Update Terraform azuread to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
azuread (source)	required_provider	major	2.53.1 → 3.8.0

---

Release Notes

hashicorp/terraform-provider-azuread (azuread)

v3.8.0

Compare Source

ENHANCEMENTS:

• dependencies: update go version to 1.25.5 (#​1842)
• dependencies: update go-azure-helpers to v0.76.2 (#​1842)
• dependencies: update go-azure-sdk to v0.20260212.1143955 (#​1842)
• dependencies: update hashicorp/terraform-plugin-sdk/v2 to v2.38.2 (#​1842)
• dependencies: update hashicorp/terraform-plugin-testing to v1.14.0 (#​1842)
• dependencies: update x/crypto to v0.48.0 (#​1842)
• azuread_group - increase default timeout for Create and Update to 30 minutes (#​1541)
• azuread_group_without_members - increase default timeout for Create and Update to 30 minutes (#​1541)

BUG FIXES:

• azuread_group - add a deadline to the context used in the CustomizeDiff (#​1541)
• azuread_group_without_members - add a deadline to the context used in the CustomizeDiff (#​1541)
• azuread_group_role_management_policy - added Eventual Consistency check to avoid misreporting not found during create (#​1836)
• azuread_invitation - added Eventual Consistency check to avoid misreporting not found during create (#​1844)
• azuread_privileged_access_group_assignment_schedule - added Eventual Consistency check to avoid misreporting not found during create (#​1845)

v3.7.0

Compare Source

FEATURES:

• New Resource: azuread_flexible_federated_identity_credential (#​1788)

EHANCEMENTS:

• Dependencies: go-azure-sdk updated to v0.20251029.1173336 (#​1787)
• Dependencies: Go updated to v1.25.3 (#​1792)

BUG FIXES:

• azuread_application - allow retry on 409 Conflict during creation (#​1768)
• azuread_conditional_access_policy - add support for the authentication_flow_transfer_methods property (#​1796)
• azuread_group_role_management_policy - fix update for activation_rule.required_conditional_access_authentication_context (#​1783)

v3.6.0

Compare Source

ENHANCEMENTS:

• data.azuread_named_location - add support for the object_id property (#​1703)
• azuread_named_location - add support for the object_id property (#​1703)

BUG FIXES:

• data.azuread_users - queries that return multiple users with the same mail nickname no longer causes an error (#​1762)

v3.5.0

Compare Source

ENHANCEMENTS:

• azuread_conditional_access_policy - add support for the client_applications.filter property (#​1744)

BUG FIXES:

• azuread_conditional_access_policy - fix support for everyTime restrictions in session_controls request payload (#​1719)

v3.4.0

Compare Source

• dependencies: update hashicorp/hc-install to v0.9.2 (#​1696)
• dependencies: update hashicorp/terraform-exec to v0.23.0 (#​1696)
• dependencies: update hashicorp/terraform-registry-address to v0.2.5 (#​1696)
• dependencies: update x/crypto to v0.38.0 (#​1696)
• dependencies: update x/net to v0.40.0 (#​1696)
• dependencies: update x/oauth2 to v0.30.0 (#​1702)
• dependencies: update x/sync to v0.14.0 (#​1696)
• dependencies: update x/sys to v0.33.0 (#​1696)
• dependencies: update x/text to v0.25.0 (#​1696)
• azuread_application - add support for brk-multihub scheme for redirect_uris (#​1663)
• azuread_application_redirect_uris - add support for brk-multihub scheme for redirect_uris (#​1663)
• azuread_conditional_access_policy - populate members only when membership_kind is set to enumerated (#​1601)

v3.3.0

Compare Source

ENHANCEMENTS:

• dependencies: update Go to 1.24.1 (#​1675)

BUG FIXES:

• azuread_application_pre_authorized - fix unexpected removal of unmanaged pre-authorized apps on delete (#​1659)
• azuread_directory_role - fix for changes in Graph API response for ListRolesResponse in create (#​1575)
• azuread_directory_role_eligibility_schedule_request - fix Read for time based service automatic deletion of request resource (#​1682)

v3.2.0

Compare Source

FEATURES:

• New Resource: azuread_group_without_members (#​1623)

