christianbumann · Oct 10, 2019 · Oct 10, 2019 · Oct 10, 2019 · Oct 10, 2019 · Oct 10, 2019
Showing 2,508 changed files with 728,903 additions and 2,702 deletions.
diff --git a/.azdo/azure-pipeline-nightly.yml b/.azdo/azure-pipeline-nightly.yml
@@ -0,0 +1,28 @@
+schedules:
+- cron: "0 0 * * *"
+  displayName: "Nightly Build"
+  branches:
+    include:
+    - 'master'
+
+jobs:
+- template: ./ci.yml
+  parameters:
+    maxParallel: 1 # any more and we get throttled by AzDO!
+
+    goVersions:
+    - value: '1.12.1'
+      ymlSafeName: '1_12_1'
+
+    - value: '1.12.10'
+      ymlSafeName: '1_12_10'
+
+    - value: '1.13.1'
+      ymlSafeName: '1_13_1'
+
+    vmImages:
+    - value: 'macOS-10.14'
+      ymlSafeName: 'macos_10_14'
+
+    - value: 'ubuntu-16.04'
+      ymlSafeName: ubuntu_16_04
diff --git a/.azdo/azure-pipeline.yml b/.azdo/azure-pipeline.yml
@@ -19,18 +19,9 @@ jobs:
 - template: ./ci.yml
   parameters:
     goVersions:
-    - value: '1.12.1'
-      ymlSafeName: '1_12_1'
-
     - value: '1.12.10'
       ymlSafeName: '1_12_10'
 
-    - value: '1.13.1'
-      ymlSafeName: '1_13_1'
-
     vmImages:
-    - value: 'macOS-10.14'
-      ymlSafeName: 'macos_10_14'
-
     - value: 'ubuntu-16.04'
       ymlSafeName: ubuntu_16_04
diff --git a/.azdo/ci.yml b/.azdo/ci.yml
@@ -5,6 +5,7 @@
 parameters:
   goVersions: []
   vmImages: []
+  maxParallel: 1
 
 jobs:
 
@@ -13,6 +14,7 @@ jobs:
 
   # Build on each combination of supported OS and Go version
   strategy:
+    maxParallel: ${{ parameters.maxParallel }}
     matrix:
       ${{ each goVersion in parameters.goVersions }}:
         ${{ each vmImage in parameters.vmImages }}:
@@ -32,12 +34,13 @@ jobs:
   - bash: |
       #!/usr/bin/env bash
       cd "$BUILD_SOURCESDIRECTORY"
-      chmod +x ./scripts/*.sh
-    displayName: 'Set Scripts as Executable'
+      ./scripts/fmt-check-go.sh
+    displayName: 'Run Format Check'
 
   - bash: |
       #!/usr/bin/env bash
       cd "$BUILD_SOURCESDIRECTORY"
+      go get -u golang.org/x/lint/golint
       ./scripts/lint-check-go.sh
     displayName: 'Run Lint Check'
 
@@ -46,3 +49,26 @@ jobs:
       cd "$BUILD_SOURCESDIRECTORY"
       ./scripts/build.sh
     displayName: 'Run Build Script'
+
+  - bash: |
+      #!/usr/bin/env bash
+      cd "$BUILD_SOURCESDIRECTORY"
+      ./scripts/acctest.sh
+    displayName: 'Run Acceptance Tests'
+    env:
+      AZDO_ORG_SERVICE_URL: $(ACC_TEST_AZDO_ORG_URL)
+      AZDO_PERSONAL_ACCESS_TOKEN: $(ACC_TEST_AZDO_PAT)
+      AZDO_GITHUB_SERVICE_CONNECTION_PAT: $(ACC_TEST_GH_PAT)
+      AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME: $(AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME)
+      AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL: $(AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL)
+      AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD: $(AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD)
+      AZDO_BITBUCKET_SERVICE_CONNECTION_USERNAME: $(AZDO_BITBUCKET_SERVICE_CONNECTION_USERNAME)
+      AZDO_BITBUCKET_SERVICE_CONNECTION_PASSWORD: $(AZDO_BITBUCKET_SERVICE_CONNECTION_PASSWORD)
+
+  - bash: |
+      if [ -x "$(command -v docker)" ]; then
+        docker build -f .devcontainer/Dockerfile -t dev --build-arg GO_VERSION=${GO_VERSION} .
+      fi
+    env:
+      GO_VERSION: $(goVersion)
+    displayName: 'Run Build Script in Docker'
diff --git a/.azdo/main.tf b/.azdo/main.tf
@@ -11,24 +11,34 @@ resource "azuredevops_project" "project" {
   work_item_template = "Agile"
 }
 
-resource "azuredevops_serviceendpoint" "github_serviceendpoint" {
-  project_id             = azuredevops_project.project.id
-  service_endpoint_name  = "GitHub Service Connection"
-  service_endpoint_type  = "github"
-  service_endpoint_url   = "http://github.com"
-  service_endpoint_owner = "library"
+resource "azuredevops_serviceendpoint_github" "github_serviceendpoint" {
+  project_id            = azuredevops_project.project.id
+  service_endpoint_name = "GitHub Service Connection"
+
+  auth_personal {
+    # personalAccessToken = "..." Or set with `AZDO_GITHUB_SERVICE_CONNECTION_PAT` env var
+  }
+}
+
+resource "azuredevops_serviceendpoint_dockerhub" "dockerhub_serviceendpoint" {
+  project_id            = azuredevops_project.project.id
+  service_endpoint_name = "DockerHub Service Connection"
+
+  # docker_username = "..." - Or set with `AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME` env var
+  # docker_email    = "..." - Or set with `AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL` env var
+  # docker_password = "..." - Or set with `AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD` env var
 }
 
