terraform-provider-azurerm: Azure Management Group creation with Service Principal returns 403

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or “me too” comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform version: 0.12.20 Azurerm version: 2.0.0

Affected Resource(s)

• azurerm_management_group

We use a Service Principal to connect to out Azure environment. This SP has Owner role at Root Management Group. If we login to Azure CLI with this SP, we can manage Management Groups without a problem. When we try to run from terraform, we get a 403 error:

Error: Error checking for presence of existing Management Group "d45bbbf8-72bd-486b-ac78-73e07c2e4043": managementgroups.Client#Get: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'f0e7a3ad-21cb-4968-aea2-b3ef5ec930d4' with object id 'f0e7a3ad-21cb-4968-aea2-b3ef5ec930d4' does not have authorization to perform action 'Microsoft.Management/managementGroups/read' over scope '/providers/Microsoft.Management/managementGroups/d45bbbf8-72bd-486b-ac78-73e07c2e4043' or the scope is invalid. If access was recently granted, please refresh your credentials." 

Terraform Configuration Files

provider "azurerm" {
  version = "=2.0.0"
  features {}
}
resource "azurerm_management_group" "ccoe" {
  display_name = "azure-ccoe"
}

Debug Output

Provided in Gist

Expected Behavior

Management Group is created

Actual Behavior

Terraform apply fails with error 403 forbidden

Steps to Reproduce

1. Assign service principal as owner of Root Management Group
2. Set proper local env variables to connect with SP: export ARM_SUBSCRIPTION_ID=“xxxxxx” export ARM_CLIENT_ID=“xxxxxx” export ARM_CLIENT_SECRET=“xxxxx” export ARM_TENANT_ID=“xxxxx”
3. terraform init
4. terraform apply