Azure Active Directory Provider

https://registry.terraform.io/providers/hashicorp/azuread/latest/docs
Admin
The Azure Active Directory Provider enables Terraform to manage users, groups, service principals,...
Tokens:37,423
Snippets:306
Trust Score:10
Update:4 weeks ago
Show doc for...
Tokens:
Raw
### Example output of az account list

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/azure_cli

This is an example of the output from the az account list command, showing multiple tenants and subscriptions. The provider selects the tenant from the default Azure CLI account.

```text
TenantID                              Subscription                         Default
------------------------------------  -----------------------------------  ---------
00000000-0000-1111-1111-111111111111  N/A(tenant level account)            False
00000000-0000-2222-2222-222222222222  N/A(tenant level account)            False
00000000-0000-1111-1111-111111111111  My Subscription                      True
00000000-0000-1111-1111-111111111111  My Other Subscription                False
```

--------------------------------

### Example Usage: azuread_application_fallback_public_client

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_fallback_public_client

Creates an azuread_application_registration and an azuread_application_fallback_public_client resource. The fallback public client is enabled for the application. This resource is incompatible with the azuread_application resource.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_application_fallback_public_client" "example" {
  application_id = azuread_application_registration.example.id
  enabled        = true
}

```

--------------------------------

### Basic example: azuread_application_password

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_password

Creates an application registration and a password credential for it. The application_id argument references the registration's id.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_application_password" "example" {
  application_id = azuread_application_registration.example.id
}

```

--------------------------------

### Example Usage: Pre-authorize a client application

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_pre_authorized

Creates an application registration and an application with API permissions, then pre-authorizes the client to access those permissions. Requires the appropriate application or directory roles as described in the API Permissions section.

```hcl
resource "azuread_application_registration" "authorized" {
  display_name = "example-authorized-app"
}

resource "azuread_application" "authorizer" {
  display_name = "example-authorizing-app"

  api {
    oauth2_permission_scope {
      admin_consent_description  = "Administer the application"
      admin_consent_display_name = "Administer"
      enabled                    = true
      id                         = "00000000-0000-0000-0000-000000000000"
      type                       = "Admin"
      value                      = "administer"
    }

    oauth2_permission_scope {
      admin_consent_description  = "Access the application"
      admin_consent_display_name = "Access"
      enabled                    = true
      id                         = "11111111-1111-1111-1111-111111111111"
      type                       = "User"
      user_consent_description   = "Access the application"
      user_consent_display_name  = "Access"
      value                      = "user_impersonation"
    }
  }
}

resource "azuread_application_pre_authorized" "example" {
  application_id       = azuread_application.authorizer.id
  authorized_client_id = azuread_application_registration.authorized.client_id

  permission_ids = [
    "00000000-0000-0000-0000-000000000000",
    "11111111-1111-1111-1111-111111111111",
  ]
}
```

--------------------------------

### Example Usage: azuread_application_optional_claims with access_token, id_token, and saml2_token

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_optional_claims

Creates an application registration and configures optional claims for access, ID, and SAML2 tokens. Use the ignore_changes lifecycle meta-argument when using this resource alongside the azuread_application resource.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_application_optional_claims" "example" {
  application_id = azuread_application_registration.example.id

  access_token {
    name = "myclaim"
  }

  access_token {
    name = "otherclaim"
  }

  id_token {
    name                  = "userclaim"
    source                = "user"
    essential             = true
    additional_properties = ["emit_as_roles"]
  }

  saml2_token {
    name = "samlexample"
  }
}

```

--------------------------------

### Example Usage: azuread_application_redirect_uris

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_redirect_uris

Creates an application registration and assigns redirect URIs for PublicClient, SPA, and Web types. Requires the azuread_application_registration resource. The type must be one of PublicClient, SPA, or Web.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_application_redirect_uris" "example_public" {
  application_id = azuread_application_registration.example.id
  type           = "PublicClient"

  redirect_uris = [
    "myapp://auth",
    "sample.mobile.app.bundie.id://auth",
    "https://login.microsoftonline.com/common/oauth2/nativeclient",
    "https://login.live.com/oauth20_desktop.srf",
    "ms-appx-web://Microsoft.AAD.BrokerPlugin/00000000-1111-1111-1111-222222222222",
    "urn:ietf:wg:oauth:2.0:foo",
  ]
}

resource "azuread_application_redirect_uris" "example_spa" {
  application_id = azuread_application_registration.example.id
  type           = "SPA"

  redirect_uris = [
    "https://mobile.example.com/",
    "https://beta.example.com/",
  ]
}

resource "azuread_application_redirect_uris" "example_web" {
  application_id = azuread_application_registration.example.id
  type           = "Web"

  redirect_uris = [
    "https://app.example.com/",
    "https://classic.example.com/",
    "urn:ietf:wg:oauth:2.0:oob",
  ]
}
```

