Add powerplatform_environment_application_admin resource

[Copilot]

This PR implements the powerplatform_environment_application_admin resource that ensures a service principal exists as an application user with the System Administrator role in a Dataverse environment.

Key Features

• Ensures Application User Exists: Adds the specified service principal to a Dataverse environment as an application user with System Administrator privileges
• Idempotent Operation: Create operation will succeed even if the application user already exists
• Drift Detection: If the application user is removed outside of Terraform, the resource will be marked for recreation
• Import Support: Resource can be imported with the format {environment_id}/{application_id}
• Delete is a No-Op: Since Dataverse doesn't support removing application users via API, resource deletion does not remove the app user

Technical Implementation

• Uses the BAP Admin API POST /providers/Microsoft.BusinessAppPlatform/scopes/admin/enroll to add the application user
• Uses the Dataverse Web API to query for the application user's existence during Read operations
• Stores a composite ID in the format {environment_id}/{application_id}

Example Usage

resource "powerplatform_environment_application_admin" "import_fix" {
  environment_id = var.environment_id        # GUID of environment
  application_id = var.spn_application_id    # GUID (client ID) of the SP
}

This resource is especially useful for imported environments where service principals don't already have Dataverse access.

Fixes #782.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint-api.hashicorp.com
  • Triggering command: /tmp/go-build2494529128/b001/environment_application_admin.test -test.testlogfile=/tmp/go-build2494529128/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true (dns block)
  • Triggering command: tfplugindocs generate --provider-name powerplatform --rendered-provider-name Power Platform (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to my firewall allow list

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[mawasile]

Comment should end in a period (godot)

[Copilot]

Added period to comment in d1989f9

[mawasile]

Comment should end in a period (godot)

[Copilot]

Added period to comment in d1989f9