microsoft / microsoft/terraform-provider-msgraph

How to handle PIM for Entra ID roles

Open
#66 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
65
Forks
25
Avg merge
3d 10h
Merged PRs (30d)
6

Description

Is there a way to manage PIM for Entra Roles with this provider?

The APIs is a bit creative, and not following normal delete for deleting resources for example. Fails on Update as well
For example Role Eligibility Request

Delete
POST /roleManagement/directory/roleEligibilityScheduleRequests/{unifiedRoleEligibilityScheduleRequestId}/cancel

Docs

Example error messages

Delete

Destroying... [id=62c252b0-7327-490f-9796-b3facca809d8]
╷
│ Error: Failed to delete resource
│ 
│ DELETE https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleRequests/956b93d3-04b2-4e67-bb2c-7067469bd163
│ --------------------------------------------------------------------------------
│ RESPONSE 404: 404 Not Found
│ ERROR CODE: UnknownError
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "UnknownError",
│     "message": "{\"message\":\"No HTTP resource was found that matches the request URI 'https://api.azrbac.mspim.azure.com/api/v3/roleManagement/directory/roleEligibilityScheduleRequests('956b93d3-04b2-4e67-bb2c-7067469bd163')?'.\"}",
│     "innerError": {
│       "date": "2025-10-11T15:02:25",
│       "request-id": "e3f96448-9190-4ea8-a1b2-c4bc87549a56",
│       "client-request-id": "e3f96448-9190-4ea8-a1b2-c4bc87549a56"
│     }
│   }
│ }

Update


│   16: resource "msgraph_resource" "group_role_assignment" {
│ 
│ PATCH https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleRequests/62c252b0-7327-490f-9796-b3facca809d8
│ --------------------------------------------------------------------------------
│ RESPONSE 404: 404 Not Found
│ ERROR CODE: UnknownError
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "UnknownError",
│     "message": "{\"message\":\"No HTTP resource was found that matches the request URI 'https://api.azrbac.mspim.azure.com/api/v3/roleManagement/directory/roleEligibilityScheduleRequests('62c252b0-7327-490f-9796-b3facca809d8')?'.\"}",
│     "innerError": {
│       "date": "2025-10-11T15:01:46",
│       "request-id": "942d7b4f-f0d1-4602-9178-2a30582be503",
│       "client-request-id": "942d7b4f-f0d1-4602-9178-2a30582be503"
│     }
│   }
│ }

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Microsoft Graph documentation for roleEligibilityScheduleRequests and reproduce the delete and update failures shown for msgraph_resource and group_role_assignment. Done means the provider has a defined way to manage PIM role eligibility requests, including the documented cancellation operation and working update behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.