--------------------------------

### Example Usage: Create application from template

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_from_template

Creates an application from a gallery template using the azuread_application_template data source, then retrieves the resulting application and service principal. Requires API permissions: Application.ReadWrite.OwnedBy or Application.ReadWrite.All for service principals, or Application Administrator or Global Administrator for user principals.

```hcl
data "azuread_application_template" "example" {
  display_name = "Marketo"
}

resource "azuread_application_from_template" "example" {
  display_name = "Example Application"
  template_id  = data.azuread_application_template.example.template_id
}

data "azuread_application" "example" {
  object_id = azuread_application_from_template.example.application_object_id
}

data "azuread_service_principal" "example" {
  object_id = azuread_application_from_template.example.service_principal_object_id
}

```

--------------------------------

### Granting access to an application

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application_published_app_ids

Uses the data source to get the client ID for MicrosoftGraph, creates a service principal for it, and configures required resource access on an application. The example grants User.Read.All role and User.ReadWrite scope.

```hcl
data "azuread_application_published_app_ids" "well_known" {}

resource "azuread_service_principal" "msgraph" {
  client_id    = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
  use_existing = true
}

resource "azuread_application" "example" {
  display_name = "example"

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]

    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
      type = "Role"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.ReadWrite"]
      type = "Scope"
    }
  }
}

```

--------------------------------

### Example Usage: azuread_application data source

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application

Use this data source to look up an existing Azure AD application by display name and output its object ID. Requires the Application.Read.All or Directory.Read.All application role when authenticated with a service principal.

```hcl
data "azuread_application" "example" {
  display_name = "My First AzureAD Application"
}

output "application_object_id" {
  value = data.azuread_application.example.object_id
}

```

--------------------------------

### Using a certificate from Azure Key Vault

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_certificate

This example demonstrates how to create an Azure Key Vault certificate and associate it with an Azure AD application certificate resource using hex encoding.

```hcl
resource "azurerm_key_vault_certificate" "example" {
  name         = "generated-cert"
  key_vault_id = azurerm_key_vault.example.id

  certificate_policy {
    issuer_parameters {
      name = "Self"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    lifetime_action {
      action {
        action_type = "AutoRenew"
      }

      trigger {
        days_before_expiry = 30
      }
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      extended_key_usage = ["1.3.6.1.5.5.7.3.2"]

      key_usage = [
        "dataEncipherment",
        "digitalSignature",
        "keyCertSign",
        "keyEncipherment",
      ]

      subject_alternative_names {
        dns_names = ["internal.contoso.com", "domain.hello.world"]
      }

      subject            = "CN=${azuread_application.example.name}"
      validity_in_months = 12
    }
  }
}

resource "azuread_application" "example" {
  display_name = "example"
}

resource "azuread_application_certificate" "example" {
  application_id = azuread_application.example.id
  type           = "AsymmetricX509Cert"
  encoding       = "hex"
  value          = azurerm_key_vault_certificate.example.certificate_data
  end_date       = azurerm_key_vault_certificate.example.certificate_attribute[0].expires
  start_date     = azurerm_key_vault_certificate.example.certificate_attribute[0].not_before
}
```

--------------------------------

### Example Usage: azuread_application_template

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application_template

Retrieves an application template by display name and outputs its template ID. Requires either template_id or display_name to be specified.

```hcl
data "azuread_application_template" "example" {
  display_name = "Marketo"
}

output "application_template_id" {
  value = data.azuread_application_template.example.template_id
}

```

--------------------------------

### Example Usage: azuread_application_owner

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_owner

Creates an application registration, a user, and assigns the user as an owner. Requires the `Application.ReadWrite.OwnedBy` or `Application.ReadWrite.All` application role, or the `Application Administrator` or `Global Administrator` directory role when using a user principal.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_user" "jane" {
  user_principal_name = "jane.fischer@example.com"
  display_name        = "Jane Fischer"
  password            = "Ch@ngeMe"
}

resource "azuread_application_owner" "example_jane" {
  application_id  = azuread_application_registration.example.id
  owner_object_id = azuread_user.jane.object_id
}

```

--------------------------------

### Example Terraform Configuration for azuread_application_federated_identity_credential

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_federated_identity_credential

Creates an application registration and a federated identity credential for it. Uses a service principal authenticated via GitHub Actions. Audiences must be set to 'api://AzureADTokenExchange'.

