FAQ
Questions teams ask before they start with TerraProvider.
What it manages, how it signs in, which edition fits and how buying works, grouped by topic.
What it manages and what a plan changes
01Does it create users and groups?
No. Users, groups, applications and service principals are lookups: you can read them and reference their ids. Create groups with HashiCorp's azuread provider, as the quickstart does, and assign policies to them with TerraProvider.
02How is TerraProvider different from Microsoft365DSC?
They work in different toolchains. Microsoft365DSC is built on PowerShell Desired State Configuration; TerraProvider is a provider for Terraform and OpenTofu, so your tenant settings are written in HCL and use the same state, plans and pipelines as your Azure resources. If your team already runs Terraform or OpenTofu, it fits into what you have.
03Can we use it next to the azuread provider or another Microsoft 365 provider?
Yes. The quickstart does it: groups come from HashiCorp's azuread provider, and TerraProvider assigns policies to them in the same configuration. Let one provider own each object: TerraProvider watches every attribute of the objects it manages, so a change another tool makes to one of them shows up in the next plan.
04We configured our tenant by hand. Do we start over?
No. Every resource can be imported into the Terraform state, and the quickstart exports groups, filters, notification templates, compliance policies, configuration policies into code and imports them for you. Expect a short clean-up after the first plan; the export is a starting point, not a perfect copy.
05What happens to settings we don't write down?
They get the default the Microsoft portals use, and the plan watches them like everything else. A change made in the portal shows up in the next plan; the next apply resets it, unless you put the new value into your file.
Setup and sign-in
01Does it work with OpenTofu?
Yes. The provider is listed in the OpenTofu Registry under the same address, terraprovider/microsoft365wp, and the quickstart's own workflows run OpenTofu. Your configuration doesn't change when you switch.
02Which permissions does it need?
Microsoft Graph application permissions for the objects you manage, granted with admin consent: for example DeviceManagementConfiguration.ReadWrite.All for Intune policies and Policy.ReadWrite.ConditionalAccess for Conditional Access. The full list is on the How it works page.
03Can a pipeline run it without a stored secret?
Yes. Use OpenID Connect from GitHub Actions or an Azure DevOps service connection; the provider reads the same ARM_* settings as the azuread provider. For local work it uses your Azure CLI sign-in.
04Does it work in government clouds?
Yes. Set the environment to US Government L4, US Government L5 (DoD) or China, or point it at your own metadata host.
Editions and licenses
01Is there a free edition?
Yes. The Community Edition is free for organizations with up to 99 users. It's for your own tenant, configured by your own employees, needs a registration and comes without support. Service providers can't use it for customers.
02Is the code open?
The source is public on GitHub under the Business Source License 1.1. You can read and test it freely; production use needs a subscription, and the Community Edition is one, free of charge.
03Who counts as a user?
Every user in the tenant who is licensed for Microsoft Intune P1 or Microsoft Entra ID P1 or higher. Users without either license don't count.
04We manage tenants for customers. Which plan is ours?
Using TerraProvider for customer tenants needs its own plan. Talk to us.
05Do non-profits get a discount?
Talk to us; there is special pricing for non-profit organizations.
Buying and support
01What's the smallest package?
100 users. Packages include 100, 250, 1,000, 2,500 and 10,000 users; if you need more than your package includes, you add users at that package's per-user price. The table above shows both.
02Can we pay monthly?
No. Subscriptions run for a year and are billed for the whole year in advance.
03Can we buy through the Azure Marketplace?
Yes, with an Azure subscription on which you have the Owner or Contributor role, in 56 countries and regions. Microsoft bills you only after the cancellation grace period, and after checkout we create your license within one business day.
04Is support included?
In Enterprise, yes: by ticket, Monday to Friday, 08:00 to 18:00 CET/CEST, with a typical response under 8 hours for incidents, in English. The Community Edition has no support.