Support for password policies

docs/resources/user.md

@@ -37,6 +37,8 @@ The following arguments are supported:
 * `consent_provided_for_minor` - (Optional) Whether consent has been obtained for minors. Supported values are `Granted`, `Denied` and `NotRequired`. Omit this property or specify a blank string to unset.
 * `country` - (Optional) The country/region in which the user is located, e.g. `US` or `UK`.
 * `department` - (Optional) The name for the department in which the user works.
+* `disable_password_expiration` - (Optional) Whether the users password is exempt from expiring. Defaults to `false`.
+* `disable_strong_password` - (Optional) Whether the user is allowed weaker passwords than the default policy to be specified. Defaults to `false`.
 * `display_name` - (Required) The name to display in the address book for the user.
 * `employee_id` - (Optional) The employee identifier assigned to the user by the organisation.
 * `fax_number` - (Optional) The fax number of the user.

internal/services/users/user_resource.go

@@ -209,6 +209,19 @@ func userResource() *schema.Resource {
 				ValidateFunc: validation.StringLenBetween(1, 256), // Currently the max length for AAD passwords is 256
 			},
 
+			"disable_strong_password": {
+				Description: "Whether the user is allowed weaker passwords than the default policy to be specified.",
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+			},
+			"disable_password_expiration": {
+				Description: "Whether the users password is exempt from expiring",
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+			},
+
 			"postal_code": {
 				Description: "The postal code for the user's postal address. The postal code is specific to the user's country/region. In the United States of America, this attribute contains the ZIP code",
 				Type:        schema.TypeString,
@@ -367,6 +380,18 @@ func userResourceCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		mailNickName = strings.Split(upn, "@")[0]
 	}
 
+	var passwordPolicies string
+	disableStrongPassword := d.Get("disable_strong_password").(bool)
+	disablePasswordExpiration := d.Get("disable_password_expiration").(bool)
+
+	if disableStrongPassword && (!disablePasswordExpiration) {
+		passwordPolicies = "DisableStrongPassword"
+	} else if (!disableStrongPassword) && disablePasswordExpiration {
+		passwordPolicies = "DisablePasswordExpiration"
+	} else if disableStrongPassword && disablePasswordExpiration {
+		passwordPolicies = "DisablePasswordExpiration, DisableStrongPassword"
+	}
+
 	properties := msgraph.User{
 		AccountEnabled:          utils.Bool(d.Get("account_enabled").(bool)),
 		AgeGroup:                utils.NullableString(d.Get("age_group").(string)),
@@ -385,6 +410,7 @@ func userResourceCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		MobilePhone:             utils.NullableString(d.Get("mobile_phone").(string)),
 		OfficeLocation:          utils.NullableString(d.Get("office_location").(string)),
 		OtherMails:              tf.ExpandStringSlicePtr(d.Get("other_mails").(*schema.Set).List()),
+		PasswordPolicies:        utils.NullableString(passwordPolicies),
 		PostalCode:              utils.NullableString(d.Get("postal_code").(string)),
 		PreferredLanguage:       utils.NullableString(d.Get("preferred_language").(string)),
 		ShowInAddressList:       utils.Bool(d.Get("show_in_address_list").(bool)),
@@ -425,6 +451,18 @@ func userResourceCreate(ctx context.Context, d *schema.ResourceData, meta interf
 func userResourceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client := meta.(*clients.Client).Users.UsersClient
 
+	var passwordPolicies string
+	disableStrongPassword := d.Get("disable_strong_password").(bool)
+	disablePasswordExpiration := d.Get("disable_password_expiration").(bool)
+
+	if disableStrongPassword && (!disablePasswordExpiration) {
+		passwordPolicies = "DisableStrongPassword"
+	} else if (!disableStrongPassword) && disablePasswordExpiration {
+		passwordPolicies = "DisablePasswordExpiration"
+	} else if disableStrongPassword && disablePasswordExpiration {
+		passwordPolicies = "DisablePasswordExpiration, DisableStrongPassword"
+	}
+
 	properties := msgraph.User{
 		DirectoryObject: msgraph.DirectoryObject{
 			ID: utils.String(d.Id()),
@@ -445,6 +483,7 @@ func userResourceUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 		MobilePhone:             utils.NullableString(d.Get("mobile_phone").(string)),
 		OfficeLocation:          utils.NullableString(d.Get("office_location").(string)),
 		OtherMails:              tf.ExpandStringSlicePtr(d.Get("other_mails").(*schema.Set).List()),
+		PasswordPolicies:        utils.NullableString(passwordPolicies),
 		PostalCode:              utils.NullableString(d.Get("postal_code").(string)),
 		PreferredLanguage:       utils.NullableString(d.Get("preferred_language").(string)),
 		ShowInAddressList:       utils.Bool(d.Get("show_in_address_list").(bool)),
@@ -538,6 +577,23 @@ func userResourceRead(ctx context.Context, d *schema.ResourceData, meta interfac
 	tf.Set(d, "user_principal_name", user.UserPrincipalName)
 	tf.Set(d, "user_type", user.UserType)
 
+	disableStrongPassword := false
+	disablePasswordExpiration := false
+
+	if user.PasswordPolicies != nil {
+		policies := strings.Split(string(*user.PasswordPolicies), ",")
+		for _, p := range policies {
+			if strings.EqualFold(strings.TrimSpace(p), "DisableStrongPassword") {
+				disableStrongPassword = true
+			}
+			if strings.EqualFold(strings.TrimSpace(p), "DisablePasswordExpiration") {
+				disablePasswordExpiration = true
+			}
+		}
+	}
+	tf.Set(d, "disable_strong_password", disableStrongPassword)
+	tf.Set(d, "disable_password_expiration", disablePasswordExpiration)
+
 	return nil
 }
 

internal/services/users/user_resource_test.go

@@ -174,8 +174,10 @@ resource "azuread_user" "test" {
   onpremises_immutable_id = "%[1]d"
   usage_location          = "NO"
 
-  password              = "%[2]s"
-  force_password_change = true
+  password                    = "%[2]s"
+  force_password_change       = true
+  disable_strong_password     = true
+  disable_password_expiration = true
 
   age_group                  = "NotAdult"
   business_phones            = ["12345678901"]