azuread_application_password wants to recreate NEW password becasue of application_id change

[michasacuer]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.11.3
on windows_amd64

• provider registry.terraform.io/azure/azapi v2.4.0
• provider registry.terraform.io/hashicorp/azuread v3.4.0
• provider registry.terraform.io/hashicorp/azurerm v4.30.0
• provider registry.terraform.io/hashicorp/time v0.13.1

Your version of Terraform is out of date! The latest version
is 1.12.1. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• azuread_application_password

Terraform Configuration Files

# secret_configs = [
#        {
#          name            = "client-secret-2"
#          expiration_date = "2026-06-30T23:59:59Z"
#        } 


variable "display_name" {
  description = "Display Name for the Service Principal"
  type        = string
}

variable "secret_configs" {
  type = list(object({
    name            = string
    expiration_date = string
    key_vaults = optional(list(object({
      id          = string
      secret_name = string
    })), [])
  }))

  default = []
}

locals {
  secret_config_map = {
    for secret in var.secret_configs : secret.name => secret
  }

  secret_vault_map = {
    for pair in flatten([
      for secret in var.secret_configs : [
          key = "${secret.name}"
          value = {
            password_key          = secret.name
            expiration_date       = secret.expiration_date
          }
        }
      ]
    ]) : pair.key => pair.value
  }
}

resource "azuread_application" "application" {
  display_name    = var.display_name
  identifier_uris = var.identifier_uris
}

resource "azuread_service_principal" "service_principal" {
  client_id                    = azuread_application.application.client_id
  app_role_assignment_required = false

  depends_on = [azuread_application.application]
}

resource "azuread_application_password" "passwords" {
  for_each = local.secret_config_map

  application_id = azuread_application.application.id
  display_name   = each.key
  end_date       = each.value.expiration_date

  depends_on = [azuread_service_principal.service_principal]
}

Debug Output

  # module.cip["displayname"].azuread_application_password.passwords["client-secret-2"] must be replaced
-/+ resource "azuread_application_password" "passwords" {
      ~ application_id = "/applications/CLIENT_ID" -> "applications/CLIENT_ID" # forces replacement
      ~ id             = "REDACTED" -> (known after apply)
      ~ key_id         = "REDACTED" -> (known after apply)
      ~ start_date     = "2025-05-26T10:57:51.2305055Z" -> (known after apply)
      ~ value          = (sensitive value)
        # (2 unchanged attributes hidden)
    }

Expected Behavior

application_id should not force password recreation

Actual Behavior

Terraform detects application_id change and forces to recreate. Manually id change in state doesnt help

Steps to Reproduce

1. terraform apply

[michasacuer]

  lifecycle {
    ignore_changes = [
      application_id
    ]
  }

fixes issue, but i dont know if its correct behaviour

[tpaul1611]

  lifecycle {
    ignore_changes = [
      application_id
    ]
    replace_triggered_by = [
      azuread_application.application.id
    ]
  }

if you also add the application id reference to replace_triggered_by you should actually get the full functionality 🙂