How to fix AzureRM Error Listing Service Principals with Status Code 403 in Terraform

Update your Terraform configuration to use the latest AzureRM provider which uses Microsoft Graph API instead of the deprecated Azure AD Graph API:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

Then run:

terraform init
terraform plan

Navigate to your Azure portal and grant the service principal the required permissions:

1. Go to Azure AD > App registrations > Select your app
2. Click "API permissions" in the left sidebar
3. Click "Add a permission"
4. Select "Microsoft Graph"
5. Choose "Application permissions"
6. Search for and select:
- Directory.Read.All
- Group.Read.All
- Application.ReadWrite.All (if managing applications)
7. Click "Add permissions"

The permissions must be granted by a tenant administrator:

1. Stay on the "API permissions" page
2. Look for the blue button "Grant admin consent for [TenantName]"
3. Click this button
4. Confirm the consent dialog
5. Wait a few moments for the consent to take effect

After granting consent, the permissions should show "Granted for [TenantName]".

Decode your service principal token to verify permissions are included:

# Get an access token (using Azure CLI with service principal)
az account get-access-token --query accessToken -o tsv

# Decode the token at https://jwt.ms

For service principal authentication, check the "roles" claim. For delegated authentication, check the "scp" claim. Both should include the permissions you granted.

Run Terraform with the updated configuration:

terraform init
terraform plan
terraform apply

The 403 error should no longer appear as your service principal now has the required permissions and the provider uses Microsoft Graph API.

If you're still experiencing issues, verify the correct permission type:

- Service Principal (Application): Requires Application permissions (not Delegated)
- User-based access: Requires Delegated permissions

In your Terraform service principal scenario, you need Application permissions. Ensure under "API permissions" you selected "Application permissions" and not "Delegated permissions".