title: Service Principal from Terraform not recognized by Azure API
body: <blockquote>
  <p><strong>What specific changes need to be made to the syntax below in order for the terraform azurerm provider to be able to authenticate the service principal that will be created using the following code?</strong></p>
  </blockquote>
  <p><strong>The Problem</strong></p>
  <p>A <strong>Second</strong> Terraform module needs to authenticate to Azure through the azurerm provider with a <code>client_id</code> and <code>client_secret</code> that is created programatically during an earlier, separate process.</p>
  <p>The provider block in the <strong>Second</strong> Terraform module looks like:</p>
  <pre><code>provider &quot;azurerm&quot; {
    subscription_id = var.subscriptionId
    client_id       = var.clientId
    client_secret   = var.clientSecret
    tenant_id       = var.tenantId
  }  
  </code></pre>
  <p>The problem arises when the correct values whcih we validated from the earlier preceding process are not accepted as the <code>var.clientId</code> and the <code>var.clientSecret</code> in the provider code block above.</p>
  <p><strong>How the Service Principal is Created:</strong></p>
  <p>The <code>client_id</code> and <code>client_secret</code> to be used to authenticate to the <strong>Second</strong> Terraform module are currently created by a <strong>First</strong> Terraform module which includes the following:</p>
  <pre><code>resource &quot;azuread_application&quot; &quot;appReg&quot; {
    name = var.appName
  }
  
  resource &quot;azuread_service_principal&quot; &quot;example-sp&quot; {
    application_id = azuread_application.appReg.application_id
  }
  
  resource &quot;azuread_service_principal_password&quot; &quot;example-sp_pwd&quot; {
    service_principal_id = azuread_service_principal.example-sp.id
    value                = &quot;long-random-string&quot;
    end_date             = &quot;2021-06-02T01:02:03Z&quot;
  }
  
  data &quot;azurerm_subscription&quot; &quot;thisSubscription&quot; {
    subscription_id = var.subscriptionId
  }
  
  resource &quot;azurerm_role_assignment&quot; &quot;example-sp_role_assignment&quot; {
    scope                = data.azurerm_subscription.thisSubscription.id
    role_definition_name = &quot;Contributor&quot;
    principal_id         = azuread_service_principal.example-sp.id
  }
  
  resource &quot;azuread_application_app_role&quot; &quot;example-role&quot; {
    application_object_id = azuread_application.appReg.id
    allowed_member_types  = [&quot;User&quot;, &quot;Application&quot;]
    description           = &quot;Admins can manage roles and perform all task actions&quot;
    display_name          = &quot;Admin&quot;
    is_enabled            = true
    value                 = &quot;administer&quot;
  }
  </code></pre>
  <p>Terraform reports <code>Apply complete</code> after the above <strong>First</strong> module is run, and we are also able to confirm in the Azure Portal that the correct Active Directory has a new app registration with name <code>var.appName</code> and with ID equal to what we find in the <strong>First</strong> modules <code>tfstate</code> file.</p>
  <p><strong>The Error Message:</strong></p>
  <p>When Terraform tries to <code>apply</code> the <strong>Second</strong> module using the Service Principal ID and Secret created by the <strong>First</strong> module, the following error is thrown:</p>
  <pre><code>Error: 
  Error building account: 
  Error getting authenticated object ID: 
  Error listing Service Principals: 
  autorest.DetailedError{
    Original:adal.tokenRefreshError{
      message:&quot;adal: Refresh request failed. 
      Status Code = '400'. 
      Response body: {
        \&quot;error\&quot;:\&quot;unauthorized_client\&quot;,
        \&quot;error_description\&quot;:\&quot;AADSTS700016: 
            Application with identifier 'correct-app-id' was not found in the directory 'the-right-ad-id'. 
            This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. 
            You may have sent your authentication request to the wrong tenant.\\r\\n
            Trace ID: some-trace-id\\r\\n
            Correlation ID: correlation-id-redacted\\r\\n
            Timestamp: 2020-12-31 19:02:19Z\&quot;,
            \&quot;error_codes\&quot;:[700016],
            \&quot;timestamp\&quot;:\&quot;2020-12-31 19:02:19Z\&quot;,
            \&quot;trace_id\&quot;:\&quot;some-trace-id\&quot;,
            \&quot;correlation_id\&quot;:\&quot;correlation-id-redacted\&quot;,
            \&quot;error_uri\&quot;:\&quot;https://login.microsoftonline.com/error?code=700016\&quot;
      }&quot;, 
      resp:(*http.Response)(0xc000ac2000)}, 
      PackageType:&quot;azure.BearerAuthorizer&quot;, 
      Method:&quot;WithAuthorization&quot;, 
      StatusCode:400, 
      Message:&quot;Failed to refresh the Token for request to https://graph.windows.net/the-right-ad-id/servicePrincipals?%24filter=appId+eq+%27correct-app-id%27&amp;api-version=1.6&quot;, 
      ServiceError:[]uint8(nil), 
      Response:(*http.Response)(0xc000ac2000)
  }  
  </code></pre>
  <p>The error message does not seem helpful because we validated that the app is registered with the AAD instance.</p>
  <blockquote>
  <p><strong>How can we resolve this problem and programmatically create a <code>client_id</code> and <code>client_secret</code> that will be accepted and usable by the <strong>Second</strong> module?</strong></p>
  </blockquote>