Terraform AzureRM Provider v5.9.0: New List Resources and Key Enhancements

Introduction

HashiCorp released terraform-provider-azurerm v5.9.0 on October 8, 2026. This release introduces three new list resources, a batch of dependency updates (including a go-azure-sdk bump), several resource enhancements, and bug fixes affecting azurerm_app_configuration_feature, azurerm_dashboard_grafana, azurerm_kubernetes_cluster_node_pool, and azurerm_vpn_server_configuration. This is the first release tracked on terraformpilot.com for this provider, so there is no prior-version diff to compare against.

What Is New

New List Resources

Three new list resources were added, useful for querying existing Azure resources without importing them individually into state:

• azurerm_app_service_custom_hostname_binding (#33423)
• azurerm_eventhub (#33376)
• azurerm_kubernetes_cluster_node_pool (#33399)

Example usage of the new azurerm_kubernetes_cluster_node_pool list resource:

list "azurerm_kubernetes_cluster_node_pool" "existing" {
  provider = azurerm
 
  config {
    kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
  }
}

Run it with:

terraform query -config list_example.tf

Notable Resource Enhancements

• azurerm_application_gateway (and its data source) now supports ssl_profile.client_authentication_mode (#33536):

resource "azurerm_application_gateway" "example" {
  # ...
 
  ssl_profile {
    name                         = "example-ssl-profile"
    client_authentication_mode  = "OptionalClientCertificate"
  }
}

• azurerm_monitor_data_collection_rule gains logs_ingestion_endpoint and metrics_ingestion_endpoint properties, plus support for the Direct kind (#31317):

resource "azurerm_monitor_data_collection_rule" "example" {
  name                = "example-dcr"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  kind                = "Direct"
 
  # ...
}

• azurerm_storage_blob_inventory_policy adds filter.created_within_days (#30675).
• azurerm_data_protection_backup_policy_kubernetes_cluster now supports VaultStore in both default_retention_rule.life_cycle.data_store_type and retention_rule.life_cycle.data_store_type (#32356).
• azurerm_network_watcher_flow_log accepts version = 5 (#33589).
• azurerm_orchestrated_virtual_machine_scale_set adds NvmeDisk to os_disk.0.diff_disk_settings.0.placement (#33578).
• azurerm_virtual_desktop_host_pool adds MultiplePersistent to load_balancer_type (#32744).
• azurerm_virtual_desktop_application relaxes name validation to allow spaces, periods, underscores, and @ (#33522).
• azurerm_virtual_network_gateway_connection now skips an unnecessary update call when only shared_key changes (#33392), reducing noisy plan/apply cycles.

Dependency Updates

The release bumps go-azure-sdk to v0.20261005.1221110 (#33574) and the mssqlmanagedinstance API version to 2025-01-01 (#33559), along with several Go module updates (terraform-json v0.28.0, golang.org/x/crypto v0.57.0, and others) under issue #33548.

Bug Fixes

• azurerm_app_configuration_feature — fixed a serialization issue in timewindow_filter.start / timewindow_filter.end that produced a broken config in Azure (#32969).
• azurerm_dashboard_grafana — fixed an update failure when smtp was set but unchanged (#32720).
• azurerm_kubernetes_cluster_node_pool — added locking on pod/node virtual network IDs to prevent conflicts when multiple node pools target the same VNet (#32682).
• azurerm_vpn_server_configuration — fixed a persistent diff (truncated in the published notes; see the release page for the full fix description).

No deprecations or breaking changes are listed for this release.

Upgrade Steps

Pin the provider version in your configuration:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 5.9.0"
    }
  }
}

Then re-initialize to fetch the new provider build:

terraform init -upgrade

If you use azurerm_kubernetes_cluster_node_pool, azurerm_dashboard_grafana, or azurerm_virtual_network_gateway_connection, run a plan in a non-production workspace first to confirm no unexpected diffs appear from the locking and update-skip fixes.

Verify

Confirm the installed provider version and that the plan is clean:

terraform version
terraform plan -out=tfplan

Check that terraform version reports provider registry.terraform.io/hashicorp/azurerm v5.9.0, and review the plan for only the resource changes you intended (for example, a new ssl_profile.client_authentication_mode value if you added one).

Conclusion

v5.9.0 is primarily an incremental release: three new list resources for querying App Service hostname bindings, Event Hubs, and AKS node pools, targeted feature additions across App Gateway, Monitor DCR, VDI, and VM scale sets, and four bug fixes addressing update-loop and locking issues. There are no breaking changes or deprecations to plan around, so upgrading should be low-risk — run terraform init -upgrade and a terraform plan to confirm before applying.