# Issue with azuread catalog association - CallerNotResourceOwner: The caller is not the resource

**URL:** <https://discuss.hashicorp.com/t/issue-with-azuread-catalog-association-callernotresourceowner-the-caller-is-not-the-resource/70090>\
**Category:** Terraform\
**Tags:** azure\
**Created:** [September 19, 2024, 4:31am UTC](https://discuss.hashicorp.com/t/issue-with-azuread-catalog-association-callernotresourceowner-the-caller-is-not-the-resource/70090 "2024-09-19T04:31:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kitavaNZ](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/kitavanz/32/43064_2.png) [@kitavaNZ](https://discuss.hashicorp.com/u/kitavaNZ)\
**Post date:** [September 19, 2024, 4:31am UTC](https://discuss.hashicorp.com/t/issue-with-azuread-catalog-association-callernotresourceowner-the-caller-is-not-the-resource/70090/1 "2024-09-19T04:31:39Z")

</div>

I’m looking to setup Azure catalogs and access packages with Terraform and found a handy module created here which I’m trying to use: [GitHub - fortytwoservices/terraform-azuread-entitlement-management: This module allows you to simply do Entitlement Management in Azure AD through Catalogs and Access Packages](https://github.com/fortytwoservices/terraform-azuread-entitlement-management)

So far so good, until I try to add resources into the access package and then hit an issue with the association. This is the error I’m getting:

> Error: Failed to link resource “fbfeaae9-6bcf-4333-xxxx-xxxxxxxxxxxx”@“AadGroup” with access catalog “023678c2-c22b-4609-xxxx-xxxxxxxxxxxx”.  
> │  
> │ with module.catalog.azuread\_access\_package\_resource\_catalog\_association.resource-catalog-associations[“CatalogName-Aadgroupname”],  
> │ on .terraform/modules/catalog/modules/azuread/azuread\_entitlement\_management/main.tf line 152, in resource “azuread\_access\_package\_resource\_catalog\_association” “resource-catalog-associations”:  
> │ 152: resource “azuread\_access\_package\_resource\_catalog\_association” “resource-catalog-associations” {  
> │  
> │ AccessPackageResourceRequestClient.BaseClient.Post(): unexpected status 400  
> │ with OData error: CallerNotResourceOwner: The caller is not the resource  
> │ owner.

The module itself has this for the azuread\_access\_package\_resource\_catalog\_association:

> resource “azuread\_access\_package\_resource\_catalog\_association” “resource-catalog-associations” {  
> for\_each = { for resource in local.resource-catalog-associations-filtered : resource.catalog\_resource\_association\_key =\> resource }
> 
> catalog\_id = azuread\_access\_package\_catalog.entitlement-catalogs[each.value.catalog\_key].id  
> resource\_origin\_id = each.value.resource\_origin\_id  
> resource\_origin\_system = each.value.resource\_origin\_system
> 
> depends\_on = [  
> azuread\_access\_package\_catalog.entitlement-catalogs  
> ]  
> }

This is the resource part of the variable being fed into the module:

> ```
> resources = [ # List of resources, one resource per object
> {
> display_name = "MyAadGroupName"
> resource_origin_system = "AadGroup"
> resource_origin_id = "fbfeaae9-6bcf-4333-xxxx-xxxxxxxxxxxx" # The ID of the Azure resource to be added to the Catalog and Access Package
> }
> ]
> 
> ```

Guess I’m trying to figure out if I’m hitting an API bug or if there’s part of the Terraform I’m not understanding correctly.

---

<div class="post-metadata">

**Author:** ![magnusjak](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/magnusjak/32/43413_2.png) [@magnusjak](https://discuss.hashicorp.com/u/magnusjak)\
**Post date:** [October 11, 2024, 6:34am UTC](https://discuss.hashicorp.com/t/issue-with-azuread-catalog-association-callernotresourceowner-the-caller-is-not-the-resource/70090/2 "2024-10-11T06:34:07Z")

</div>

I am not using Terraform, but Microsofts Graph API directly, and I am also getting this error. Which makes no sense, as the ServicePrincipal I am using have the correct API-permissions, it has owner on the catalog and also is the one that created the group I am trying to add as a resource to the catalog.

So it seems this might be some kind of bug. However, it does seem to work if I use the token from my GA-elevated user-account. But that ofc won’t work in the long run.

---

<div class="post-metadata">

**Author:** ![magnusjak](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/magnusjak/32/43413_2.png) [@magnusjak](https://discuss.hashicorp.com/u/magnusjak)\
**Post date:** [October 11, 2024, 12:14pm UTC](https://discuss.hashicorp.com/t/issue-with-azuread-catalog-association-callernotresourceowner-the-caller-is-not-the-resource/70090/3 "2024-10-11T12:14:23Z")

</div>

Managed to get this fixed.  
Even though the ServicePrincipal was the one that created the group in question, it still had to be added as owner of the specific group. After this was done, it was able to add the group as a resource to the catalog.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/hashicorp/original/1X/79bf76adfd92a75631996933098f9ce29d37abf3.svg) [@system](https://discuss.hashicorp.com/u/system)\
**Post date:** [April 9, 2025, 12:14pm UTC](https://discuss.hashicorp.com/t/issue-with-azuread-catalog-association-callernotresourceowner-the-caller-is-not-the-resource/70090/4 "2025-04-09T12:14:57Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.