```HCL
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_application_federated_identity_credential" "example" {
  application_id = azuread_application_registration.example.id
  display_name   = "my-repo-deploy"
  description    = "Deployments for my-repo"
  audiences      = ["api://AzureADTokenExchange"]
  issuer         = "https://token.actions.githubusercontent.com"
  subject        = "repo:my-organization/my-repo:environment:prod"
}
```

--------------------------------

### Time-based rotation example: azuread_application_password

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_password

Uses the time_rotating resource to rotate the password every 7 days. The rotate_when_changed argument forces recreation when the rotation timestamp changes.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "time_rotating" "example" {
  rotation_days = 7
}

resource "azuread_application_password" "example" {
  application_id = azuread_application_registration.example.id
  rotate_when_changed = {
    rotation = time_rotating.example.id
  }
}

```

--------------------------------

### List Azure Subscriptions and Tenants

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/azure_cli

Run this command to list all subscriptions and tenants associated with the logged-in account. The output shows the tenant ID, subscription name, and whether it is the default subscription.

```sh
az account list -o table --all --query "[].{TenantID: tenantId, Subscription: name, Default: isDefault}"
```

--------------------------------

### Login to Azure CLI with a Service Principal and Certificate

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/azure_cli

Use this command to log in with a service principal using a client certificate. Provide the path to the certificate file and the tenant ID.

```sh
az login --service-principal \
         --username 00000000-0000-0000-0000-000000000000 \
         --password /path/to/certificate \
         --tenant 10000000-2000-3000-4000-500000000000 \
         --allow-no-subscriptions
```

--------------------------------

### Generate a PKCS#12 bundle (.pfx) with OpenSSL

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/service_principal_client_certificate

Exports the client certificate and key into a .pfx file that the AzureAD provider can use for authentication. The password is set to 'Pa55w0rd123'.

```bash
$ openssl pkcs12 -export -password pass:"Pa55w0rd123" -out client.pfx -inkey client.key -in client.crt

```

--------------------------------

### Configure OIDC via Environment Variables

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/service_principal_oidc

Set these environment variables to enable OIDC authentication for the AzureAD provider.

```bash
$ export ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
$ export ARM_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
$ export ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"
$ export ARM_USE_OIDC=true
```

--------------------------------

### Import an application registration by object ID

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_registration

Imports an existing application registration using its object ID in the format /applications/{object-id}.

```shell
terraform import azuread_application_registration.example /applications/00000000-0000-0000-0000-000000000000