-resource "azuredevops_build_definition" "build_definition" {
+resource "azuredevops_build_definition" "nightly_build" {
   project_id      = azuredevops_project.project.id
   agent_pool_name = "Hosted Ubuntu 1604"
-  name            = "Provider CI Pipeline"
+  name            = "Nightly Build"
 
   repository {
     repo_type             = "GitHub"
-    repo_name             = "microsoft/terraform-provider-azuredevops"
+    repo_id               = "microsoft/terraform-provider-azuredevops"
     branch_name           = "master"
-    yml_path              = ".azdo/azure-pipeline.yml"
-    service_connection_id = azuredevops_serviceendpoint.github_serviceendpoint.id
+    yml_path              = ".azdo/azure-pipeline-nightly.yml"
+    service_connection_id = azuredevops_serviceendpoint_github.github_serviceendpoint.id
   }
 }
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -0,0 +1,65 @@
+FROM golang:1.13-stretch
+
+# Avoid warnings by switching to noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
+
+ARG TERRAFORM_VERSION=0.12.24
+ARG TFLINT_VERSION=0.15.3
+ARG TERRAFORM_PROVIDER_AZUREDEVOPS_NAME=terraform-provider-azuredevops
+
+RUN apt-get update \
+    && apt-get -y install --no-install-recommends apt-utils 2>&1 \
+    # Verify git, process tools, lsb-release (common in install instructions for CLIs), unzip installed
+    && apt-get -y install git procps lsb-release unzip \
+    # Install Editor
+    && apt-get install vim -y \
+    # Install Terraform, tflint
+    && mkdir -p /tmp/docker-downloads \
+    && curl -sSL -o /tmp/docker-downloads/terraform.zip https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip \
+    && unzip /tmp/docker-downloads/terraform.zip \
+    && mv terraform /usr/local/bin \
+    && curl -sSL -o /tmp/docker-downloads/tflint.zip https://github.com/wata727/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_amd64.zip \
+    && unzip /tmp/docker-downloads/tflint.zip \
+    && mv tflint /usr/local/bin \
+    && cd ~ \ 
+    && rm -rf /tmp/docker-downloads \
+    #
+    # Clean up
+    && apt-get autoremove -y \
+    && apt-get clean -y \
+    && rm -rf /var/lib/apt/lists/*
+
+# Enable go modules
+ENV GO111MODULE=on
+
+# Install Go tools
+RUN \
+    # --> Delve for debugging
+    go get github.com/go-delve/delve/cmd/dlv@v1.4.0 \
+    # --> Go language server
+    && go get golang.org/x/tools/gopls@v0.3.4 \
+    # --> GolangCI-lint
+    && curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sed 's/tar -/tar --no-same-owner -/g' | sh -s -- -b $(go env GOPATH)/bin \
+    # --> Go-outline for extracting a JSON representation of the declarations in a Go source file
+    && go get -v github.com/ramya-rao-a/go-outline \
+    #
+    # Clean up
+    && rm -rf /go/src/ && rm -rf /go/pkg
+
+# Install AzDO terraform provider
+ADD . ${TERRAFORM_PROVIDER_AZUREDEVOPS_NAME}
+RUN (cd ${TERRAFORM_PROVIDER_AZUREDEVOPS_NAME} && make build) \
+    && rm -rf ${TERRAFORM_PROVIDER_AZUREDEVOPS_NAME}
+
+# Git command prompt
+RUN git clone https://github.com/magicmonty/bash-git-prompt.git ~/.bash-git-prompt --depth=1 \
+    && echo "if [ -f \"$HOME/.bash-git-prompt/gitprompt.sh\" ]; then GIT_PROMPT_ONLY_IN_REPO=1 && source $HOME/.bash-git-prompt/gitprompt.sh; fi" >> "/root/.bashrc"
+
+# Add alias
+RUN echo "alias tf=terraform" >> "/root/.bashrc"
+
+# Switch back to dialog for any ad-hoc use of apt-get
+ENV DEBIAN_FRONTEND=dialog
+
+# Install goreleaser
+RUN (cd /usr/local && curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- "v0.132.1") 
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -0,0 +1,56 @@
+// For format details, see https://aka.ms/vscode-remote/devcontainer.json or the definition README at
+// https://github.com/microsoft/vscode-dev-containers/tree/master/containers/docker-existing-dockerfile
+{
+	"name": "Dev Dockerfile",
+	"dockerFile": "Dockerfile",
+	"context": "..",
+	// The optional 'runArgs' property can be used to specify additional runtime arguments.
+	"runArgs": [
+		// Enable go debugger
+		"--cap-add=SYS_PTRACE",
+		"--security-opt",
+		"seccomp=unconfined",
+		// Enable SSH for git
+		"-v",
+		"${env:HOME}${env:USERPROFILE}/.ssh:/root/.ssh-localhost:ro"
+	],
+	"postCreateCommand": "mkdir -p /root/.ssh && cp -r /root/.ssh-localhost/* /root/.ssh && chmod 700 /root/.ssh && chmod 600 /root/.ssh/*",
+	"settings": {
+		"files.eol": "\n",
+		"go.gopath": "/go",
+		"terminal.integrated.shell.linux": "/bin/bash",
+		"go.useLanguageServer": true,
+		"go.autocompleteUnimportedPackages": true,
+		"go.gotoSymbol.includeImports": true,
