使用Terraform/Graph API添加AzureAD应用密钥遇管理员限制超限错误求助

现象 #

• 使用Terraform（本地个人账号或GitHub Actions服务账号）创建Azure AD应用注册的客户端密钥时，始终返回Server admin limit exceeded错误
• 同一账号通过Azure门户手动创建密钥完全正常
• 通过Graph Explorer（beta及1.0版本）调用addPassword接口时，同样复现该错误

相关请求与响应日志 #

2023-05-05T10:06:24.9951032Z 2023-05-05T10:06:24.248Z [INFO] provider.terraform-provider-azuread_v2.36.0_x5: 2023/05/05 10:06:24 [DEBUG] ============================ Begin AzureAD Request ============================
2023-05-05T10:06:24.9951240Z Request ID: 1a383e68-291a-f30e-af0b-ba66f5352ce7
2023-05-05T10:06:24.9951250Z
2023-05-05T10:06:24.9951535Z POST /beta/applications/<removed>/addPassword HTTP/1.1
2023-05-05T10:06:24.9951644Z Host: graph.microsoft.com
2023-05-05T10:06:24.9952169Z User-Agent: HashiCorp Terraform/1.4.6 (+https://www.terraform.io) Terraform Plugin SDK/2.10.1 terraform-provider-azuread/dev Hamilton (Go-http-client/1.1) pid-222c6c49-1b0a-5959-a213-6608f9eb8820
2023-05-05T10:06:24.9952297Z Content-Length: 111
2023-05-05T10:06:24.9952529Z Accept: application/json; charset=utf-8; IEEE754Compatible=false
2023-05-05T10:06:24.9952720Z Content-Type: application/json; charset=utf-8
2023-05-05T10:06:24.9952850Z Odata-Maxversion: 4.0
2023-05-05T10:06:24.9952972Z Odata-Version: 4.0
2023-05-05T10:06:24.9953100Z Accept-Encoding: gzip
2023-05-05T10:06:24.9953107Z
2023-05-05T10:06:24.9953465Z {"passwordCredential":{"displayName":"Client secret "}}
2023-05-05T10:06:24.9953740Z ============================= End AzureAD Request =============================: timestamp=2023-05-05T10:06:24.248Z
2023-05-05T10:06:24.9954246Z 2023-05-05T10:06:24.430Z [DEBUG] provider.terraform-provider-azurerm_v3.52.0_x5: Generated Provider Correlation Request Id: b701e369-4abf-2ad0-a7c3-8a42d0043207: timestamp=2023-05-05T10:06:24.428Z
2023-05-05T10:06:24.9955799Z 2023-05-05T10:06:24.582Z [TRACE] maybeTainted: module.environment.module.<removed>.azuread_application_password.app_registration_password encountered an error during creation, so it is now marked as tainted
2023-05-05T10:06:24.9956357Z 2023-05-05T10:06:24.582Z [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState to workingState for module.environment.module.<removed>.azuread_application_password.app_registration_password
2023-05-05T10:06:24.9956927Z 2023-05-05T10:06:24.582Z [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState: removing state object for module.environment.module.<removed>.azuread_application_password.app_registration_password
2023-05-05T10:06:24.9957403Z 2023-05-05T10:06:24.582Z [TRACE] evalApplyProvisioners: module.environment.module.<removed>.azuread_application_password.app_registration_password is tainted, so skipping provisioning
2023-05-05T10:06:24.9957857Z 2023-05-05T10:06:24.582Z [TRACE] maybeTainted: module.environment.module.<removed>.azuread_application_password.app_registration_password was already tainted, so nothing to do
2023-05-05T10:06:24.9958490Z 2023-05-05T10:06:24.582Z [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState to workingState for module.environment.module.<removed>.azuread_application_password.app_registration_password
2023-05-05T10:06:24.9959085Z 2023-05-05T10:06:24.582Z [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState: removing state object for module.environment.module.<removed>.azuread_application_password.app_registration_password
2023-05-05T10:06:24.9959689Z 2023-05-05T10:06:24.586Z [ERROR] vertex “module.environment.module..azuread_application_password.app_registration_password” error: Adding password for application with object ID “<removed>”
2023-05-05T10:06:24.9960120Z 2023-05-05T10:06:24.586Z [TRACE] vertex “module.environment.module.<removed>.azuread_application_password.app_registration_password”: visit complete, with errors
2023-05-05T10:06:24.9960608Z 2023-05-05T10:06:24.586Z [INFO] provider.terraform-provider-azuread_v2.36.0_x5: 2023/05/05 10:06:24 [DEBUG] ============================ Begin AzureAD Response ===========================
2023-05-05T10:06:24.9960958Z POST https://graph.microsoft.com/beta/applications/<removed>/addPassword
2023-05-05T10:06:24.9961160Z Request ID: 1a383e68-291a-f30e-af0b-ba66f5352ce7
2023-05-05T10:06:24.9961167Z
2023-05-05T10:06:24.9961261Z HTTP/1.1 400 Bad Request
2023-05-05T10:06:24.9961400Z Transfer-Encoding: chunked
2023-05-05T10:06:24.9961523Z Cache-Control: no-cache
2023-05-05T10:06:24.9961745Z Client-Request-Id: 8e624ae8-710f-49e8-a15b-7050cb9b0e42
2023-05-05T10:06:24.9961896Z Content-Type: application/json
2023-05-05T10:06:24.9961997Z Date: Fri, 05 May 2023 10:06:24 GMT
2023-05-05T10:06:24.9962187Z Request-Id: 8e624ae8-710f-49e8-a15b-7050cb9b0e42
2023-05-05T10:06:24.9962370Z Strict-Transport-Security: max-age=31536000
2023-05-05T10:06:24.9962497Z Vary: Accept-Encoding
2023-05-05T10:06:24.9962871Z X-Ms-Ags-Diagnostic: {"ServerInfo":{"DataCenter":"Central US","Slice":"E","Ring":"2","ScaleUnit":"001","RoleInstance":"DS2PEPF00000F45"}}
2023-05-05T10:06:24.9963002Z X-Ms-Resource-Unit: 1
2023-05-05T10:06:24.9963009Z
2023-05-05T10:06:24.9963083Z eb
2023-05-05T10:06:24.9963640Z {"error":{"code":"Request_BadRequest","message":"Server admin limit exceeded.","innerError":{"date":"2023-05-05T10:06:24","request-id":"8e624ae8-710f-49e8-a15b-7050cb9b0e42","client-request-id":"8e624ae8-710f-49e8-a15b-7050cb9b0e42"}}}
2023-05-05T10:06:24.9963719Z 0
2023-05-05T10:06:24.9963726Z
2023-05-05T10:06:24.9963740Z
2023-05-05T10:06:24.9964019Z ============================= End AzureAD Response ============================: timestamp=2023-05-05T10:06:24.582Z