```

--------------------------------

### Create an Azure AD application with full configuration

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application

Creates an Azure AD application with a full configuration: API permissions, app roles, optional claims, required resource access, and web settings. Uses the azuread_client_config data source to set the owner. Includes comments identifying Microsoft Graph and Office 365 Management resource IDs.

```hcl
data "azuread_client_config" "current" {}

resource "azuread_application" "example" {
  display_name     = "example"
  identifier_uris  = ["api://example-app"]
  logo_image       = filebase64("/path/to/logo.png")
  owners           = [data.azuread_client_config.current.object_id]
  sign_in_audience = "AzureADMultipleOrgs"

  api {
    mapped_claims_enabled          = true
    requested_access_token_version = 2

    known_client_applications = [
      azuread_application.known1.client_id,
      azuread_application.known2.client_id,
    ]

    oauth2_permission_scope {
      admin_consent_description  = "Allow the application to access example on behalf of the signed-in user."
      admin_consent_display_name = "Access example"
      enabled                    = true
      id                         = "96183846-204b-4b43-82e1-5d2222eb4b9b"
      type                       = "User"
      user_consent_description   = "Allow the application to access example on your behalf."
      user_consent_display_name  = "Access example"
      value                      = "user_impersonation"
    }

    oauth2_permission_scope {
      admin_consent_description  = "Administer the example application"
      admin_consent_display_name = "Administer"
      enabled                    = true
      id                         = "be98fa3e-ab5b-4b11-83d9-04ba2b7946bc"
      type                       = "Admin"
      value                      = "administer"
    }
  }

  app_role {
    allowed_member_types = ["User", "Application"]
    description          = "Admins can manage roles and perform all task actions"
    display_name         = "Admin"
    enabled              = true
    id                   = "1b19509b-32b1-4e9f-b71d-4992aa991967"
    value                = "admin"
  }

  app_role {
    allowed_member_types = ["User"]
    description          = "ReadOnly roles have limited query access"
    display_name         = "ReadOnly"
    enabled              = true
    id                   = "497406e4-012a-4267-bf18-45a1cb148a01"
    value                = "User"
  }

  feature_tags {
    enterprise = true
    gallery    = true
  }

  optional_claims {
    access_token {
      name = "myclaim"
    }

    access_token {
      name = "otherclaim"
    }

    id_token {
      name                  = "userclaim"
      source                = "user"
      essential             = true
      additional_properties = ["emit_as_roles"]
    }

    saml2_token {
      name = "samlexample"
    }
  }

  required_resource_access {
    resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph

    resource_access {
      id   = "df021288-bdef-4463-88db-98f22de89214" # User.Read.All
      type = "Role"
    }

    resource_access {
      id   = "b4e74841-8e56-480b-be8b-910348b18b4c" # User.ReadWrite
      type = "Scope"
    }
  }

  required_resource_access {
    resource_app_id = "c5393580-f805-4401-95e8-94b7a6ef2fc2" # Office 365 Management

    resource_access {
      id   = "594c1fb6-4f81-4475-ae41-0c394909246c" # ActivityFeed.Read
      type = "Role"
    }
  }

  web {
    homepage_url  = "https://app.example.net"
    logout_url    = "https://app.example.net/logout"
    redirect_uris = ["https://app.example.net/account"]

    implicit_grant {
      access_token_issuance_enabled = true
      id_token_issuance_enabled     = true
    }
  }
}

```

--------------------------------

### Create Azure AD application and generate a password

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application

Creates an Azure AD application and generates a password using the time_rotating resource to set start and end dates. The password is exposed via a sensitive output that extracts the value from the application's password list.

```hcl
data "azuread_client_config" "current" {}

resource "time_rotating" "example" {
  rotation_days = 180
}

resource "azuread_application" "example" {
  display_name = "example"
  owners       = [data.azuread_client_config.current.object_id]

  password {
    display_name = "MySecret-1"
    start_date   = time_rotating.example.id
    end_date     = timeadd(time_rotating.example.id, "4320h")
  }
}

output "example_password" {
  sensitive = true
  value     = tolist(azuread_application.example.password).0.value
}

```

--------------------------------

### Login to Azure CLI with Service Principal and OpenID Connect

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/azure_cli

Use this command to log in with a service principal using OpenID Connect, typically for CI/CD scenarios. Provide the service principal ID and tenant ID.

```sh
az login --service-principal \
         --username 00000000-0000-0000-0000-000000000000 \
         --tenant 10000000-2000-3000-4000-500000000000 \
         --allow-no-subscriptions
```

--------------------------------

### Import azuread_application_known_clients

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_known_clients

Imports an existing known clients configuration using the object ID of the application in the specified format.

```shell
terraform import azuread_application_known_clients.example /applications/00000000-0000-0000-0000-000000000000/knownClients

```

--------------------------------

### Create Azure AD application from a gallery template

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application

Creates an Azure AD application from a gallery template by referencing the template's ID, then creates a service principal for that application with use_existing set to true.

```hcl
data "azuread_application_template" "example" {
  display_name = "Marketo"
}

resource "azuread_application" "example" {
  display_name = "example"
  template_id  = data.azuread_application_template.example.template_id
}

resource "azuread_service_principal" "example" {
  client_id    = azuread_application.example.client_id
  use_existing = true
}

```

--------------------------------

### Configure AzureAD provider and create resources

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs

Complete Terraform configuration for the AzureAD provider. It sets up the provider with a tenant ID, retrieves the initial domain, creates an application registration, a service principal, and a user. The user's principal name uses the domain from the data source.

```hcl
terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 3.1.0"
    }
  }
}

# Configure the Azure Active Directory Provider
provider "azuread" {
  tenant_id = "00000000-0000-0000-0000-000000000000"
}

# Retrieve domain information
data "azuread_domains" "example" {
  only_initial = true
}

# Create an application
resource "azuread_application_registration" "example" {
  display_name = "ExampleApp"
}

# Create a service principal
resource "azuread_service_principal" "example" {
  client_id = azuread_application_registration.example.client_id
}

# Create a user
resource "azuread_user" "example" {
  user_principal_name = "ExampleUser@${data.azuread_domains.example.domains.0.domain_name}"
  display_name        = "Example User"
  password            = "..."
}
```