+		"go.gotoSymbol.includeGoroot": true,
+		"go.toolsEnvVars": {
+			"GO111MODULE": "on"
+		},
+		"go.lintFlags": [
+			"--fast"
+		],
+		"go.testFlags": [
+			"-v",
+			"-tags=all"
+		],
+		"go.testEnvVars": {
+			"TF_ACC": "1"
+		},
+		"go.testEnvFile": "${workspaceFolder}/.env",
+		"[go]": {
+			"editor.formatOnSave": true,
+			"editor.codeActionsOnSave": {
+				"source.organizeImports": true
+			}
+		},
+		"gopls": {
+			"usePlaceholders": true, // add parameter placeholders when completing a function
+			// Experimental settings
+			"completeUnimported": true, // autocomplete unimported packages
+			"deepCompletion": true // enable deep completion
+		},
+	},
+	"extensions": [
+		"ms-vscode.go"
+	]
+}
diff --git a/.gitattributes b/.gitattributes
@@ -0,0 +1,4 @@
+go.mod text eol=lf
+go.sum text eol=lf
+*.sh text eol=lf
+*.go text eol=lf
diff --git a/.github/workflows/check-pr.yml b/.github/workflows/check-pr.yml
@@ -0,0 +1,81 @@
+name: Build and Test Terraform provider AzDo
+on: [pull_request]
+jobs:
+
+  build:
+    name: Build
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-16.04]
+        go-version: [1.12.10]
+
+
+    steps:
+
+    - name: Set up Go
+      uses: actions/setup-go@v1
+      with:
+        go-version: ${{ matrix.go-version }}
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v1
+
+    - name: Get dependencies
+      run: |
+        go get -v -t -d ./...
+        if [ -f Gopkg.toml ]; then
+            curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
+            dep ensure
+        fi
+
+    - name: Run Format Check
+      run: ./scripts/fmt-check-go.sh
+
+    - name: Run Lint Check
+      run: |
+        go get -u golang.org/x/lint/golint
+        ./scripts/lint-check-go.sh
+
+    - name: Run Build Script
+      run: ./scripts/build.sh
+
+    - name: Run Acceptance Tests
+      run: ./scripts/acctest.sh
+      env:
+        AZDO_ORG_SERVICE_URL: ${{ secrets.AZDO_ORG_SERVICE_URL }}
+        AZDO_PERSONAL_ACCESS_TOKEN: ${{ secrets.AZDO_PERSONAL_ACCESS_TOKEN }}
+        AZDO_GITHUB_SERVICE_CONNECTION_PAT: ${{ secrets.GITHUB_TOKEN }}
+        AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME: ${{ secrets.AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME }}
+        AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL: ${{ secrets.AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL }}
+        AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD: ${{ secrets.AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD }}
+        AZDO_TEST_AAD_USER_EMAIL: ${{ secrets.AZDO_TEST_AAD_USER_EMAIL }}
+
+    - name: Run Build Script in Docker
+      run: docker build -f .devcontainer/Dockerfile -t dev --build-arg GO_VERSION=${GO_VERSION} .
+      env:
+        GO_VERSION: ${{ matrix.go-version }}
+
+    - name: Run Acceptance Tests in Docker
+      run: |
+        docker run \
+        --env AZDO_ORG_SERVICE_URL=${AZDO_ORG_SERVICE_URL} \
+        --env AZDO_PERSONAL_ACCESS_TOKEN=${AZDO_PERSONAL_ACCESS_TOKEN} \
+        --env AZDO_GITHUB_SERVICE_CONNECTION_PAT=${AZDO_GITHUB_SERVICE_CONNECTION_PAT} \
+        --env AZDO_TEST_AAD_USER_EMAIL=${AZDO_TEST_AAD_USER_EMAIL} \
+        --env AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME=${AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME} \
+        --env AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL=${AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL} \
+        --env AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD=${AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD} \
+        --workdir /workspaces/terraform-provider-azuredevops \
+        -v ${PWD}:/workspaces/terraform-provider-azuredevops \
+        dev ./scripts/acctest.sh
+      env:
+        AZDO_ORG_SERVICE_URL: ${{ secrets.AZDO_ORG_SERVICE_URL }}
+        AZDO_PERSONAL_ACCESS_TOKEN: ${{ secrets.AZDO_PERSONAL_ACCESS_TOKEN }}
+        AZDO_GITHUB_SERVICE_CONNECTION_PAT: ${{ secrets.GITHUB_TOKEN }}
+        AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME: ${{ secrets.AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME }}
+        AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL: ${{ secrets.AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL }}
+        AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD: ${{ secrets.AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD }}
+        AZDO_TEST_AAD_USER_EMAIL: ${{ secrets.AZDO_TEST_AAD_USER_EMAIL }}
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,6 @@
 .env
-.vscode/
+#direnv files
+.envrc
 bin/
 
