title: Terraform AzureRM domain-join fails due to account lockout
body: <p>I'm creating terraform configuration files to rapidly create and destory demo environments for our prospective customers. These environments are pretty simple, containing a few VMs in single vnet with a single subnet, some for management, some for apps, and one as an AVD session host.</p>
  <p>I have seen this work perfectly well a handfull of times, but most of the time it fails during the VM domain-join. When I troubleshoot the issue it's always because the account being used for the doman-join is locked out. I have confirmed this by connecting to the VM via the bastion and manually attempting the domain-join.</p>
  <p>Here's my config to create the admin account used for domain join:</p>
  <pre><code>resource &quot;azuread_group&quot; &quot;dc_admins&quot; {
      display_name     = &quot;AAD DC Administrators&quot;
      security_enabled = true
  }
  
  resource &quot;azuread_user&quot; &quot;admin&quot; {
      user_principal_name = join(&quot;@&quot;, [var.admin_username, var.onmicrosoft_domain])
      display_name        = var.admin_username
      password            = var.admin_password
      depends_on = [
          azuread_group.dc_admins
      ]
  }
  
  resource &quot;azuread_group_member&quot; &quot;admin&quot; {
      group_object_id  = azuread_group.dc_admins.object_id
      member_object_id = azuread_user.admin.object_id
      depends_on = [
          azuread_group.dc_admins,
          azuread_user.admin
      ]
  }
  </code></pre>
  <p>Here's my domain-join config:</p>
  <pre><code>resource &quot;azurerm_virtual_machine_extension&quot; &quot;domain_join_mgmt_devices&quot; {
    name                 = &quot;join-domain&quot;
    virtual_machine_id   = azurerm_windows_virtual_machine.mgmtvm[count.index].id
    publisher            = &quot;Microsoft.Compute&quot;
    type                 = &quot;JsonADDomainExtension&quot;
    type_handler_version = &quot;1.0&quot;
    depends_on           = [
      azurerm_windows_virtual_machine.mgmtvm,
      azurerm_virtual_machine_extension.install_rsat_tools
    ]
    count                = &quot;${var.vm_count}&quot;
  
    settings = &lt;&lt;SETTINGS
      {
          &quot;Name&quot;: &quot;${var.onmicrosoft_domain}&quot;,
          &quot;OUPath&quot;: &quot;OU=AADDC Computers,DC=hidden,DC=onmicrosoft,DC=com&quot;,
          &quot;User&quot;: &quot;${var.onmicrosoft_domain}\\${var.admin_username}&quot;,
          &quot;Restart&quot;: &quot;true&quot;,
          &quot;Options&quot;: &quot;3&quot;
      }
  SETTINGS
  
    protected_settings = &lt;&lt;PROTECTED_SETTINGS
      {
          &quot;Password&quot;: &quot;${var.admin_password}&quot;
      }
  PROTECTED_SETTINGS
  }
  </code></pre>
  <p>Here's the console output for the plan:</p>
  <pre><code>Terraform will perform the following actions:
  
    # azurerm_virtual_machine_extension.domain_join_mgmt_devices[0] will be created
    + resource &quot;azurerm_virtual_machine_extension&quot; &quot;domain_join_mgmt_devices&quot; {
        + id                   = (known after apply)
        + name                 = &quot;join-domain&quot;
        + protected_settings   = (sensitive value)
        + publisher            = &quot;Microsoft.Compute&quot;
        + settings             = jsonencode(
              {
                + Name    = &quot;hidden.onmicrosoft.com&quot;
                + OUPath  = &quot;OU=AADDC Computers,DC=hidden,DC=onmicrosoft,DC=com&quot;
                + Options = &quot;3&quot;
                + Restart = &quot;true&quot;
                + User    = &quot;hidden.onmicrosoft.com\\admin_username&quot;
              }
          )
        + type                 = &quot;JsonADDomainExtension&quot;
        + type_handler_version = &quot;1.0&quot;
        + virtual_machine_id   = &quot;/subscriptions/hiddensubid/resourceGroups/demo-rg/providers/Microsoft.Compute/virtualMachines/mgmt-vm1&quot;
      }
  
  Plan: 1 to add, 0 to change, 0 to destroy.
  </code></pre>
  <p>I cannot for the life of my figure out what is locking the account. It's a fresh account, in a fresh subscription, created by the Terraform configuration prior to being used for the domain-join action.</p>
  <p>Has anyone else seen anything like this?</p>
  <ul>
  <li>Am I missing some knowledge about AAD, AD DS, cloud-only managed
  domains?</li>
  <li>I create the AAD DC Administrative user before creating the AAD DS managed domain. Could this be an issue?</li>
  <li>Should I wait X minutes before creating an admin account and  using it for administrative actions?</li>
  <li>Is it possible, using Terraform and AzureRM, to prevent an AAD account from being locked out?</li>
  </ul>