Create Azure SQL Server and Azure AD administrators in same request

[timwebster9]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

This is kind of halfway between a bug and a feature request, so apologies if it's not the correct issue type.

It appears that when creating a SQL Server and Azure AD administrator, they are provisioned using separate requests using the REST API (see gist here) However it is possible to create them both in a single request using the properties.administrators field: https://docs.microsoft.com/en-us/rest/api/sql/2021-02-01-preview/servers/create-or-update

The reason this would be useful is for users of Azure Policy. For example, we would like all instances of SQL server to be provisioned with an Azure AD administrator, or the provisioning request should be rejected. Because this is done in separate requests, we cannot enforce this and have to allow the provisioning of the server without the Azure AD admin. At best we have to use an audit policy and then chase teams to add an Azure AD admin after the fact.

Policy is critically important in enterprise environments, and it makes things difficult in these environments if Terraform and Policy don't play together well.

There is already another resource for adding an Azure AD admin separately, and that could be kept: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/sql_active_directory_administrator

New or Affected Resource(s)

• azurerm_mssql_server

Potential Terraform Configuration

The configuration could remain unchanged:

resource "azurerm_mssql_server" "example" {
  name                         = "mssqlserver"
  resource_group_name          = azurerm_resource_group.example.name
  location                     = azurerm_resource_group.example.location
  version                      = "12.0"
  administrator_login          = "missadministrator"
  administrator_login_password = "thisIsKat11"
  minimum_tls_version          = "1.2"

  azuread_administrator {
    login_username = "AzureAD Admin"
    object_id      = "00000000-0000-0000-0000-000000000000"
  }

}

[aristosvo]

#13622 is merged, I'll give it a try!

[aristosvo]

@timwebster9 It is working for creation of new servers (PR follows soon), but updates cannot be done following the same mechanism, still possibly breaking your policy at the moment.

I'm figuring out if it is possible to work around that issue as well, as it might happen that you want to change admins.

[github-actions]

This functionality has been released in v2.82.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.