 terraform-provider-azure-devops
@@ -15,3 +16,11 @@ crash.log
 
 # .tfvars files
 *.tfvars
+
+# unwanted binary file
+**/debug.test
+dist
+
+
+#GoLand Editor configuration
+.idea
diff --git a/.go-version b/.go-version
@@ -0,0 +1 @@
+1.14.2
diff --git a/.golangci.yml b/.golangci.yml
@@ -0,0 +1,37 @@
+run:
+  deadline: 10m10s
+  modules-download-mode: vendor
+
+issues:
+  max-per-linter: 0
+  max-same-issues: 0
+
+linters:
+  disable-all: true
+  enable:
+    - deadcode
+    - errcheck
+    - gofmt
+    - goimports
+    - gosimple
+    - govet
+    - ineffassign
+    - interfacer
+    - nakedret
+    - misspell
+    - staticcheck
+    - structcheck
+    - typecheck
+    - unused
+    - unconvert
+    - varcheck
+    - vet
+    - vetshadow
+    - whitespace
+
+linters-settings:
+  errcheck:
+    ignore: github.com/hashicorp/terraform-plugin-sdk/helper/schema:ForceNew|Set,fmt:.*,io:Close
+  misspell:
+    ignore-words:
+      - hdinsight
diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -0,0 +1,28 @@
+# This is an example goreleaser.yaml file with some sane defaults.
+builds:
+- binary: "{{ .ProjectName }}_{{ .Tag }}"
+  env:
+  - CGO_ENABLED=0
+  goos:
+  - linux
+  - windows
+  - darwin
+archives:
+- name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}"
+  format_overrides:
+    - goos: windows
+      format: zip
+checksum:
+  name_template: 'checksums.txt'
+snapshot:
+  name_template: "terraform-provider-azuredevops"
+changelog:
+  sort: asc
+  filters:
+    exclude:
+    - '^docs:'
+    - '^test:'
+release:
+  github:
+    owner: microsoft
+    name: terraform-provider-azuredevops
diff --git a/.vscode/terraform.code-snippets b/.vscode/terraform.code-snippets
@@ -0,0 +1,194 @@
+{
+	// Place your terraform-provider-azuredevops workspace snippets here. Each snippet is defined under a snippet name and has a scope, prefix, body and
+	// description. Add comma separated ids of the languages where the snippet is applicable in the scope field. If scope
+	// is left empty or omitted, the snippet gets applied to all languages. The prefix is what is
+	// used to trigger the snippet and the body will be expanded and inserted. Possible variables are:
+	// $1, $2 for tab stops, $0 for the final cursor position, and ${1:label}, ${2:another} for placeholders.
+	// Placeholders with the same ids are connected.
+	// Example:
+	// "Print to console": {
+	// 	"scope": "javascript,typescript",
+	// 	"prefix": "log",
+	// 	"body": [
+	// 		"console.log('$1');",
+	// 		"$2"
+	// 	],
+	// 	"description": "Log output to console"
+	// }
+	"Resource Template": {
+		"scope": "go",
+		"prefix": "tf-azdo-rs",
+		"body": [
+			"package azuredevops",
+			"",
+			"import (",
+			"	\"fmt\"",
+			"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/helper/schema\"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/helper/validation\"",
+			"",
+			"	\"github.com/microsoft/azure-devops-go-api/azuredevops/core\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/validate\"",
+			")",
+			"",
+			"func resource${1}() *schema.Resource {",
+			"	return &schema.Resource{",
+			"		Create: resource${1}Create,",
+			"		Read:   resource${1}Read,",
+			"		Update: resource${1}Update,",
+			"		Delete: resource${1}Delete,",
+			"",
+			"		Schema: map[string]*schema.Schema{",
+			"			// add properties here",
+			"		},",
+			"	}",
+			"}",
+			"",
+			"func resource${1}Create(d *schema.ResourceData, m interface{}) error {",
+			"",
+			"	return resource${1}Read(d, m)",
+			"}",
+			"",
+			"func resource${1}Read(d *schema.ResourceData, m interface{}) error {",
+			"	clients := m.(*config.AggregatedClient)",
+			"",
+			"	return nil",
+			"}",
+			"",
+			"func resource${1}Update(d *schema.ResourceData, m interface{}) error {",
+			"	return resource${1}Read(d, m)",
+			"}",
+			"",
+			"func resource${1}Delete(d *schema.ResourceData, m interface{}) error {",
+			"	return nil",
+			"}",
+			""
+		],
+		"description": "Resource Template"
+	},
+	"Data Source Template": {
+		"scope": "go",
+		"prefix": "tf-azdo-ds",
+		"body": [
+			"package azuredevops",
+			"",
+			"import (",
+			"	\"fmt\"",
+			"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/helper/schema\"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/helper/validation\"",
+			"",
+			"	\"github.com/microsoft/azure-devops-go-api/azuredevops/core\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/validate\"",
+			")",
+			"",
+			"func dataSource${1}() *schema.Resource {",
+			"	return &schema.Resource{",
+			"		Read: dataSource${1}Read,",
+			"",
+			"		//https://godoc.org/github.com/hashicorp/terraform/helper/schema#Schema",
+			"		Schema: map[string]*schema.Schema{",
+			"			// add properties here",
+			"		},",
+			"",
+			"	}",
+			"}",
+			"",
+			"func dataSource${1}Read(d *schema.ResourceData, m interface{}) error {",
+			"	clients := m.(*config.AggregatedClient)",
+			"	${1}s := make([]map[string]interface{}, 0)",
+			"	",
+			"	// read data into map ${1}s",
+			"",
+			"	d.SetId(\"${1}s\")",
+			"	if err := d.Set(\"${1}s\", ${1}s); err != nil {",
+			"		return fmt.Errorf(\"Error setting `${1}s`: %+v\", err)",
+			"	}",
+			"",
+			"	return nil",
+			"}",
+			""
+		],
+		"description": "Data Source Template"
+	},
+	"Test Template": {
+		"scope": "go",
+		"prefix": "tf-azdo-test",
+		"body": [
+			"// +build all",
+			"",
+			"package azuredevops",
+			"",
+			"// The tests in this file use the mock clients in mock_client.go to mock out",
+			"// the Azure DevOps client operations.",
+			"",
+			"import (",
+			"	\"context\"",
+			"	\"errors\"",
+			"	\"fmt\"",
+			"	\"testing\"",
+			"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azdosdkmocks\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config\"",
+			"	\"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter\"",
+			"",
+			"	\"github.com/golang/mock/gomock\"",
+			"	\"github.com/google/uuid\"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/helper/acctest\"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/helper/resource\"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/helper/schema\"",
+			"	\"github.com/hashicorp/terraform-plugin-sdk/terraform\"",
+			"	\"github.com/microsoft/azure-devops-go-api/azuredevops/core\"",
+			"	\"github.com/microsoft/azure-devops-go-api/azuredevops/operations\"",
