fix(resource-group-init): remove pipeline MI as app registration owner

josielsouzanordcloud · josielsouzanordcloud · commit de13a785f949 · 2026-06-02T12:43:57.000+01:00
The pipeline MI only needs to be owner of the service principal, not
the application registration. Group members remain owners of both.
diff --git a/infrastructure/terraform/resource_group_init/enterpriseAppOwner.bicep b/infrastructure/terraform/resource_group_init/enterpriseAppOwner.bicep
@@ -5,19 +5,17 @@ param enterpriseAppClientId string
 param enterpriseAppName string
 param groupMemberIds array = []
 
-var owners = concat([miPrincipalId], groupMemberIds)
-
 resource enterpriseAppSp 'Microsoft.Graph/servicePrincipals@v1.0' = {
   appId: enterpriseAppClientId
   owners: {
-    relationships: owners
+    relationships: concat([miPrincipalId], groupMemberIds)
   }
 }
 
 resource enterpriseApp 'Microsoft.Graph/applications@v1.0' = {
   uniqueName: enterpriseAppName
   displayName: enterpriseAppName
   owners: {
-    relationships: owners
+    relationships: groupMemberIds
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -5,19 +5,17 @@ param enterpriseAppClientId string`
`5`	`5`	`param enterpriseAppName string`
`6`	`6`	`param groupMemberIds array = []`
`7`	`7`
`8`		`-var owners = concat([miPrincipalId], groupMemberIds)`
`9`		`-`
`10`	`8`	`resource enterpriseAppSp 'Microsoft.Graph/servicePrincipals@v1.0' = {`
`11`	`9`	`appId: enterpriseAppClientId`
`12`	`10`	`owners: {`
`13`		`- relationships: owners`
	`11`	`+ relationships: concat([miPrincipalId], groupMemberIds)`
`14`	`12`	`}`
`15`	`13`	`}`
`16`	`14`
`17`	`15`	`resource enterpriseApp 'Microsoft.Graph/applications@v1.0' = {`
`18`	`16`	`uniqueName: enterpriseAppName`
`19`	`17`	`displayName: enterpriseAppName`
`20`	`18`	`owners: {`
`21`		`- relationships: owners`
	`19`	`+ relationships: groupMemberIds`
`22`	`20`	`}`
`23`	`21`	`}`