Table of Contents

1. Terraform + Azure Entra ID Mini Project: Step-by-Step Beginner Guide (Users & Groups from CSV)
2. 🎯 What We’re Building
3. 🟢 Step 1 — Configure Provider & Fetch Domain
4. 🟢 Step 2 — Test CSV Reading
5. 🟢 Step 3 — Create ONE Test User
6. 🟢 Step 4 — Create Users from CSV
7. 🟢 Step 5 — Create Group & Add Members
8. 🧠 Key Beginner Lessons
9. 🚀 What You Can Try Next
10. 🎉 Final Thoughts

Terraform + Azure Entra ID Mini Project: Step-by-Step Beginner Guide (Users & Groups from CSV)

In this mini project, I automated user and group management in Microsoft Entra ID using Terraform.

Instead of creating infrastructure like VMs or VNets, we manage:

• 👤 Users
• 👥 Groups
• 🔗 Group memberships

I followed my instructor’s tutorial but implemented it in my own small, testable steps. This blog shows exactly how you can do the same and debug easily as a beginner.

---

🎯 What We’re Building

We will:

✅ Fetch our tenant domain
✅ Read users from a CSV file
✅ Create Entra ID users from CSV
✅ Detect duplicate usernames
✅ Create a group
✅ Add users to the group based on department

---

🟢 Step 1 — Configure Provider & Fetch Domain

azadprovider.tf

terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "2.41.0"
    }
  }
}

👉 This tells Terraform to use the Azure AD provider.

---

domainfetch.tf

data "azuread_domains" "tenant" {
  only_initial = true
}

output "domain" {
  value = data.azuread_domains.tenant.domains.0.domain_name
}

Run

terraform init
terraform apply

Verify

You should see:

domain = "yourtenant.onmicrosoft.com"

✅ Now Terraform can build valid usernames.

---

🟢 Step 2 — Test CSV Reading

locals {
  users = csvdecode(file("users.csv"))
}

output "users_debug" {
  value = local.users
}

Why?

Before creating users, confirm Terraform reads the CSV correctly.

Run

terraform plan

You should see structured user data printed.

✅ If this fails → your CSV format is wrong.

---

🟢 Step 3 — Create ONE Test User

Always test with one user first.

resource "azuread_user" "testuserminipro867" {
  user_principal_name = "testuserminipro867@yourdomain.onmicrosoft.com"
  display_name = "Test User"
  password = "Password123!"
}

Verify in Portal

Entra ID → Users → Confirm creation.

✅ Works? Good.
Then comment it out.

---

🟢 Step 4 — Create Users from CSV

Now we automate.

---

Generate UPNs

locals {
  upns = [
    for u in local.users :
    lower("${u.first_name}.${u.last_name}@${data.azuread_domains.tenant.domains[0].domain_name}")
  ]
}

👉 Creates usernames like:

michael.scott@tenant.onmicrosoft.com

---

Detect Duplicates

output "duplicate_check" {
  value = length(local.upns) != length(distinct(local.upns))
    ? "❌ DUPLICATES FOUND"
    : "✅ No duplicates"
}

💡 Beginner Tip:
Duplicate usernames will break Terraform — always check first!

---

Preview Planned Users

output "planned_users" {
  value = local.upns
}

---

Create Users

resource "azuread_user" "users" {

  for_each = {
    for idx, user in local.users :
    local.upns[idx] => user
  }

  user_principal_name = each.key
  display_name = "${each.value.first_name} ${each.value.last_name}"
  mail_nickname = lower("${each.value.first_name}${each.value.last_name}")

  department = each.value.department
  password = "Password123!"
}

Apply

terraform apply

Verify

Check Entra ID → Users.

✅ Users created automatically!

---

🔥 Important Learning

If you change the CSV later:

Terraform will
✔ create new users
✔ update existing users
✔ remove deleted users

👉 This is Terraform’s desired state model in action.

---

🟢 Step 5 — Create Group & Add Members

---

Create Group

resource "azuread_group" "test_group" {
  display_name = "Test Group"
  security_enabled = true
}

---

Add Members by Department

resource "azuread_group_member" "education" {

  for_each = {
    for u in azuread_user.users :
    u.mail_nickname => u
    if u.department == "Education"
  }

  group_object_id = azuread_group.test_group.id
  member_object_id = each.value.id
}

Apply

terraform apply

Verify

Portal → Groups → Members tab

✅ Only Education department users added.

---

🧠 Key Beginner Lessons

✅ Work in Small Steps

Don’t deploy everything at once.

---

✅ Always Check Data First

Validate CSV before creating resources.

---

✅ Use Outputs for Debugging

Outputs save hours of troubleshooting.

---

✅ Terraform is Declarative

It maintains the desired state automatically.

---

🚀 What You Can Try Next

👉 Add more users to CSV
👉 Create groups by job title
👉 Use Service Principal authentication
👉 Generate random passwords
👉 Assign roles to groups

---

🎉 Final Thoughts

This project shows how powerful Terraform is beyond infrastructure — it can manage identity too.

If you’re learning cloud or DevOps, this skill is extremely valuable because real organizations manage thousands of users and groups.

Start small, test often, and build confidence step-by-step — exactly like you did here.