+			"	\"github.com/stretchr/testify/require\"",
+			")",
+			"",
+			"func init() {",
+			"	/* add code for test setup here */",
+			"}",
+			"",
+			"/**",
+			" * Begin unit tests",
+			" */",
+			"",
+			"func Test${1:Resource}_${2:Function}_Test${3:Subject}(t *testing.T) {",
+			"	ctrl := gomock.NewController(t)",
+			"	defer ctrl.Finish()",
+			"",
+			"	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)",
+			"	clients := &config.AggregatedClient{",
+			"		CoreClient: coreClient,",
+			"		Ctx:        context.Background(),",
+			"	}",
+			"",
+			"    /* start writing test here */",
+			"}",
+			""
+		],
+		"description": "Test Template"
+	},
+	"Test Function Template": {
+		"scope": "go",
+		"prefix": "tf-azdo-test-func",
+		"body": [
+			"func Test${1:Resource}_${2:Function}_Test${3:Subject}(t *testing.T) {",
+			"	ctrl := gomock.NewController(t)",
+			"	defer ctrl.Finish()",
+			"",
+			"	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)",
+			"	clients := &config.AggregatedClient{",
+			"		CoreClient: coreClient,",
+			"		Ctx:        context.Background(),",
+			"	}",
+			"",
+			"    /* start writing test here */",
+			"}",
+			""
+		],
+		"description": "Test Function Template"
+	}
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,19 @@
+## 0.0.1  (Unreleased)
+
+NOTES:
+* The Azure DevOps provider can be used to configure Azure DevOps project in [Microsoft Azure](https://azure.microsoft.com/en-us/) using [Azure DevOps Service REST API](https://docs.microsoft.com/en-us/rest/api/azure/devops/?view=azure-devops-rest-5.1)
+
+FEATURES:
+* **New Resource** `azuredevops_build_definition`                               
+* **New Resource** `azuredevops_project`                                                 
+* **New Resource** `azuredevops_variable_group` [#21](https://github.com/microsoft/terraform-provider-azuredevops/issues/21)
+* **New Resource** `azuredevops_serviceendpoint_github` [#3](https://github.com/microsoft/terraform-provider-azuredevops/issues/3)
+* **New Resource** `azuredevops_serviceendpoint_dockerhub` [#3](https://github.com/microsoft/terraform-provider-azuredevops/issues/3)
+* **New Resource** `azuredevops_serviceendpoint_azurerm` [#3](https://github.com/microsoft/terraform-provider-azuredevops/issues/3)
+* **New Resource** `azuredevops_git_repository` [#94](https://github.com/microsoft/terraform-provider-azuredevops/issues/94) [#95](https://github.com/microsoft/terraform-provider-azuredevops/issues/95) [#96](https://github.com/microsoft/terraform-provider-azuredevops/issues/96) [#97](https://github.com/microsoft/terraform-provider-azuredevops/issues/97)
+* **New Resource** `azuredevops_user_entitlement` [#125](https://github.com/microsoft/terraform-provider-azuredevops/issues/125)
+* **New Resource** `azuredevops_group_membership` [#74](github.com/microsoft/terraform-provider-azuredevops/issues/74)
+* **New Resource** `azuredevops_agent_pool` [#22](https://github.com/microsoft/terraform-provider-azuredevops/issues/22)
+* **New Resource** `azuredevops_group` [#103](https://github.com/microsoft/terraform-provider-azuredevops/issues/103)
+* **New Data Source** `azuredevops_group` [#126](https://github.com/microsoft/terraform-provider-azuredevops/issues/126)
+* **New Data Source** `azuredevops_projects` [#17](https://github.com/microsoft/terraform-provider-azuredevops/issues/17)
diff --git a/GNUmakefile b/GNUmakefile
@@ -0,0 +1,80 @@
+TEST?=$$(go list ./... |grep -v 'vendor')
+WEBSITE_REPO=github.com/hashicorp/terraform-website
+PKG_NAME=azuredevops
+TESTTIMEOUT=180m
+
+.EXPORT_ALL_VARIABLES:
+  TF_SCHEMA_PANIC_ON_ERROR=1
+  GO111MODULE=on
+  GOFLAGS=-mod=vendor
+
+default: build
+
+tools:
+	@echo "==> installing required tooling..."
+	@sh "$(CURDIR)/scripts/gogetcookie.sh"
+	GO111MODULE=off go get -u github.com/golangci/golangci-lint/cmd/golangci-lint
+	GO111MODULE=off go get -u github.com/client9/misspell/cmd/misspell
+	GO111MODULE=off go get -u github.com/bflad/tfproviderlint/cmd/tfproviderlint
+	GO111MODULE=off go get -u github.com/bflad/tfproviderdocs
+	GO111MODULE=off go get -u github.com/katbyte/terrafmt
+
+build: fmtcheck
+	go install
+
+fmt:
+	@echo "==> Fixing source code with gofmt..."
+	@echo "# This logic should match the search logic in scripts/gofmtcheck.sh"
+	find . -name '*.go' | grep -v vendor | xargs gofmt -s -w
+
+fmtcheck:
+	@sh -c "'$(CURDIR)/scripts/gofmtcheck.sh'"
+
+lint:
+	@echo "==> Checking source code against linters..."
+	golangci-lint run ./...
+
+test: fmtcheck
+	go test -tags "all" -i $(TEST) || exit 1
+	echo $(TEST) | \
+    		xargs -t -n4 go test -tags "all" $(TESTARGS) -timeout=30s -parallel=4
+
+testacc: fmtcheck
+	TF_ACC=1 go test -tags "all" $(TEST) -v $(TESTARGS) -timeout 120m
+
+test-compile:
+	@if [ "$(TEST)" = "./..." ]; then \
+		echo "ERROR: Set TEST to a specific package. For example,"; \
+		echo "  make test-compile TEST=./$(PKG_NAME)"; \
+		exit 1; \
+	fi
+	go test -c $(TEST) $(TESTARGS)
+
+vet:
+	@echo "go vet ."
+	@go vet $$(go list ./... | grep -v vendor/) ; if [ $$? -eq 1 ]; then \
+		echo ""; \
+		echo "Vet found suspicious constructs. Please check the reported constructs"; \
+		echo "and fix them if necessary before submitting the code for review."; \
+		exit 1; \
+	fi
+
+website:
+ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
+	echo "$(WEBSITE_REPO) not found in your GOPATH (necessary for layouts and assets), get-ting..."
+	git clone https://$(WEBSITE_REPO) $(GOPATH)/src/$(WEBSITE_REPO)
+endif
+	@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
+
+website-lint:
+	@echo "==> Checking website against linters..."
+	@misspell -error -source=text website/
+
+website-test:
+ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
+	echo "$(WEBSITE_REPO) not found in your GOPATH (necessary for layouts and assets), get-ting..."
+	git clone https://$(WEBSITE_REPO) $(GOPATH)/src/$(WEBSITE_REPO)
+endif
+	@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider-test PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
+
+.PHONY: build test testacc vet fmt fmtcheck lint tools test-compile website website-lint website-test
diff --git a/README.md b/README.md
@@ -1,26 +1,20 @@
-# Terraform Provider for Azure DevOps
+# Terraform Provider for Azure DevOps (Devops Resource Manager)
 
