Provider Block
Configuration Options
Cloud Environment
The Microsoft cloud environment to use. Supported values:
public- Microsoft Public Cloud (default)usgovernment- US Government Cloud (GCC, GCC High, DoD)china- Microsoft China Cloud (21Vianet)
The Microsoft Entra ID (Azure AD) tenant ID (GUID) for your organization.
Authentication Configuration
The provider supports multiple authentication methods:Client Credentials (Service Principal)
The Application (client) ID of the Azure AD application/service principal.
The client secret for the Azure AD application. Note: Store secrets in variables or use secret management tools.
Path to the client certificate file (.pfx or .p12) for certificate-based authentication.
Password for the client certificate file (if encrypted).
Interactive Authentication
Enable device code flow for interactive authentication. Useful for development or when browser access is limited.
Enable interactive browser authentication. Opens a browser window for user login.
Managed Identity
Enable Azure Managed Identity authentication. Works on Azure VMs, App Services, and other Azure resources.
The client ID of a user-assigned managed identity (optional, uses system-assigned if not specified).
Workload Identity & OIDC
Enable OpenID Connect (OIDC) authentication. Supports GitHub Actions and Azure DevOps workload identity federation.
The OIDC token for workload identity federation.
Path to a file containing the OIDC token.
Azure Developer CLI
Use credentials from the Azure Developer CLI (
azd).API Configuration
Use the Microsoft Graph Beta API endpoint. Set to
true to access preview features.false- Use Graph v1.0 API (generally available features)true- Use Graph Beta API (preview features)
Default timeout in seconds for API requests. Individual resources may override this.
Maximum number of retry attempts for failed API requests (e.g., throttling, transient errors).
Delay in seconds between retry attempts. Uses exponential backoff.
Network Configuration
Enable HTTP proxy for API requests.
HTTP/HTTPS proxy URL (e.g.,
http://proxy.example.com:8080).Username for proxy authentication (if required).
Password for proxy authentication (if required).
Custom User-Agent header for API requests. Useful for tracking or compliance.
Disable HTTP response compression. May be useful for debugging.
Maximum number of HTTP redirects to follow.
Telemetry & Logging
Disable telemetry data collection sent to Microsoft.
Enable detailed logging of HTTP requests/responses (for debugging). Warning: May log sensitive data.
Environment Variables
All provider configuration options can be set via environment variables using the prefixM365_:
Authentication Examples
Client Secret (Production)
Client Certificate
Managed Identity (Azure VM/App Service)
OIDC with GitHub Actions
Device Code (Interactive Development)
Required Permissions
The service principal or user authenticating to the provider requires appropriate Microsoft Graph API permissions. Required permissions vary by resource:Common Permission Sets
Device Management (Intune):DeviceManagementConfiguration.ReadWrite.AllDeviceManagementApps.ReadWrite.AllDeviceManagementManagedDevices.ReadWrite.All
Directory.ReadWrite.AllGroup.ReadWrite.AllUser.ReadWrite.AllPolicy.ReadWrite.ConditionalAccess
Application.ReadWrite.AllServicePrincipalEndpoint.ReadWrite.All
Cloud Environment Details
Microsoft Public Cloud
US Government Cloud
Microsoft China Cloud
Best Practices
Secret Management
Secret Management
- Never hardcode secrets in provider configuration
- Use Terraform variables and store secrets in:
- Environment variables
- HashiCorp Vault
- Azure Key Vault
- AWS Secrets Manager
- Terraform Cloud/Enterprise workspace variables
Service Principal Permissions
Service Principal Permissions
- Follow principle of least privilege
- Create separate service principals for different environments (dev/staging/prod)
- Regularly audit and rotate credentials
- Use certificate-based authentication in production for enhanced security
Network Configuration
Network Configuration
- Test proxy configuration before production deployment
- Configure appropriate timeouts for your network conditions
- Use retry settings to handle transient API failures
- Enable request logging only in development (may expose sensitive data)
Multi-Environment Setup
Multi-Environment Setup
- Use different tenant IDs for dev/staging/prod environments
- Leverage Terraform workspaces or separate state files
- Consider using
use_graph_betaonly in non-production environments
Troubleshooting
Authentication Issues
Error: Invalid client secret- Verify client secret hasn’t expired
- Check for whitespace or special characters in secret value
- Ensure service principal has required API permissions
- Verify
client_idandtenant_idare correct - Ensure application exists in the correct tenant
- Check that service principal is enabled
Network Issues
Error: Connection timeout- Increase
timeoutvalue - Verify network connectivity to Microsoft Graph API
- Check proxy configuration if applicable
- Microsoft Graph API is throttling requests
- Provider will automatically retry with exponential backoff
- Consider spreading operations across multiple
terraform applyruns
API Version Issues
Error: Resource not found in v1.0- Resource may only be available in beta API
- Set
use_graph_beta = truein provider configuration - Check resource documentation for API version requirements
