TF Destroy - Inconsistent Deletion of First-Party Azure AD Applications

Terraform Providers Azure
1

We have a terraform package to deploy new Azure AD application registration, it also grants permissions to existing Microsoft first-party applications like SharePoint Online and MS Exchange Online, referencing them as demonstrated in the code below.

resource "azuread_service_principal" "exchange" {
  application_id = data.azuread_application_published_app_ids.well_known.result.Office365ExchangeOnline
  use_existing   = true
}

resource "azuread_service_principal" "sharepoint" {
  application_id = data.azuread_application_published_app_ids.well_known.result.Office365SharePointOnline
  use_existing   = true
}

resource "azuread_service_principal" "intune" {
  application_id = data.azuread_application_published_app_ids.well_known.result.InTune
  use_existing   = true
}

resource "azuread_service_principal" "teams" {
  application_id = data.azuread_application_published_app_ids.well_known.result.TeamsServices
  use_existing   = true
}

We have referred to the documentation of the flag use_existing = true Terraform Registry and understood the caveat associated with it.

In theory, when the “destroy” command is executed for this package, it should remove the Azure AD application registration as well as the referenced service principles marked with the “use_existing = true” flag. However, if it encounters any difficulties in deleting them, it will proceed with the execution, but any errors that occur will not be displayed.

According to Microsoft’s documentation, it’s not possible to delete first-party applications in Azure AD from the tenant. Based on this information, as indicated in the code above, the “destroy” command should refrain from deleting the referenced service principles in Azure AD since all of them are Microsoft’s first-party applications.

Observation: Upon running the “destroy” command, we observed that out of four, it deleted two of the referenced service principles below from Azure AD, in addition to the application registration created by the package.

  • Office365ExchangeOnline

  • Office365SharePointOnline

What’s intriguing is that it selectively removed only 2 out of the 4 referenced service principles, which is inconsistent.

This prompts a couple of questions.
First, why did the “destroy” command manage to delete only a subset of the referred first-party applications?
Secondly, if Microsoft specifies that first-party applications cannot be deleted, how did Terraforms “destroy” command still succeed in deleting them?

2

Update - It appears that the issue is with the azure ad provider and already is discussed here