sign_in_frequency 'isEnabled' parameter

[cbshapil]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Affected Resource(s)

• azuread_conditional_access_policy

Terraform Configuration Files

conditions {
    client_app_types              = [
        "all",
    ]
    service_principal_risk_levels = []
    sign_in_risk_levels           = []
    user_risk_levels              = [
        "high",
        "medium",
    ]

    applications {
        excluded_applications = []
        included_applications = [
            "All",
        ]
    }

    users {
        excluded_groups = [
            "XXXXX"
        ]
        excluded_roles  = []
        excluded_users  = []
        included_groups = [
            "XXXXX",
        ]
        included_roles  = []
        included_users  = []
    }
}

grant_controls {
    built_in_controls             = [
        "mfa",
        "passwordChange",
    ]
    custom_authentication_factors = []
    operator                      = "AND"
    terms_of_use                  = []
}

session_controls {
    sign_in_frequency_authentication_type     = "primaryAndSecondaryAuthentication"
    sign_in_frequency_interval                = "everyTime"
}

Actual Behavior

The above policy creation fails with the following error (even though the applicationEnforcedRestrictions and disableResilienceDefaults parameters are not specified):

azuread_conditional_access_policy.CADev: Creating...
╷
│ Error: Could not create conditional access policy
│
│ with azuread_conditional_access_policy.CADev,
│ on CADev.tf line 10, in resource "azuread_conditional_access_policy" "CADev":
│ 10: resource "azuread_conditional_access_policy" "CADev" {
│
│ ConditionalAccessPoliciesClient.BaseClient.Post(): unexpected status 400 with OData error: BadRequest: 1115: The specified session controls,
│ 'applicationEnforcedRestrictions, disableResilienceDefaults', are not supported with the password change control; only signInFrequency every time
│ is supported. For examples, please see the API documentation at
│ https://docs.microsoft.com/en-us/graph/api/conditionalaccessroot-post-policies?view=graph-rest-1.0.

A similar policy created in Microsoft Graph including the "isEnabled" parameter works fine.

Here's a snippit from the policy created using Microsoft Graph:

"signInFrequency": {
"value": null,
"type": null,
"authenticationType": "primaryAndSecondaryAuthentication",
"frequencyInterval": "everyTime",
"isEnabled": true
}

References

• N/A

[GokanDonmez]

Is there a workaround for this bug?

[manicminer]

Not at this time, but I am working on improving the azuread_conditional_access_policy resource and hope to squash this bug soon.

[manicminer]

@GokanDonmez Whilst I've been able to reproduce this, adding "isEnabled": true to the sessionControls object still produces the same 400 error for me?

{
  "conditions": {
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": []
    },
    "clientAppTypes": [
      "all"
    ],
    "devices": null,
    "locations": null,
    "platforms": null,
    "servicePrincipalRiskLevels": [],
    "signInRiskLevels": [],
    "userRiskLevels": [
      "high",
      "medium"
    ],
    "users": {
      "includeUsers": ["none"],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "displayName": "acctest-CONPOLICY-240611180728063403",
  "grantControls": {
    "operator": "AND",
    "builtInControls": [
      "mfa",
      "passwordChange"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": []
  },
  "sessionControls": {
    "applicationEnforcedRestrictions": {
      "isEnabled": false
    },
    "cloudAppSecurity": null,
    "disableResilienceDefaults": false,
    "persistentBrowser": null,
    "signInFrequency": {
      "authenticationType": "primaryAndSecondaryAuthentication",
      "frequencyInterval": "everyTime",
      "isEnabled": true
    }
  },
  "state": "disabled"
}

{
  "error": {
    "code": "BadRequest",
    "message": "1115: The specified session controls, 'applicationEnforcedRestrictions, disableResilienceDefaults', are not supported with the password change control; only signInFrequency every time is supported. For examples, please see the API documentation at https://docs.microsoft.com/en-us/graph/api/conditionalaccessroot-post-policies?view=graph-rest-1.0.",
    "innerError": {
      "date": "2024-06-11T17:08:43",
      "request-id": "366029ae-0af1-47e2-8553-af6761d672f4",
      "client-request-id": "366029ae-0af1-47e2-8553-af6761d672f4"
    }
  }
}

[schaijik]

Same issue at our side, would love a quick fix for it.

[goldjg]

Hitting this same issue just now, has been driving me nuts. Sort of glad I can confirm it's not a problem between keyboard and chair :-)
But as I'm trying to move all of our CA to being as code through Terraform, this is a major blocker :(

Has anyone found a workaround?

[mateuszte]

There is no workaround and I just found same issue... The problem is with current code, which is setting up false value as default instead of null. To fix this code, basic need to change to null.

applicationEnforcedRestrictions -> null and
disableResilienceDefaults -> null, then it will work.

"sessionControls": { "applicationEnforcedRestrictions": { "@odata.type": "#microsoft.graph.applicationEnforcedRestrictionsSessionControl", "isEnabled": false }, "cloudAppSecurity": null, "disableResilienceDefaults": false, "signInFrequency": { "@odata.type": "#microsoft.graph.signInFrequencySessionControl", "frequencyInterval": "everyTime" } },

[barapz]

also hitting the same issue
@manicminer any chance this will get fixed any time soon?