Tom Bamford

Hi @Keith-EMP, thanks for reporting your use case and this error. Unfortunately, the API has some long standing bugs around `sessionControls` which limits our options significantly, but I will have...

Thanks for reporting @rohernan. This is an unusual one, would you be able to obtain and send a [debug log](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs#logging-and-tracing)? This will show the full API request and response which...

@rohernan That's great, thanks. We'll have to try to infer what that response is supposed to mean, since it's both undocumented and noncompliant (no Location header). Do you perhaps already...

@rohernan Very interesting - many thanks for the feedback, I'll look into this further and try find out what the responses are supposed to be doing.

Thanks for requesting this @Keith-EMP. We already support [assignment policies](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/access_package_assignment_policy) for entitlement management, is this what you're looking for?

Thanks for reporting @hegerdes. Just wanted to note that you can perform admin grants with Terraform, using the [azuread_app_role_assignment resource](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/app_role_assignment) (for roles) and the [azuread_service_principal_delegated_permission_grant](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal_delegated_permission_grant) resource (for scopes) - which...

@ryan-royals Thanks for the PR and apologies for the delay - I would like to manually test this before merging as permissions for groups are tricky and don't align well...

Possible core/sdk issue, requires investigation

Are you making sure to sign out and sign back in to Azure CLI after assigning directory roles? You can also try deleting the `~/.azure` directory and signing back in...

Looks like we need to update our docs guidance for this data source, as the API docs state that `EntitlementManagement.Read.All` is needed. That said, you should probably get this permissions...