-[![Build Status](https://dev.azure.com/terraform-azdo/terraform-provider-azuredevops/_apis/build/status/microsoft.terraform-provider-azuredevops?branchName=master)](https://dev.azure.com/terraform-azdo/terraform-provider-azuredevops/_build/latest?definitionId=3&branchName=master)
+[![Gitter](https://badges.gitter.im/terraform-provider-azuredevops/community.svg)](https://gitter.im/terraform-provider-azuredevops/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
 [![Go Report Card](https://goreportcard.com/badge/github.com/microsoft/terraform-provider-azuredevops)](https://goreportcard.com/report/github.com/microsoft/terraform-provider-azuredevops)
 
-The AzDO (Azure DevOps) Provider supports Terraform 0.11.x and later - but Terraform 0.12.x is recommended.
+The AzureRM Provider supports Terraform 0.12.x and later.
 
 * [Terraform Website](https://www.terraform.io)
-* [AzDO Website](https://azure.microsoft.com/en-us/services/devops/)
-* [AzDO Provider Usage Examples](./examples/)
-
-## Important!
-This repository is a work in progress and is not yet suitable for production workloads. Community contributions are welcome.
+* [Azure DevOps Website](https://azure.microsoft.com/en-us/services/devops/)
+* [Provider Documentation](./website/docs/index.html.markdown)
+* [Resources Documentation](./website/docs/r/)
+* [Data Sources Documentation](./website/docs/d/)
+* [Usage Examples](./examples/)
+* [Gitter Channel](https://gitter.im/terraform-provider-azuredevops/community)
 
 ## Usage Example
 
-* Installing the provider
-```bash
-./scripts/build.sh          # build & test provider code
-./scripts/local-install.sh  # install provider locally
-```
-
-* Using the provider
 ```hcl
 # Make sure to set the following environment variables:
 #   AZDO_PERSONAL_ACCESS_TOKEN
@@ -30,28 +24,161 @@ provider "azuredevops" {
 }
 
 resource "azuredevops_project" "project" {
-  project_name       = "Test Project"
-  description        = "Test Project Description"
-  visibility         = "private"
-  version_control    = "Git"
-  work_item_template = "Agile"
+  project_name = "My Awesome Project"
+  description  = "All of my awesomee things"
+}
+
+resource "azuredevops_git_repository" "repository" {
+  project_id = azuredevops_project.project.id
+  name       = "My Awesome Repo"
+  initialization {
+    init_type = "Clean"
+  }
 }
 
 resource "azuredevops_build_definition" "build_definition" {
-  project_id      = azuredevops_project.project.id
-  name            = "Test Pipeline"
-  agent_pool_name = "Hosted Ubuntu 1604"
+  project_id = azuredevops_project.project.id
+  name       = "My Awesome Build Pipeline"
+  path       = "\\"
 
   repository {
-    repo_type             = "GitHub"
-    repo_name             = "nmiodice/terraform-azure-devops-hack"
-    branch_name           = "master"
-    yml_path              = "azdo-api-samples/azure-pipeline.yml"
-    service_connection_id = "1a0e1da9-57a6-4470-8e96-160a622c4a17" # Note: Eventually this will come from a GitHub Service Connection resource...  
+    repo_type   = "TfsGit"
+    repo_id     = azuredevops_git_repository.repository.id
+    branch_name = azuredevops_git_repository.repository.default_branch
+    yml_path    = "azure-pipelines.yml"
   }
 }
 ```
 
