Discover our products
Request a trial
enen
DeutschGermanDEEnglishEnglishENEspañolSpanishESFrançaisFrenchFRSvenskaSwedishSVSuomiFinnishFIDanskDanishDA한국어KoreanKONederlandsDutchNLItalianoItalianITÍslenskaIcelandicISNorskNorwegianNO日本語JapaneseJA

Written in English, translated by Claude. Something lost in translation? Please tell us.

COVERAGE

What TerraProvider manages in Intune and Entra ID.

Every resource in version 0.20.2, grouped the way you'd look for it. Each one has a docs page in the Terraform Registry, and each one can be imported from a live tenant.

  • 60 resources
  • 127 data sources
  • 25 Graph areas
  • version 0.20.2

Eight families of resources

The registry sorts the resources into 25 Graph areas. Here they're in the eight groups an Intune or Entra ID admin would use.

  • 15 resources

    Intune devices

    Settings catalog and classic configuration profiles, compliance policies and scripts, filters, PowerShell and shell scripts, Windows feature and driver updates.

  • 8 resources

    Intune apps

    Apps of 21 types with their packages, app protection and app configuration policies, categories, Company Portal branding.

  • 4 resources

    Enrollment

    Autopilot profiles and their assignments, enrollment restrictions and settings, the Microsoft Defender for Endpoint connector.

  • 10 resources

    Conditional Access and sign-in

    Conditional Access, authentication contexts and strengths, authentication methods, security defaults, authorization, device registration and external identities policies.

  • 4 resources

    Cross-tenant access

    Default and per-partner inbound and outbound settings, cross-tenant synchronization.

  • 10 resources

    Roles and governance

    Custom roles, PIM role settings, lifecycle workflows, administrative units, custom security attributes, group-based licensing, connected organizations.

  • 2 resources

    Windows 365

    Cloud PC provisioning policies and user settings.

  • 7 resources

    Network and apps

    Application proxy connector groups, IP application segments, Global Secure Access tenant status, the tenant's SharePoint settings, a provisioning schema.

All 60 resources

Filter by family. The name links to the resource's docs, with every attribute and its default.

All 60 resources
ResourceAreaKind
microsoft365wp_administrative_unitDirectory management
microsoft365wp_android_managed_app_protectionApp management
microsoft365wp_attribute_setCustom security attributes
microsoft365wp_authentication_combination_configurationAuthentication
microsoft365wp_authentication_context_class_referenceConditional access
microsoft365wp_authentication_flows_policyPoliciesTenant setting
microsoft365wp_authentication_methods_policyAuthenticationTenant setting
microsoft365wp_authentication_strength_policyAuthentication
microsoft365wp_authorization_policyPoliciesTenant setting
microsoft365wp_azure_ad_windows_autopilot_deployment_profileCorporate enrollment
microsoft365wp_azure_ad_windows_autopilot_deployment_profile_assignmentCorporate enrollment
microsoft365wp_cloud_pc_provisioning_policyCloud PC
microsoft365wp_cloud_pc_user_settingCloud PC
microsoft365wp_conditional_access_policyConditional access
microsoft365wp_connected_organizationEntitlement management
microsoft365wp_connector_groupOn-premises publishing
microsoft365wp_connector_group_applicationOn-premises publishing
microsoft365wp_connector_group_member_connectorOn-premises publishing
microsoft365wp_cross_tenant_access_policyCross-tenant accessTenant setting
microsoft365wp_cross_tenant_access_policy_configuration_defaultCross-tenant accessTenant setting
microsoft365wp_cross_tenant_access_policy_configuration_partnerCross-tenant access
microsoft365wp_cross_tenant_identity_sync_policy_partnerCross-tenant access
microsoft365wp_custom_security_attribute_definitionCustom security attributes
microsoft365wp_device_and_app_management_assignment_filterAssignments
microsoft365wp_device_compliance_policyDevice configuration
microsoft365wp_device_compliance_scriptDevice management
microsoft365wp_device_configurationDevice configuration
microsoft365wp_device_configuration_customDevice configuration
microsoft365wp_device_custom_attribute_shell_scriptDevice management
microsoft365wp_device_enrollment_configurationOnboarding
microsoft365wp_device_management_configuration_policyDevice configuration
microsoft365wp_device_management_configuration_policy_jsonDevice configuration
microsoft365wp_device_management_intentDevice management
microsoft365wp_device_management_scriptDevice management
microsoft365wp_device_registration_policyPoliciesTenant setting
microsoft365wp_device_shell_scriptDevice management
microsoft365wp_external_identities_policyIdentity and sign-inTenant setting
microsoft365wp_group_assigned_licenseLicenses and subscriptions
microsoft365wp_identity_governance_custom_task_extensionLifecycle workflows
microsoft365wp_identity_governance_lifecycle_management_settingsLifecycle workflowsTenant setting
microsoft365wp_identity_governance_workflowLifecycle workflows
microsoft365wp_identity_security_defaults_enforcement_policyPoliciesTenant setting
microsoft365wp_intune_branding_profileMobile app management (MAM)
microsoft365wp_ios_managed_app_protectionApp management
microsoft365wp_ip_application_segmentApplications
microsoft365wp_managed_device_mobile_app_configurationApp management
microsoft365wp_mobile_appApp management
microsoft365wp_mobile_app_categoryApp management
microsoft365wp_mobile_threat_defense_connector_microsoft_defenderOnboardingTenant setting
microsoft365wp_mobility_management_policyApp management
microsoft365wp_networkaccess_tenant_statusNetwork access (preview)Tenant setting
microsoft365wp_notification_message_templateDevice management
microsoft365wp_sharepoint_settingsSites and listsTenant setting
microsoft365wp_synchronization_schema_jsonSynchronization
microsoft365wp_targeted_managed_app_configurationApp management
microsoft365wp_unified_role_definitionRole management
microsoft365wp_unified_role_management_policyRole management
microsoft365wp_windows_driver_update_profileSoftware updates
microsoft365wp_windows_feature_update_profileSoftware updates
microsoft365wp_windows_management_appDevice managementTenant setting

