Terraform-provider-azuredevops: Import groups and members from AAD directly to newly created azure devops project

[rusticshiv86]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Recreated the issue here as requested by @xuzhang3

Currently, we can easily create user entitlements and assign them to newly created local groups within Azure DevOps. However, it would be very effective if we could have something similar for groups too.

Use case -

Create ADO Project => Create ADO group => import existing AAD group members ( or group itself) as "members" for created group.

Simply put => importing group from AAD directly into given project. Tried lot of ways already but did not help.

New or Affected Resource(s)

group and members resource as part of given provider

azuredevops_group
azuredevops_group_membership
azuredevops_user_entitlement

• azuredevops_XXXXX

Potential Terraform Configuration

resource "azuredevops_group" "ado_gp" {
scope = azuredevops_project.ado_prj.id
display_name = "ado-gp-dev"
description = "ADO Group for dev"

members = [
"aXXXXXXXXX" <= existing group from aad not individual member/s
]
}

References

https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-azure-active-directory-groups?view=azure-devops&tabs=preview-page

• #0000

[xuzhang3]

Potential configure:

azuredevops_menbershiop {
     groups { 
            name= "admin"
            desc:= "group description"
            members: {
                mem1,
                mem2,
            }
    }
}

[billbirchatcoles]

Hi,

We (Coles) are starting on this - to update the provider to include this feature. Our fork is https://github.com/colesgroup/terraform-provider-azuredevops.

Our branch is MADM-641-Import-groups-and-members-from-AAD-to-newly-created-project

Regards,
Bill

[josh-barker-coles]

@xuzhang3

The below code will create an AAD Group, create an AZDO Group, and add the AAD Group into the AZDO Group as a member.
I found to destroy azdo_group_linked_to_aad, you need elevated permissions; Project Collection Administrators is sufficient, but I'm not sure if there's another group that would allow you to create/delete the AZDO group.

resource "azuread_group" "aad_group" {
  name                    = "Example-AAD-Group"
  prevent_duplicate_names = true
}



resource "azuredevops_project" "p" {
  name = "Group-Demo"
}

# AZDO Group
resource "azuredevops_group" "azdo_group" {
  scope        = azuredevops_project.p.id
  display_name = "Example-AZDO-Group"
}

# AZDO needs to know the group descriptor to add a member
# So, to get a group descriptor we need to link the aad group to an azdo group.
resource "azuredevops_group" "azdo_group_linked_to_aad" {
  origin_id = azuread_group.aad_group.object_id
}

resource "azuredevops_group_membership" "membership" {
  group = azuredevops_group.azdo_group.descriptor

  members = [
    azuredevops_group.azdo_group_linked_to_aad.descriptor
  ]
}

[schwarzzz]

Thank you @josh-barker-coles, this is working.
One question, though: Does this (the use of the azdo_group_linked_to_aad group) create any (otherwise) unnecessary objects in Azure DevOps? I checked the resulting project as well as the organization and did find a corresponding object in Azure DevOpy...

[josh-barker-coles]

Hi @schwarzzz,

You could try add group membership directly on the linked group - azdo_group_linked_to_aad, and not create azdo_group.
However, there could be some limitations on the linked Azure DevOps group.
For example, I don't think you can change the name of the group, as it's linked to Azure AD.