CODE OR CONSOLE
What changes when your tenant lives in Git.
TerraProvider keeps Intune and Entra ID as Terraform code in your repository, so every change is a plan your team can review before it reaches the tenant. Here is how that compares with clicking in the Microsoft Intune and Microsoft Entra admin centers, and when a management console fits your team better.
- terraprovider/microsoft365wp
- Terraform and OpenTofu
- Business Source License 1.1
# microsoft365wp_conditional_access_policy.require_mfa_admins will be updated in-place ~ resource "microsoft365wp_conditional_access_policy" "require_mfa_admins" { ~ conditions = { ~ users = { ~ exclude_users = [ - "7c1e4a90-3f2b-4d8e-9a61-0b5c2e8f1d47", ] # (8 unchanged attributes hidden) } # (6 unchanged attributes hidden) } id = "2b7f9c3e-8d41-4f6a-b0e2-5c9a1d7e3f80" # (3 unchanged attributes hidden) }Plan: 0 to add, 1 to change, 0 to destroy.
Example data.
SIDE BY SIDE
The same change in the admin centers and in code
A Conditional Access policy, a compliance rule, a second tenant: what happens to each when it is clicked, and what happens when it is a file in your repository.
| Situation | In the admin centers | With TerraProvider |
|---|---|---|
| Before a change goes live | A Conditional Access change is live the moment someone presses Save. | The change is a pull request. The plan shows which attribute moves from what to what before anything touches the tenant. |
| Who agreed, and why | The audit log names the account that saved the policy. The ticket and the reason are somewhere else, if anywhere. | Commit message, pull request and approval sit next to the change. Rolling back is a revert. |
| Test and production | Each tenant is clicked through on its own, and the two drift apart over the months. | One module, applied to both tenants. Where they differ, a variable says so. |
| A change outside the process | The documentation goes on describing the tenant as it was before. | The next plan lists it, including settings your files never mention. You adopt it or put it back. |
| A new tenant | Every policy is clicked through again, with the old tenant open in the next tab. | Import the tenant you have (the quickstart's export is a starting point), then apply the same code to the new one. |
| Changes from a pipeline | Someone signs in to a browser and makes the change by hand. | GitHub Actions and Azure DevOps sign in with OpenID Connect, without a stored secret. |
| Where the configuration lives | In the tenant itself. | In your own Git repository, as HCL that Terraform and OpenTofu both run. The provider's source is public under the Business Source License 1.1. |
WHICH FITS
Code fits teams that already review changes in pull requests
Which way fits depends less on the tenant than on the team: who makes a change, and where it gets reviewed.
TerraProvider fits when
- Your team already writes Terraform for Azure and reviews it in pull requests.
- A Conditional Access change needs a second pair of eyes before it goes live.
- Test and production have to stay alike, and where they differ has to be readable.
- Changes should run from GitHub Actions or Azure DevOps, not from someone's browser.
A management console fits better when
- Nobody on the team writes HCL, and nobody plans to.
- Changes are made by people in a browser, and the team wants to keep it that way.
TENANT TEAMS AND MSPS
One provider for your own tenant and for your customers' tenants
A team that runs its own tenant puts test and production under one module. A managed service provider gives every customer tenant its own provider block and calls the same baseline module for all of them; the exceptions are variables a reviewer can read.
- Your own tenant: the Community Edition is free for organizations with up to 99 users, and Enterprise adds support from 100 users.
- Customer tenants: the Community Edition doesn't cover them, so they need a plan of their own. Contact sales
provider "microsoft365wp" { alias = "contoso" tenant_id = "8a1f3c2e-5b7d-4e90-a6c4-2d9e7f1b0c35"}provider "microsoft365wp" { alias = "fabrikam" tenant_id = "e4c27b91-0d3a-4f86-b5e2-7a1c9d0f6b48"}module "baseline_contoso" { source = "./baseline" providers = { microsoft365wp = microsoft365wp.contoso }}module "baseline_fabrikam" { source = "./baseline" providers = { microsoft365wp = microsoft365wp.fabrikam } allow_byod = true}
Example data.
See your own tenant as a plan.
Request a trial of Enterprise, or start with the Community Edition, free for organizations with up to 99 users.