How to fix AzureRM Error Listing Service Principals with Status Code 403 in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 101 views

The 403 error when listing Azure service principals in Terraform occurs due to insufficient permissions on your service principal. This error typically happens when upgrading Azure provider versions or when your service principal lacks required Microsoft Graph API permissions.

Quick fix

Fixes 403

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}
  1. Upgrade to AzureRM provider version 3.x or later
  2. Add required Microsoft Graph API permissions to service principal
  3. Grant admin consent for the permissions
  4. Verify token contains required permissions
terraform — error
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}
provider "azurerm" {
  features {}
}
AzureRM Error Listing Service Principals with Status Code 403

What this error means

This error occurs when the Terraform AzureRM or AzureAD provider attempts to list service principals but receives a 403 Forbidden response from Azure. The status code 403 means the authenticated principal does not have authorization to perform this operation. This commonly happens in two scenarios: when using deprecated Azure AD Graph API (in older provider versions 1.x and 2.x) which was retired by Microsoft, or when your service principal lacks the required Microsoft Graph API permissions like Group.Read.All and Directory.Read.All.

Typical symptoms

  • Terraform plan fails with "Error listing Service Principals: autorest.DetailedError"
  • Status code 403 appears in error message
  • Error occurs during terraform init or terraform plan phases
  • Problem occurs even after terraform init completes successfully
  • Using AzureRM provider version 1.x or 2.x
  • Error message includes "graphrbac.ServicePrincipalsClient"

Common causes

  1. Using outdated AzureRM provider (version 1.x or 2.x) that relies on deprecated Azure AD Graph API
  2. Service principal missing Group.Read.All permission
  3. Service principal missing Directory.Read.All permission
  4. Admin consent not granted for Microsoft Graph API permissions
  5. Service principal lacking Application.ReadWrite.All for application management
  6. Azure AD Graph API deprecated (Microsoft sunset it on July 1, 2025)
  7. Token does not contain required roles or permissions

How to fix "AzureRM Error Listing Service Principals with Status Code 403"

1Upgrade to AzureRM provider version 3.x or later

Update your Terraform configuration to use the latest AzureRM provider which uses Microsoft Graph API instead of the deprecated Azure AD Graph API:

hcl
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

Then run:

bash
terraform init
terraform plan
2Add required Microsoft Graph API permissions to service principal

Navigate to your Azure portal and grant the service principal the required permissions:

1. Go to Azure AD > App registrations > Select your app
2. Click "API permissions" in the left sidebar
3. Click "Add a permission"
4. Select "Microsoft Graph"
5. Choose "Application permissions"
6. Search for and select:
 - Directory.Read.All
 - Group.Read.All
 - Application.ReadWrite.All (if managing applications)
7. Click "Add permissions"

3Grant admin consent for the permissions

The permissions must be granted by a tenant administrator:

1. Stay on the "API permissions" page
2. Look for the blue button "Grant admin consent for [TenantName]"
3. Click this button
4. Confirm the consent dialog
5. Wait a few moments for the consent to take effect

After granting consent, the permissions should show "Granted for [TenantName]".

4Verify token contains required permissions

Decode your service principal token to verify permissions are included:

bash
# Get an access token (using Azure CLI with service principal)
az account get-access-token --query accessToken -o tsv

# Decode the token at https://jwt.ms

For service principal authentication, check the "roles" claim. For delegated authentication, check the "scp" claim. Both should include the permissions you granted.

5Apply Terraform configuration with updated provider

Run Terraform with the updated configuration:

bash
terraform init
terraform plan
terraform apply

The 403 error should no longer appear as your service principal now has the required permissions and the provider uses Microsoft Graph API.

6For delegated vs application permissions mismatch

If you're still experiencing issues, verify the correct permission type:

- Service Principal (Application): Requires Application permissions (not Delegated)
- User-based access: Requires Delegated permissions

In your Terraform service principal scenario, you need Application permissions. Ensure under "API permissions" you selected "Application permissions" and not "Delegated permissions".

Advanced notes

The Azure AD Graph API retirement timeline: deprecated since September 1, 2024, with full retirement scheduled for July 1, 2025. All new applications are blocked from accessing Azure AD Graph since February 1, 2025. If you cannot upgrade immediately, you may need to temporarily use Azure CLI or PowerShell with the service principal instead of Terraform. In CI/CD pipelines, ensure the service principal executing Terraform has these permissions in all environments (dev, staging, production). Some organizations restrict Application.ReadWrite.All; if so, discuss with your Azure administrator about using Application.ReadWrite.OwnedBy which only manages applications the service principal owns. For Cloud Shell environments, note that ARM_SUBSCRIPTION_ID and ARM_TENANT_ID environment variables may be overwritten - verify these match your intended service principal.

Frequently asked questions

What does "403" mean?
This error occurs when the Terraform AzureRM or AzureAD provider attempts to list service principals but receives a 403 Forbidden response from Azure. The status code 403 means the authenticated principal does not have authorization to perform this operation. All.
How do I fix "403"?
The 403 error when listing Azure service principals in Terraform occurs due to insufficient permissions on your service principal. This error typically happens when upgrading Azure provider versions or when your service principal lacks required Microsoft Graph API permissions.
What causes "403"?
Using outdated AzureRM provider (version 1.x or 2.x) that relies on deprecated Azure AD Graph API Service principal missing Group.Read.All permission Service principal missing Directory.Read.All permission
Is the "403" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading