# Role assignment error when applying changes to Azure

**URL:** <https://discuss.hashicorp.com/t/role-assignment-error-when-applying-changes-to-azure/24018>\
**Category:** Azure\
**Tags:** azure\
**Created:** [May 4, 2021, 4:35pm UTC](https://discuss.hashicorp.com/t/role-assignment-error-when-applying-changes-to-azure/24018 "2021-05-04T16:35:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jzu](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jzu/32/19164_2.png) [@jzu](https://discuss.hashicorp.com/u/jzu)\
**Post date:** [May 4, 2021, 4:35pm UTC](https://discuss.hashicorp.com/t/role-assignment-error-when-applying-changes-to-azure/24018/1 "2021-05-04T16:35:01Z")

</div>

Hi all,

New to Terraform here. Writing some simple code to test the water.

With existing resource already deplyed in Azure. I am trying to assign a registered App to a storage account as contributor. The code passes validation and plan, but when deploying it gives me this error

_“Status=400 Code=“PrincipalTypeNotSupported” Message="Principals of type Application cannot validly be used in role assignments”_

Is the wrong type of I am trying to assign to the principal\_id of the storage? If thats the case, which one I should be using?

data “azuread\_application” “adf-d-app” {

display\_name = “adf-d-app”

}

resource “azurerm\_role\_assignment” “dstg-adf-rol” {

scope = azurerm\_storage\_account.adfdstg.id  
role\_definition\_name = “Storage Blob Data Contributor”  
principal\_id = data.azuread\_application.adf-d-app.object\_id  
skip\_service\_principal\_aad\_check = true

}

---

<div class="post-metadata">

**Author:** ![jzu](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jzu/32/19164_2.png) [@jzu](https://discuss.hashicorp.com/u/jzu)\
**Post date:** [May 5, 2021, 5:46pm UTC](https://discuss.hashicorp.com/t/role-assignment-error-when-applying-changes-to-azure/24018/2 "2021-05-05T17:46:16Z")

</div>

this seems to be a bug. I pulled the GUID value out from value that was displayed after hitting apply and just before enter yes to commit. Replaced the role with

principal\_id = " GUID value I pull from previous failed apply"

Hit the apply and it works. No errors nor complains.

---

<div class="post-metadata">

**Author:** ![AngrryRabbit](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/angrryrabbit/32/29141_2.png) [@AngrryRabbit](https://discuss.hashicorp.com/u/AngrryRabbit)\
**Post date:** [July 1, 2022, 7:37am UTC](https://discuss.hashicorp.com/t/role-assignment-error-when-applying-changes-to-azure/24018/3 "2022-07-01T07:37:21Z")

</div>

Hi I have the same problem!  
for " App registrations"  
“principal\_id” is not “Essentials” ----- \> “Object ID”  
please clicke “Managed application in local directory” your name href.  
in “Properties” the “Object ID” is different, and this “Object ID” is “principal\_id”