ENHANCEMENTS:

• dependencies: update go-azure-sdk to v0.20250131.1134653 (#​1635)

BUG FIXES:

• azuread_access_package_assignment_policy - fix crash in Read (#​1664)
• azuread_access_package_assignment_policy - fix use of alternative_approver in approval_settings (#​1567)
• azuread_group_role_management_policy - fix endless drift due to approval_status computed (#​1666)

v3.1.0

Compare Source

ENHANCEMENTS:

• dependencies - update golang.org/x/crypto to 0.31.0 (#​1585)
• data.azuread_named_location - add support for country_lookup_method (#​1589)
• azuread_conditional_access_policy - add support for the insider_risk_levels property (#​1597)
• azuread_named_location - add support for country_lookup_method (#​1589)

BUG FIXES:

• azuread_access_package_resource_catalog_association - allow origin IDs that contain / (#​1592)
• azuread_application - the password block can now correctly be removed (#​1430)
• azuread_conditional_access_policy - fix potential panic in expanding conditions (#​1619)
• azuread_group - prevent creation retry when caller hasn't been specified as an owner (#​1593)
• azuread_user - add support for employee_hire_date (#​1437)

v3.0.2

Compare Source

BUG FIXES:

• azuread_group - Fix crash and memory leak (#​1518)

v3.0.1

Compare Source

BUG FIXES:

• data.azuread_group - fix ID parsing bugs and some crashes (#​1499)
• azuread_conditional_access_policy - fix a parsing bug for authentication_strength_policy_id (#​1499)
• azuread_service_principal_certificate - fix a parsing bug for service_principal_id (#​1499)
• azuread_service_principal_claims_mapping_policy_assignment - fix a parsing bug for service_principal_id (#​1499)
• azuread_service_principal_password - fix a parsing bug for service_principal_id (#​1499)
• azuread_service_principal_token_signing_certificate - fix a parsing bug for service_principal_id (#​1499)
• azuread_synchronization_job - fix a parsing bug for service_principal_id (#​1499)
• azuread_synchronization_job_provision_on_demand - fix parsing bugs for service_principal_id and synchronization_job_id (#​1499)
• azuread_synchronization_secret - fix a parsing bug for service_principal_id (#​1499)

v3.0.0

Compare Source

NOTES:

• Major Version: Version 3.0 of the AzureAD Provider is a major version. Some behaviors have changed and some deprecated fields/resources have been removed. Please refer to the 3.0 upgrade guide for more information.
• When upgrading to v3.0 of the AzureAD Provider, we recommend upgrading to the latest version of Terraform Core (which can be found here).

---

Configuration

📅 Schedule: Branch creation - "after 7am and before 11am every weekday" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hmcts-jenkins-a-to-c]

Plan Result (aat)

No changes. Your infrastructure matches the configuration.

[hmcts-jenkins-a-to-c]

Plan Result (prod)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 1 to add, 0 to change, 1 to destroy.

• Replace
  • module.application_insights.azurerm_monitor_activity_log_alert.main[0]

Change Result (Click me)

  # module.application_insights.azurerm_monitor_activity_log_alert.main[0] must be replaced
-/+ resource "azurerm_monitor_activity_log_alert" "main" {
      ~ id                  = "/subscriptions/8999dec3-0104-4a27-94ee-6588559729d1/resourceGroups/ccd-shared-prod/providers/Microsoft.Insights/activityLogAlerts/Application Insights daily cap reached - ccd-prod" -> (known after apply)
      ~ name                = "Application Insights daily cap reached - ccd-prod" -> "Application-Insights-daily-cap-reached-ccd-prod" # forces replacement
        tags                = {
            "application"         = "core-case-data"
            "builtFrom"           = "https://github.com/HMCTS/ccd-shared-infrastructure.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#ccd-community"
            "environment"         = "production"
            "managedBy"           = "CCD"
        }
        # (5 unchanged attributes hidden)

      ~ criteria {
          - levels             = [] -> null
          - resource_groups    = [] -> null
          - resource_ids       = [] -> null
          - resource_providers = [] -> null
          - resource_types     = [] -> null
          - statuses           = [] -> null
          - sub_statuses       = [] -> null
            # (4 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.