IaC Bazaar
AzureLive-tested

Entra ID Workload Identity Baseline

App registrations, service principals, groups and federated credentials (OIDC for GitHub/Terraform) - the identity plumbing every Azure org rebuilds by hand.

terraformAzure#azure
azure-entra-id-baselineterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-29 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o azure-entra-id-baseline-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/azure-entra-id-baseline/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle azure-entra-id-baseline-1.0.0.sigstore.json \
  azure-entra-id-baseline-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "ada702c2a6f18da2c2d2c352188e63da222e7a491c5130d6505133a18c5e03c3  azure-entra-id-baseline-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "entra_id_baseline" {
  source  = "www.iac-bazaar.com/iac-bazaar/azure-entra-id-baseline/azure"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Basic, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

azure-entra-id-baseline

The Entra ID workload-identity plumbing every Azure org rebuilds by hand: app registrations, their service principals, keyless federated OIDC credentials (GitHub Actions, Terraform Cloud, Kubernetes), security groups, and Azure RBAC role assignments — all from one composable module call. Works with Terraform and OpenTofu (>= 1.6), hashicorp/azuread >= 3.0, < 4.0 plus hashicorp/azurerm >= 4.0, < 5.0 (for the resource-plane role grants).

Status: static-validated, live-test pending. Validated with tofu fmt, tofu validate, and tflint against the hashicorp/azuread and hashicorp/azurerm providers. Not yet applied against a live tenant — creating app registrations needs Microsoft Graph admin consent (Application.ReadWrite.All, Group.ReadWrite.All) in a throwaway tenant, and no such sandbox exists yet, so it ships under live-test quarantine.

Design & secure defaults

  • No secrets, ever. The module never creates a client secret or password. External workloads federate via OIDC (azuread_application_federated_identity_credential) and present short-lived tokens — nothing exportable to leak, rotate, or commit by accident.
  • Deny-by-default app access. Service principals are created with app_role_assignment_required = true: Entra issues tokens only to principals explicitly assigned to the app. Opt out per-app if you really mean to.
  • Least-privilege Graph permissions. No required_resource_access unless you declare it; Role (application) vs Scope (delegated) is validated.
  • Implicit grant off. Web clients use auth-code + PKCE; legacy implicit token/ID-token issuance stays disabled.
  • Owned by construction. Every app, service principal, and group requires at least one owner — ownerless directory objects are an operational hazard (no one can manage or clean them up). The deploying principal is a sane default.
  • Security groups only. Groups are security_enabled = true, mail_enabled = false — for RBAC/assignment, not mailboxes.
  • Duplicate-name guard. prevent_duplicate_names = true stops a typo from silently adopting a stranger's existing registration.
  • No SP replication race. Role assignments to module-created service principals set skip_service_principal_aad_check = true so a fresh apply does not fail while the SP propagates across Entra.

Requirements

RequirementVersion
Terraform / OpenTofu>= 1.6
hashicorp/azuread>= 3.0, < 4.0
hashicorp/azurerm>= 4.0, < 5.0

License

Commercial — LicenseRef-IaCBazaar-Commercial. © IaC Bazaar. Original work (not derived from a third-party module).

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Inputs
  • Outputs
  • Notes for integrators

Related modules

Azure✓ live-tested

Azure Bastion + Hardened Jumpbox

Bastion (Developer/Basic/Standard SKU) with optional hardened Linux VM, JIT-style NSG rules and boot diagnostics for secure VM access without public IPs.

$29.00v1.0.0
Azure✓ live-tested

User-Assigned Managed Identities

A map-driven module creating one or many user-assigned managed identities, each with optional workload identity federation (OIDC) and least-privilege RBAC role assignments - no secrets to rotate.

$29.00v1.0.0