-# Contributing
+## Developer Requirements
+
+* [Terraform](https://www.terraform.io/downloads.html) version 0.12.x +
+* [Go](https://golang.org/doc/install) version 1.13.x (to build the provider plugin)
+
+If you're on Windows you'll also need:
+* [Git for Windows](https://git-scm.com/download/win)
+
+If you what to use the `makefile` build strategy on Windows it's required to install
+
+* [Make for Windows](http://gnuwin32.sourceforge.net/packages/make.htm)
+
+For *GNU32 Make*, make sure its bin path is added to PATH environment variable.*
+
+For *Git Bash for Windows*, at the step of "Adjusting your PATH environment", please choose "Use Git and optional Unix tools from Windows Command Prompt".*
+
+As [described below](#build-using-powerShell-scripts) we provide some PowerShell scripts to build the provider on Windows, without the requiremet to install any Unix based tools aside Go.
+
+## Developing the Provider
+
+If you wish to work on the provider, you'll first need [Go](http://www.golang.org) installed on your machine (version 1.13+ is **required**). You'll also need to correctly setup a [GOPATH](http://golang.org/doc/code.html#GOPATH), as well as adding `$GOPATH/bin` to your `$PATH`.
+
+### Using the GOPATH model
+
+First clone the repository to: `$GOPATH/src/github.com/terraform-providers/terraform-provider-azuredevops`
+
+```sh
+$ mkdir -p $GOPATH/src/github.com/terraform-providers && cd "$_"
+$ git clone git@github.com:microsoft/terraform-provider-azuredevops.git
+$ cd terraform-provider-azuredevops
+```
+
+Once you've cloned, run the `./scripts/build.sh` and `./scripts/local-install.sh`, as recommended [here](https://github.com/microsoft/terraform-provider-azuredevops/blob/master/docs/contributing.md#3-build--install-provider).
+These commands will sideload the plugin for Terraform.
+
+### Using a directory separate from GOPATH
+
+The infrastructure supports building and testing the provider outside `GOPATH` in an arbitrary directory.
+In this scenario all required packages of the provider during build will be managed via the `pkg` in `$GOPATH`. As with the [GOPATH Model](#using-the-gopath-model), you can redefine the `GOPATH` environment variable to prevent existing packages in the current `GOPATH` directory from being changed.
+
+### Build using make
+
+Once inside the provider directory, you can run `make tools` to install the dependent tooling required to compile the provider.
+
+At this point you can compile the provider by running `make build`, which will build the provider and put the provider binary in the `$GOPATH/bin` directory.
+
+```sh
+$ make build
+...
+$ $GOPATH/bin/terraform-provider-azuredevops
+...
+```
+
+You can also cross-compile if necessary:
+
+```sh
+GOOS=windows GOARCH=amd64 make build
+```
+
+In order to run the Unit Tests for the provider, you can run:
+
+```sh
+$ make test
+```
+
+The majority of tests in the provider are Acceptance Tests - which provisions real resources in Azure. It's possible to run the entire acceptance test suite by running `make testacc` - however it's likely you'll want to run a subset, which you can do using a prefix, by running:
+
+```sh
+make testacc SERVICE='resource' TESTARGS='-run=TestAccAzureRMResourceGroup' TESTTIMEOUT='60m'
+```
+
+### Build using PowerShell scripts
+
+If you like to develop on Windows, we provide a set of PowerShell scripts to build and test the provider.
+They don't offer the luxury of a Makefile environment but are quite sufficient to develop on Windows.
+
+#### `scripts\build.ps1`
+
+The `build.ps1`is used to build the provider. Aside this the script runs (if not skipped) the defined unit tests and is able to install the compiled provider locally.
+
+| Parameter   | Description                                                                               |
+|-------------|-------------------------------------------------------------------------------------------|
+| -SkipTests  | Skip running unit tests during build                                                      |
+| -Install    | Install the provider locally, after a successful build                                    |
+| -DebugBuild | Build the provider with extra debugging information                                       |
+| -GoMod      | Control the `-mod` build parameter: Valid values: '' (Empty string), 'vendor', 'readonly' |
+
+#### `scripts\unittest.ps1`
+
+The script is used to execute unit tests. The script is also executed by `build.ps1` if the `-SkipTest` are not specified.
+
+| Parameter   | Description                                                                                                                       |
+|-------------|-----------------------------------------------------------------------------------------------------------------------------------|
+| -TestFilter | A GO regular expression which filters the test functions to be executed                                                           |
+| -Tag        | Tests in the provider project are organized with GO build tags. The parameter accepts a list of tag names which should be tested. |
+| -GoMod      | Control the `-mod` build parameter: Valid values: '' (Empty string), 'vendor', 'readonly'                                         |
+
+#### `scripts\acctest.ps1`
+
+The script is used to execute unit tests.
+
+| Parameter   | Description                                                                                                                       |
+|-------------|-----------------------------------------------------------------------------------------------------------------------------------|
+| -TestFilter | A GO regular expression which filters the test functions to be executed                                                           |
+| -Tag        | Tests in the provider project are organized with GO build tags. The parameter accepts a list of tag names which should be tested. |
+| -GoMod      | Control the `-mod` build parameter: Valid values: '' (Empty string), 'vendor', 'readonly'                                         |
+
+#### `scripts\gofmtcheck.ps1`
+
+To validate if all `.go` files adhere to the required formatting rules, execute `gofmtcheck.ps1`
+
+| Parameter | Description                                                                                                    |
+|-----------|----------------------------------------------------------------------------------------------------------------|
+| -Fix      | Fix any formatting rule deviations automatically. If the parameter is not set, the script runs in report mode. |
+
+#### `scripts\lint-check-go.ps1`
+
+Like with `gofmtcheck.ps1` the script validate if all `.go` files adhere to the required formatting rules and if any style mistakes exist. In difference to `gofmtcheck.ps1` the script uses Golint instead of Gofmt.
+
+## Environment variables for acceptance tests
+
+The following Environment Variables must be set in your shell prior to running acceptance tests:
+
+- `AZDO_ORG_SERVICE_URL`
+- `AZDO_PERSONAL_ACCESS_TOKEN`
+- `AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL`
+- `AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD`
+- `AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME`
+- `AZDO_GITHUB_SERVICE_CONNECTION_PAT`
+- `AZDO_TEST_AAD_USER_EMAIL`
 
