determine whether the resource supports the GET by ID operation — for example, by analyzing the OpenAPI specification — and construct the verification request accordingly. If not, use appropriate fallback logic.

Related links:

• https://learn.microsoft.com/en-us/graph/api/accesspackage-post-accesspackageresourcerolescopes?view=graph-rest-beta&tabs=http#example-1-add-group-membership-as-a-resource-role-to-an-access-package
• https://registry.terraform.io/providers/microsoft/msgraph/latest/docs/resources/resource

Start by tracing the provider's handling of a 201 Created response, including its use of the Location header and GET-by-ID verification request. Reproduce the accessPackageResourceRoleScopes case against the Microsoft Graph Beta API, then verify that creation succeeds and the resource is written to Terraform state when only LIST is supported.