Feature: Add support for managing custom extensions (logic apps)

[nguyenanhducs]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I'm currently using custom extensions (Logic Apps) to automate workflows for Access Package assignments. These extensions are incredibly useful for integrating custom logic at specific lifecycle events, such as when an assignment is approved or expired. However, the current version of the azuread provider doesn't support managing these custom extensions or linking them to Access Package policies.

This means I have to manually configure these extensions, adding extra overhead and complexity to our infrastructure-as-code approach. It would be amazing if the provider could support:

1. Linking custom extensions (like Logic Apps) to an Access Package catalog.
2. Associating these extensions with Access Package policies and specifying the stages where they should be triggered (e.g., assignment approved, assignment expired).

Here are the relevant Microsoft Graph API references for these features:

• Access Package Assignment Request Workflow Extension
• Create a Policy and Specify the Stages to Trigger Predefined Custom Extensions

New or Affected Resource(s)

• azuread_access_package_custom_extension
• azuread_access_package_assignment_policy

Potential Terraform Configuration

resource "azuread_access_package_custom_extension" "logic_app_extension" {
  name         = "LogicAppExtension"
  display_name = "Logic App Workflow Extension"
  description  = "Custom logic app extension for access package workflows"
  endpoint_configuration = {
    subscription_id     = "<subscription-id>"
    resource_group_name = "<resource-group-name>"
    logic_app_name      = "<logic-app-name>"
    url                 = "<logic-app-callback-url>"
  }
}

resource "azuread_access_package_assignment_policy" "example" {
  access_package_id = azuread_access_package.example.id
  display_name      = "assignment-policy"
  description       = "My assignment policy"
  duration_in_days  = 90

  requestor_settings {
    scope_type = "AllExistingDirectoryMemberUsers"
  }

  approval_settings {
    approval_required = true

    approval_stage {
      approval_timeout_in_days = 14

      primary_approver {
        object_id    = azuread_group.example.object_id
        subject_type = "groupMembers"
      }
    }
  }

  assignment_review_settings {
    enabled                        = true
    review_frequency               = "weekly"
    duration_in_days               = 3
    review_type                    = "Self"
    access_review_timeout_behavior = "keepAccess"
  }

  question {
    text {
      default_text = "hello, how are you?"
    }
  }

  custom_extension_assignments {
    stage        = "assignmentApproved"
    extension_id = azuread_access_package_custom_extension.logic_app_extension.id
  }

  custom_extension_assignments {
    stage        = "assignmentRemoved"
    extension_id = azuread_access_package_custom_extension.logic_app_extension.id
  }
}