Every resource also exists as a data source, so you can read an object you don't manage yet. Version 0.20.2; the next release adds the profile card property.

TENANT-WIDE

Tenant-wide settings are resources too

13 of the resources exist once per tenant. They're rarely touched, which is exactly why they drift: the last person who changed them has often left.

  • Authentication methods

    Which methods users may register and use.

    authentication_methods_policy

  • Authorization policy

    What default users may do, from creating apps to registering agent identity blueprints.

    authorization_policy

  • Security defaults

    On or off.

    identity_security_defaults_enforcement_policy

  • Device registration

    Who may join and register devices.

    device_registration_policy

  • Self-service sign-up

    Whether external users may sign up on their own.

    authentication_flows_policy

  • External identities

    Whether external users may leave the tenant.

    external_identities_policy

  • Cross-tenant access

    The tenant's policy object.

    cross_tenant_access_policy

  • Cross-tenant defaults

    Inbound and outbound settings for every tenant without its own entry.

    cross_tenant_access_policy_configuration_default

  • Lifecycle workflow settings

    Sender domain and branding of workflow emails.

    identity_governance_lifecycle_management_settings

  • Defender for Endpoint connector

    The connector's settings in Intune.

    mobile_threat_defense_connector_microsoft_defender

  • Windows management app

    The managed installer setting.

    windows_management_app

  • Global Secure Access

    The tenant's onboarding status.

    networkaccess_tenant_status

  • SharePoint

    The tenant's SharePoint settings, such as sharing.

    sharepoint_settings
READ-ONLY

What it reads but doesn't create

These objects come from somewhere else: your identity process, Microsoft or another provider. TerraProvider looks them up so your policies can point at them. In short: users, groups, applications, service principals and license SKUs, plus a few helpers.

What it reads but doesn't create
Data sourceWhat you use it for
applicationReference an app registration, for example in Conditional Access.
cloud_pc_device_imagePick your own Windows 365 image.
cloud_pc_gallery_imagePick a Windows 365 gallery image for a provisioning policy.
connectorFind an application proxy connector to put into a connector group.
groupAssign a policy to an existing group. Create groups with HashiCorp's azuread provider.
identity_governance_task_definitionFind a built-in lifecycle workflow task.
identity_governance_workflow_versionRead earlier versions of a lifecycle workflow.
service_principalReference an enterprise app.
subscribed_skuLook up a license SKU for group-based licensing.
unified_role_management_policy_assignmentFind which PIM policy belongs to which role.
userFind a user's id for an assignment or an exclusion.

Two functions for app packages

What this provider doesn't cover

If an object you configure in the Intune or Entra admin center isn't in the list, it isn't managed yet. Exchange Online, Teams, Purview and the rest of SharePoint Online are outside this provider. Ask for what you need on the GitHub issue tracker. The maintainers often decide what comes next by the number of thumbs-up on an issue, so a thumbs-up helps more than a "+1" comment.

Open an issue on GitHub

What this provider covers
ScopeWhich objects
Managed60 resources in 25 areas of Intune and Entra ID
Read onlyUsers, groups, app registrations and service principals
Not part of this providerExchange Online, Teams, Purview, SharePoint Online beyond the tenant's SharePoint settings

Run a plan against your own tenant.

Every resource above has its own page in the Terraform Registry. The Community Edition is free for organizations with up to 99 users.

Open the docsRequest a trial