Q: Add an AD Group as a member of already existing Enterprise Application with Terraform Right now I am provisioning an AD Security Group just fine via Terraform with:
resource "azuread_group" "my_group" {
  display_name     = "Test_Group_Terraform"
  owners = ["<hardcoded user>"]
  security_enabled = true
}

I am trying to figure out how to assign this group to be a member of an already existing Enterprise Application.
According to https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/app_role_assignment#example-usage I should be using something like
resource "azuread_app_role_assignment" "example" {
  app_role_id         = azuread_service_principal.internal.app_role_ids["Admin.All"]
  principal_object_id = azuread_group.example.object_id
  resource_object_id  = azuread_service_principal.internal.object_id
}

But how can I do so to an already existing Enterprise Application?

A: Already existing enterprise application /service principal which is previously created using UI in portal, can be used in terraform by first importing it to its terraform state .
Service principals can be imported using their object ID,
e.g.

*

*First the resource must be specified in the root module

main.tf
resource "azuread_service_principal" "mynewappsv" {
#arguments
}

(also application in appregistration can be imported if needed before terraform import azuread_application.mynewapp <objId>)
And then run the terraform import with the apps service principal object id something like below
>terraform import azuread_service_principal.test <objectId here>

Executed:

Then to see or print out the TF state run > terraform show where you can see all the state files present. You can copy the content of azuread serviceprincipal if required to the actual block in .tf file.

*

*Then you can use the resource in the terraform to assign a group to
the service principal.

main.tf (Reference: azuread_app_role_assignment | Resources | hashicorp/azuread | Terraform Registry )
   provider "azurerm" {

  features {}

}
data "azurerm_resource_group" "example" {
  name     = "xxxxxxxxx"  
}
data "azuread_client_config" "current" {}

resource "azuread_application" "mynewapp" {
  display_name = "mynewapp"
  owners       = [data.azuread_client_config.current.object_id]
}

resource "azuread_service_principal" "mynewapp" {
  application_id               = azuread_application.mynewapp.application_id
  app_role_assignment_required = true
  owners                       = [data.azuread_client_config.current.object_id]
}

    resource "azuread_group" "example" {
      display_name     = "example"
      security_enabled = true
    }
    
    #Assign a user and group to an internal application
    resource "azuread_app_role_assignment" "example" {
      app_role_id         = azuread_service_principal.internal.app_role_ids["Admin.All"]
      principal_object_id = azuread_group.example.object_id
      resource_object_id  = azuread_service_principal.mynewapp.object_id
    }

Reference: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal
