Registry / azure / pulumi-azuread

pulumi-azuread

library6.9.1pypypi✓ verified 88d ago

Pulumi AzureAD is a Python package for defining, deploying, and managing Azure Active Directory (now Microsoft Entra ID) cloud resources using Pulumi's Infrastructure as Code approach. It is currently at version 6.9.0 and follows Pulumi's rapid release cadence, often receiving weekly or bi-weekly updates to incorporate new features and bug fixes from the upstream Terraform provider.

azure devops

pip install pulumi-azuread

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PULUMI-AZUREAD

pulumi-azuread

azurepythonv6.9.1

Install

6.7s avg

Import

1520ms

Disk

84MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v6.9.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.920 runs

installs and imports cleanly · install 0.0s · import 1.876s · 92.3MB

glibc

py 3.10–3.920 runs

installs and imports cleanly · install 6.7s · import 1.164s · 78MB

84MB installed

● package 84MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

azuread

✓ import pulumi_azuread as azuread

Group

✓ from pulumi_azuread import Group

This quickstart program creates a new Azure Active Directory (Entra ID) security group. Before running, ensure you have configured your Azure credentials, typically by running `az login` or setting environment variables like `ARM_CLIENT_ID`, `ARM_CLIENT_SECRET`, and `ARM_TENANT_ID`.

import pulumi import pulumi_azuread as azuread import os # Ensure Azure credentials are set via environment variables or `az login` # Example: ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID, ARM_SUBSCRIPTION_ID # Pulumi typically picks these up automatically or via `pulumi config set`. # For local testing, ensure `az login` has been run or environment variables are configured. # For CI/CD, consider OIDC or Service Principal authentication. # Create an Azure AD Group my_group = azuread.Group( "my-python-group", display_name="MyPythonManagedGroup", mail_enabled=False, security_enabled=True ) # Export the ID of the created group pulumi.export("groupId", my_group.id)

Debug

Known issues

breakingUpgrading from Pulumi AzureAD v5.x to v6.x may introduce breaking changes. These often stem from updates to the underlying Terraform AzureAD provider, leading to schema changes, removed deprecated properties, and potential changes in resource behavior (e.g., case-sensitive enum values). Review the official migration guide for the specific version range you are upgrading to/from.

fix

Consult the Pulumi AzureAD migration guide for detailed steps. Be prepared to update resource property names, types, or provide missing required properties. Preview your changes (`pulumi preview`) carefully to identify potential replacements or diffs.

affects: 5.x to 6.x

gotchaAuthentication errors are common if Azure credentials are not correctly configured. The provider relies on the Azure CLI login (`az login`) or specific environment variables (e.g., `ARM_CLIENT_ID`, `ARM_TENANT_ID`, `ARM_CLIENT_SECRET`, `ARM_SUBSCRIPTION_ID`) for authentication. If you encounter errors like 'failed to load Azure credentials' or 'Error obtaining Authorization Token', it's usually an authentication issue.

fix

Ensure you are logged in via `az login` or that the necessary `ARM_` environment variables are correctly set. For CI/CD environments, consider using OpenID Connect (OIDC) or a Service Principal with appropriate permissions.

affects: All versions

deprecatedThe `end_date_relative` property on the `azuread.ServicePrincipalCertificate` resource is deprecated. It will be removed in a future version.

fix

Instead of `end_date_relative`, use the `end_date` property and calculate its value using a function like Terraform's `timeadd()` (or Python's `datetime` equivalent) to specify an absolute expiry date.

affects: 6.x and earlier

gotchaPulumi has two main Azure providers: `pulumi-azuread` and `pulumi-azure-native` (or `pulumi-azure` for the older Classic provider). `pulumi-azuread` is specifically for managing Azure Active Directory (Entra ID) resources like Users, Groups, Applications, and Service Principals. `pulumi-azure-native` is for general Azure ARM resources (e.g., Virtual Machines, Storage Accounts, Resource Groups). Confusing the two can lead to 'resource not found' or 'property not supported' errors.

fix

Use `pulumi-azuread` for identity-related resources within Entra ID. Use `pulumi-azure-native` for all other Azure infrastructure resources. For new projects, `pulumi-azure-native` is generally recommended for ARM resources over the deprecated `pulumi-azure` (Classic) provider.

affects: All versions

Errors

Common errors & fixes

error: failed to load Azure credentials. Details: could not configure AzureCli Authorizer: tenant ID was not specified and the default tenant ID could not be determined: obtaining tenant ID: obtaining account details: running Azure CLI: exit status 1: ERROR: Please run 'az login' to setup account.

The Pulumi AzureAD provider cannot authenticate to Azure because the Azure CLI is not logged in, or required environment variables/Pulumi configuration for service principal authentication are missing.

fix

Log in via Azure CLI (`az login`), or set the necessary Pulumi configuration values (`pulumi config set azuread:clientId <CLIENT_ID>`, `pulumi config set azuread:tenantId <TENANT_ID>`, `pulumi config set azuread:clientSecret <CLIENT_SECRET>`) or environment variables (`ARM_CLIENT_ID`, `ARM_TENANT_ID`, `ARM_CLIENT_SECRET`).

ModuleNotFoundError: No module named 'pulumi_azuread'

The 'pulumi-azuread' Python package is not installed in the active Python environment or the Pulumi program's Python environment.

fix

Install the package using pip: `pip install pulumi-azuread`. Ensure you are running `pulumi` commands within the correct Python virtual environment if you are using one.

warning: azuread:index/application:Application resource 'myAzureAdApp' has a problem: Conflicting configuration arguments: "feature_tags": conflicts with tags. Examine values at 'myAzureAdApp.featureTags'.

When defining an `azuread.Application` resource, both `tags` and `feature_tags` properties are being used, which are mutually exclusive.

fix

Choose to use either the `tags` property or the `feature_tags` property, but not both, for an `azuread.Application` resource. Remove the conflicting property.

error: azuread:index/servicePrincipal:ServicePrincipal resource 'aad-sp-backend' has a problem: Missing required argument. The argument "client_id" is required, but no definition was found.. Examine values at 'aad-sp-backend.clientId'.

The `clientId` property, which is required for an `azuread.ServicePrincipal`, is not being correctly resolved or passed from its dependent `azuread.Application` resource, often because it's an output property that needs to be explicitly accessed after the application is created.

fix

Ensure that the `clientId` from the `azuread.Application` resource is correctly referenced and that any potential `Output` types are handled (e.g., using `.apply` in Python) if chaining resources in a complex way, for example: `client_id=application.client_id`.

Upgrade

Version history

6.9.1latest on PyPI · released May 22, 2026

Audit

Dependencies

pulumirequiredCore Pulumi SDK for infrastructure provisioning.

pythonoptionalRequires Python 3.9 or newer.

Agent activity

34 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/pulumi/pulumi-azuread ↗

packagehttps://pypi.org/project/pulumi-azuread/ ↗

homepagehttps://pulumi.io ↗