The sessionControls
field of conditional access policies is validated incorrectly and inconsistently. When updating an existing conditional access policy to disable signInFrequency
, sometimes this is not possible because the API does not accept the request. This happens with both the v1.0 and beta endpoints.
Example Request
PATCH /v1.0/57934744-b9ca-4e29-b5df-7578783cc31b/identity/conditionalAccess/policies/8eca5441-5a49-4273-b494-5171957fa938 HTTP/1.1
Host: graph.microsoft.com
User-Agent: HashiCorp Terraform/1.0.6 (+https://www.terraform.io) Terraform Plugin SDK/2.7.0 terraform-provider-azuread/dev Hamilton (Go-http-client/1.1) pid-222c6c49-1b0a-5959-a213-6608f9eb8820
Content-Length: 835
Accept: application/json
Authorization: Bearer [redacted]
Content-Type: application/json; charset=utf-8
Accept-Encoding: gzip
{
"conditions": {
"applications": {
"includeApplications": [
"All"
],
"excludeApplications": [],
"includeUserActions": []
},
"users": {
"includeUsers": [
"All"
],
"excludeUsers": [
"GuestsOrExternalUsers"
],
"includeGroups": [],
"excludeGroups": [],
"includeRoles": [],
"excludeRoles": []
},
"clientAppTypes": [
"browser"
],
"locations": {
"includeLocations": [
"All"
],
"excludeLocations": []
},
"platforms": {
"includePlatforms": [
"all"
],
"excludePlatforms": []
},
"signInRiskLevels": [],
"userRiskLevels": []
},
"displayName": "acctest-CONPOLICY-210916131029741032",
"grantControls": {
"operator": "OR",
"builtInControls": [
"block"
],
"customAuthenticationFactors": [],
"termsOfUse": []
},
"id": "f0b63446-86b9-4f21-8668-5923f4d9db6e",
"sessionControls": {
"applicationEnforcedRestrictions": {
"isEnabled": false
},
"cloudAppSecurity": {
"isEnabled": false
},
"signInFrequency": {
"isEnabled": false
}
},
"state": "disabled"
}
400 Response
HTTP/1.1 400 Bad Request
Date: Thu, 16 Sep 2021 12:46:18 GMT
Content-Type: application/json
Cache-Control: no-cache
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: 33432bcb-7152-4559-a46a-72b6a86466de
client-request-id: 33432bcb-7152-4559-a46a-72b6a86466de
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"LN2PEPF00003AC1"}}
{
"error": {
"code": "BadRequest",
"message": "1019: SignInFrequency type is invalid. It must be a valid hour or day. For examples, please see API documentation at https://docs.microsoft.com/en-us/graph/api/conditionalaccesspolicy-update?view=graph-rest-1.0.",
"innerError": {
"date": "2021-09-16T12:46:18",
"request-id": "33432bcb-7152-4559-a46a-72b6a86466de",
"client-request-id": "33432bcb-7152-4559-a46a-72b6a86466de"
}
}
}
Note that this error only happens in some (as yet undetermined) circumstances, other times the same request is accepted without error:
Request
PATCH /v1.0/57934744-b9ca-4e29-b5df-7578783cc31b/identity/conditionalAccess/policies/9374b53d-7b5c-43b8-9d69-777db20ac896 HTTP/1.1
Host: graph.microsoft.com
User-Agent: HashiCorp Terraform/1.0.6 (+https://www.terraform.io) Terraform Plugin SDK/2.7.0 terraform-provider-azuread/dev Hamilton (Go-http-client/1.1) pid-222c6c49-1b0a-5959-a213-6608f9eb8820
Content-Length: 835
Accept: application/json
Authorization: Bearer [redacted]
Content-Type: application/json; charset=utf-8
Accept-Encoding: gzip
{
"conditions": {
"applications": {
"includeApplications": [
"All"
],
"excludeApplications": [],
"includeUserActions": []
},
"users": {
"includeUsers": [
"All"
],
"excludeUsers": [
"GuestsOrExternalUsers"
],
"includeGroups": [],
"excludeGroups": [],
"includeRoles": [],
"excludeRoles": []
},
"clientAppTypes": [
"browser"
],
"locations": {
"includeLocations": [
"All"
],
"excludeLocations": []
},
"platforms": {
"includePlatforms": [
"all"
],
"excludePlatforms": []
},
"signInRiskLevels": [],
"userRiskLevels": []
},
"displayName": "acctest-CONPOLICY-210916133840745958",
"grantControls": {
"operator": "OR",
"builtInControls": [
"block"
],
"customAuthenticationFactors": [],
"termsOfUse": []
},
"id": "ac7412c6-bfdc-4d3b-9ef2-04a2e51f7c24",
"sessionControls": {
"applicationEnforcedRestrictions": {
"isEnabled": false
},
"cloudAppSecurity": {
"isEnabled": false
},
"signInFrequency": {
"isEnabled": false
}
},
"state": "disabled"
}
204 Response
HTTP/1.1 204 No Content
Date: Thu, 16 Sep 2021 12:43:13 GMT
Content-Length: 0
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000
request-id: e699dce6-122f-4be9-9130-5a4bf79f8a3e
client-request-id: e699dce6-122f-4be9-9130-5a4bf79f8a3e
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"UK South","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"LN2PEPF00003315"}}
Related to: hashicorp/terraform-provider-azuread#569