azuread >3.x creates a wrong azuread_service_principal id for MS API

[Skyb0rg]

Terraform (and AzureAD Provider) Version

Terraform v1.9.5
on windows_amd64

• provider registry.terraform.io/hashicorp/azuread v3.0.2
• provider registry.terraform.io/hashicorp/azurerm v4.10.0
• provider registry.terraform.io/hashicorp/tls v4.0.6

Affected Resource(s)

• azurerm_role_assignment
• azuread_service_principal

Terraform Configuration Files

data "azuread_application" "tf_xxx" {
  display_name = "Terraform xxx"
}

data "azuread_service_principal" "sp_tf_xxx" {
  client_id = data.azuread_application.tf_xxx.client_id
}

resource "azurerm_role_assignment" "prod_contributor_tf_xxx" {
  for_each = var.rg_prod_set 
  scope                = azurerm_resource_group.by_prod_set["${each.value}"].id
  role_definition_name = "Contributor"
  principal_id         = data.azuread_service_principal.sp_tf_xxx.id
}

Panic Output

~ principal_id = "3efd3513-xxxx-xxxx-xxxx-ed35f98315a0" -> "/servicePrincipals/3efd3513-xxxx-xxxx-xxxx-ed35f98315a0" # forces replacement

after apply:

Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400
-- Original Error: autorest/azure: Service returned an error. Status=400 Code="InvalidPrincipalId" 
Message="The Principal ID '/servicePrincipals/3efd3513-xxxx-xxxx-xxxx-ed35f98315a0' is not valid. Principal ID must be a GUID."

Expected Behavior

Id should be only the id without "/servicePrincipals/"

Actual Behavior

id is "/servicePrincipals/3efd3513-xxxx-xxxx-xxxx-ed35f98315a0" and forces replacements, with are not allowed by azure API

Steps to Reproduce

• create ressouces with azuread 2.x
• upgrade to azuread 3.x
• terraform plan or apply

[Bouke]

I ran into this as well, I've resorted to using object_id instead: data.azuread_service_principal.example.object_id

[manicminer]

This is expected behavior - object_id is the correct attribute to use here.

[Skyb0rg]

uld be only the id without "/servicePrincipals/"

OK but why does it break the configs when upgrading to the 3.x version? Or was it already a bug before?