azuread_application_federated_identity_credential - update to handle "claims matching expression"

[scott-doyland-burrows]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Azure now allows federated credentials to be wildcarded.

https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-flexible-federated-identity-credentials?tabs=github

Can the resource be updated to allow us to manage this via terraform.

The Portal looks like this:

New or Affected Resource(s)

• azuread_application_federated_identity_credential

Potential Terraform Configuration

resource "azuread_application_federated_identity_credential" "example" {
  application_id   = "/applications/xxx"
  display_name     = "plan"
  issuer           = "https://app.terraform.io"
  claim_expression = "claims['sub'] matches 'organization:company-cloudhub:project:devops:workspace:*:run_phase:*'"
}

References

• https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-flexible-federated-identity-credentials?tabs=github

[kevindashton]

According to the MS docs on Flexible FIC , the only way to do this programmatically is via the az rest method, but since the structure is different than expected, it currently causes subsequent reads by Terraform to fail.

Is this a feature that would be accepted if a PR was submitted?

[iwarapter]

the beta API supports this - i wrote a quick update to fix this but havent had time to flesh out the acctests for it. You can only use the claims support for the supported issuers defined in the preview - (github/gitlab/tf cloud etc)

[stdedos]

It seems implemented in https://github.com/hashicorp/terraform-provider-azuread/blob/main/CHANGELOG.md#370-november-18-2025? (#1788)

But there is already glitches (#1807)