排查与解决方案 #

1. 清理过期/冗余密钥 #

Azure AD应用注册默认限制最多存在25个客户端密钥（含过期但未删除的密钥）。门户创建时会自动忽略过期密钥的计数，但Graph API和Terraform会严格统计所有密钥：

• 登录Azure门户，进入目标应用注册的「证书和密码」页面
• 删除所有过期、闲置的密钥
• 重新执行Terraform部署或Graph API请求

2. 显式指定密钥过期时间 #

从日志可见，Terraform发送的请求仅包含displayName，未指定过期时间。虽然API文档标记该参数为可选，但部分场景下缺失会触发后端限制检查：
在Terraform资源中添加end_date参数，示例：

resource "azuread_application_password" "app_registration_password" {
  application_id = azuread_application.example.id
  display_name   = "Client secret"
  end_date       = "2025-05-05T00:00:00Z"
}

3. 验证账号权限与租户策略 #

• 确认执行操作的账号拥有Application.ReadWrite.All或Application.ReadWrite.OwnedBy权限
• 联系租户管理员，确认是否存在自定义的应用密钥数量限制策略

4. 切换Graph API版本 #

尝试使用稳定的v1.0接口发送完整参数请求，规避beta版本的潜在逻辑差异

内容的提问来源于stack exchange，提问作者MWDoesIT