Terraform AzureAD Provider v3.10.0: New License and Authentication Strength Resources

Introduction

HashiCorp shipped terraform-provider-azuread v3.10.0 on September 24, 2026. This release focuses on expanding Microsoft Entra ID authentication strength policy management and introduces dedicated resources for assigning licenses to users and groups, alongside a round of dependency bumps and two bug fixes. No breaking changes or deprecations are listed in the release notes.

What Is New

New data source: azuread_authentication_strength_policy

Look up an existing authentication strength policy by display name or ID (#1887). The resource also gained an object_id output attribute (#1954).

data "azuread_authentication_strength_policy" "phishing_resistant" {
  display_name = "Phishing-resistant MFA"
}
 
output "policy_object_id" {
  value = data.azuread_authentication_strength_policy.phishing_resistant.object_id
}

New resources for authentication strength combinations

Two new resources let you manage FIDO2 and X.509 certificate combination configurations on an authentication strength policy directly in HCL rather than through portal-only settings (#1881):

resource "azuread_authentication_strength_policy" "custom" {
  display_name          = "Custom auth strength"
  allowed_combinations   = ["fido2", "x509CertificateMultiFactor"]
}
 
resource "azuread_authentication_strength_policy_fido2_combination_configuration" "example" {
  policy_id         = azuread_authentication_strength_policy.custom.id
  allowed_aaguids   = ["de1e552d-db1d-4423-a619-566b625cdc84"]
}
 
resource "azuread_authentication_strength_policy_x509_combination_configuration" "example" {
  policy_id                    = azuread_authentication_strength_policy.custom.id
  certificate_authentication_type = "multiFactor"
}

New resources for license assignment

azuread_user_license (#1879) and azuread_group_license (#1890) let you manage SKU license assignments as standalone resources instead of inline blocks on azuread_user or azuread_group.

resource "azuread_user_license" "example" {
  user_object_id = azuread_user.example.object_id
  sku_id         = "6fd2c87f-b296-42f0-b197-1e91e994b900" # Office 365 E3
}
 
resource "azuread_group_license" "example" {
  group_object_id = azuread_group.example.object_id
  sku_id          = "6fd2c87f-b296-42f0-b197-1e91e994b900"
}

Data source improvement

azuread_groups now exposes a groups output attribute, returning richer group objects instead of only IDs/names (#1770):

data "azuread_groups" "all" {
  display_name_prefix = "engineering-"
}
 
output "engineering_groups" {
  value = data.azuread_groups.all.groups
}

Bug fixes

• azuread_user data source now reports the actual mail value in lookup error messages instead of an empty string, making failed lookups easier to debug (#1926).
• azuread_service_principal_token_signing_certificate no longer deletes the wrong resource on destroy (#1905). This was a correctness bug worth noting if you manage multiple signing certificates per service principal.

Dependency updates

The release bumps Go to 1.26.6 and refreshes HashiCorp's internal plugin and testing libraries (go-azure-helpers, hc-install, terraform-exec, terraform-plugin-sdk/v2, terraform-plugin-testing) along with several golang.org/x/* packages. These are maintenance updates with no user-facing behavior change called out in the notes.

Upgrade Steps

Pin the provider version and re-initialize:

terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 3.10.0"
    }
  }
}

terraform init -upgrade
terraform plan

Since this is the first tracked version on this site (no prior known version), review your existing azuread_user and azuread_group license blocks if you plan to migrate to the new azuread_user_license / azuread_group_license resources — moving license management out of inline attributes requires state import or a controlled terraform state mv to avoid drift.

Verify

Confirm the provider version and that the new resources are recognized:

terraform version
terraform providers schema -json | jq '.provider_schemas["registry.terraform.io/hashicorp/azuread"].resource_schemas | keys[] | select(test("license|combination_configuration"))'

Run terraform plan against a configuration using one of the new resources or data sources to confirm no errors before applying.

Conclusion

v3.10.0 is a feature-additive release: it strengthens Microsoft Entra ID authentication strength policy management with new FIDO2/X.509 combination resources and separates license assignment into its own resources for users and groups. Two targeted bug fixes improve error messaging and delete correctness. Update the version constraint, run terraform init -upgrade, and validate with terraform plan before rolling out the new resources.