--------------------------------

### Manage known client applications with azuread_application_known_clients

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_known_clients

Creates two application registrations and associates the client application's ID with the main application using the azuread_application_known_clients resource. Requires the azuread_application_registration resource, not the azuread_application resource.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_application_registration" "client" {
  display_name = "example client"
}

resource "azuread_application_known_clients" "example" {
  application_id = azuread_application_registration.example.id
  known_client_ids = [
    azuread_application_registration.client.client_id,
  ]
}

```

--------------------------------

### Basic usage with azuread_application_registration and azuread_application_identifier_uri

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_identifier_uri

Creates an application registration and a single identifier URI for it. For managing multiple identifier URIs, create another instance of this resource.

```hcl
resource "azuread_application_registration" "example" {
  display_name = "example"
}

resource "azuread_application_identifier_uri" "example" {
  application_id = azuread_application_registration.example.id
  identifier_uri = "https://app.example.com"
}

```

--------------------------------

### Import: azuread_application_fallback_public_client

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_fallback_public_client

Shows the Terraform import command for the fallback public client setting using the object ID of the application. The import format is /applications/{objectId}/fallbackPublicClient.

```bash
terraform import azuread_application_fallback_public_client.example /applications/00000000-0000-0000-0000-000000000000/fallbackPublicClient

```

--------------------------------

### Import: azuread_application_owner

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_owner

Imports an application owner using the object ID of the application and the object ID of the owner in the format `/applications/{application-id}/owners/{owner-id}`.

```bash
terraform import azuread_application_owner.example /applications/00000000-0000-0000-0000-000000000000/owners/11111111-1111-1111-1111-111111111111

```

--------------------------------

### Login to Azure CLI with a Service Principal and Secret

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/azure_cli

Use this command to log in with a service principal using a client secret. Replace the placeholders with your actual service principal ID, password, and tenant ID.

```sh
az login --service-principal \
         --username 00000000-0000-0000-0000-000000000000 \
         --password "MyCl1eNtSeCr3t" \
         --tenant 10000000-2000-3000-4000-500000000000 \
         --allow-no-subscriptions
```

--------------------------------

### Usage with azuread_application resource (with ignore_changes)

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_identifier_uri

Shows how to use azuread_application_identifier_uri alongside azuread_application. The lifecycle ignore_changes meta-argument for identifier_uris is required to prevent conflicts.

```hcl
resource "azuread_application" "example" {
  display_name = "example"

  lifecycle {
    ignore_changes = [
      identifier_uris,
    ]
  }
}

resource "azuread_application_identifier_uri" "example" {
  application_id = azuread_application.example.id
  # ...
}

```

--------------------------------

### Create an application registration with azuread_application_registration

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_registration

Defines an Azure AD application registration with display name, description, sign-in audience, and various URLs. Requires Application.ReadWrite.OwnedBy or Application.ReadWrite.All application roles, or Application Administrator or Global Administrator directory roles.

```hcl
resource "azuread_application_registration" "example" {
  display_name     = "Example Application"
  description      = "My example application"
  sign_in_audience = "AzureADMyOrg"

  homepage_url          = "https://app.example.com/"
  logout_url            = "https://app.example.com/logout"
  marketing_url         = "https://example.com/"
  privacy_statement_url = "https://example.com/privacy"
  support_url           = "https://support.example.com/"
  terms_of_service_url  = "https://example.com/terms"
}

```

--------------------------------

### Use azuread_application_api_access with azuread_application and ignore_changes

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_api_access

Shows how to use the azuread_application_api_access resource alongside the azuread_application resource. The lifecycle ignore_changes meta-argument prevents conflicts with the required_resource_access block in the azuread_application resource.

```hcl
resource "azuread_application" "example" {
  display_name = "example"

  lifecycle {
    ignore_changes = [
      required_resource_access,
    ]
  }
}

resource "azuread_application_api_access" "example" {
  application_id = azuread_application.example.id
  # ...
}

```

--------------------------------

### Import command for azuread_application_identifier_uri

Source: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_identifier_uri

Imports an application identifier URI using the object ID of the application and the base64-encoded identifier URI.

```bash
terraform import azuread_application_identifier_uri.example /applications/00000000-0000-0000-0000-000000000000/identifierUris/aHR0cHM6Ly9leGFtcGxlLm5ldC8=

```
Tokens:
Raw