使用Terraform创建Azure AD组遇403权限不足，需何种权限？

云原生阿岚

2026-8-6

问题描述

尝试用以下Terraform代码创建Azure AD组：

# Required Provider
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0.2"
    }
  }
  required_version = ">= 1.1.0"
}

# Configure the Microsoft Azure Provider
provider "azurerm" {
  features {}

  ....
  ....
}

data "azuread_client_config" "current" {}

# Variables
variable "ad_groups" {
  description = "Azure AD groups to be added"
  type = list(object({
    display_name = string,
    description  = string   
  }))
  default = [
    {
      display_name = "Group1",
      description  = "some description"
    },
    {
      display_name = "Group2",
      description  = "some description" 
    }
  ]
}

# Create AD Groups and add the Current User
resource "azuread_group" "this"{
  count = length(var.ad_groups)
  display_name =  var.ad_groups[count.index].display_name
  description = var.ad_groups[count.index].description
  security_enabled = true
  prevent_duplicate_names = true  
  owners  = [data.azuread_client_config.current.object_id]
}

执行后触发如下错误：

Error: could not check for existing group(s): unable to list Groups with filter "displayName eq 'Group1'": GroupsClient.BaseClient.Get(): unexpected status 403 with OData error: Authorization_RequestDenied: Insufficient privileges to complete the operation.

该服务主体已在管理组级别配置对应角色（见附图）。请问是否需要同时配置Directory.ReadWrite.All和Group.ReadWrite.All API权限？若不需要，应配置何种权限？

注：禁用prevent_duplicate_names = true后重新执行Terraform，仍会抛出错误：

GroupsClient.BaseClient.Post(): unexpected status 403 with OData error: Authorization_RequestDenied: Insufficient privileges to complete the operation.

解决方案

不需要同时配置Directory.ReadWrite.All和Group.ReadWrite.All，只需要**Group.ReadWrite.All应用权限**（注意是应用权限，不是委派权限）即可满足需求：

启用prevent_duplicate_names = true时，Terraform需要查询Azure AD中已存在的组，Group.ReadWrite.All包含读取和写入组的权限，足够覆盖该查询操作。
禁用该参数后，Terraform直接创建组，同样需要写入组的权限，Group.ReadWrite.All也能完全满足。

额外注意事项：

配置权限后，必须给服务主体授予该权限的管理员同意，否则权限不会生效。
管理组级别角色是针对Azure资源的权限体系，和Azure AD Graph/Microsoft Graph的API权限相互独立，管理组角色无法替代AD组的读写API权限。

内容的提问来源于stack exchange，提问作者One Developer