-Interested in contributing to the provider? Great, we need your help. Get started by reading the [contributing](./docs/contributing.md) document.
+**Note:** Acceptance tests create real resources in Azure DevOps which often cost money to run.
diff --git a/README.md.lengacy b/README.md.lengacy
@@ -0,0 +1,80 @@
+# Terraform Provider for Azure DevOps
+
+[![Gitter](https://badges.gitter.im/terraform-provider-azuredevops/community.svg)](https://gitter.im/terraform-provider-azuredevops/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
+[![Build Status](https://dev.azure.com/terraform-azdo/terraform-provider-azuredevops/_apis/build/status/Nightly%20Build?branchName=master)](https://dev.azure.com/terraform-azdo/terraform-provider-azuredevops/_build/latest?definitionId=27&branchName=master)
+[![Go Report Card](https://goreportcard.com/badge/github.com/microsoft/terraform-provider-azuredevops)](https://goreportcard.com/report/github.com/microsoft/terraform-provider-azuredevops)
+
+The AzDO (Azure DevOps) Provider supports Terraform 0.11.x and later - but Terraform 0.12.x is recommended.
+
+* [Terraform Website](https://www.terraform.io)
+* [AzDO Website](https://azure.microsoft.com/en-us/services/devops/)
+* [AzDO Provider Documentation](website/docs/index.html.markdown)
+* [AzDO Provider Usage Examples](./examples/)
+
+Checkout our [Project Roadmap](./docs/roadmap.md).
+
+## Important!
+This repository is a work in progress and is not yet suitable for production workloads. Community contributions are welcome.
+
+## Looking for AzDO Provider Documentation?
+
+![docs](docs/images/terraform-docs-website.png)
+
+The documentation for things like resource specific usage examples, required parameters and default values can be found under the [/website](website) directory, which contains all of the [AzDO Provider Documentation](website/docs/index.html.markdown).
+
+## Configuration Values
+
+| Environment Variable | Description | Required? | Example |
+| --- | --- | --- | --- |
+| `AZDO_PERSONAL_ACCESS_TOKEN` | A personal access token that grants access to Azure DevOps APIs within the org specified by `AZDO_ORG_SERVICE_URL` | yes | `d7894a91db7610e39decbe09b2dfd449ed2ed5a` |
+| `AZDO_ORG_SERVICE_URL` | URL of the Azure DevOps org in which resources will be provisioned/managed | yes | `https://dev.azure.com/contoso-org` |
+| `AZDO_GITHUB_SERVICE_CONNECTION_PAT` | If running the acceptance tests, you will need this defined in order to validate the GitHub Service Connection resource | for acceptance tests only | `a9194a91d75643e39decbe09b2dfd558dd2abca` |
+| `AZDO_PRJ_CREATE_DELAY` | Delay (in seconds) to insert after creation of projects. This was determined to be useful based on observed behavior of the AzDO APIs | no | `10` |
+
+## Usage Example
+
+* Installing the provider
+```bash
+./scripts/build.sh          # build & test provider code
+./scripts/local-install.sh  # install provider locally
+```
+
+* Provision project, repository and build pipeline using the provider
+```hcl
+# Make sure to set the following environment variables:
+#   AZDO_PERSONAL_ACCESS_TOKEN
+#   AZDO_ORG_SERVICE_URL
+provider "azuredevops" {
+  version = ">= 0.0.1"
+}
+
+resource "azuredevops_project" "project" {
+  project_name = "My Awesome Project"
+  description  = "All of my awesomee things"
+}
+
+resource "azuredevops_git_repository" "repository" {
+  project_id = azuredevops_project.project.id
+  name       = "My Awesome Repo"
+  initialization {
+    init_type = "Clean"
+  }
+}
+
+resource "azuredevops_build_definition" "build_definition" {
+  project_id = azuredevops_project.project.id
+  name       = "My Awesome Build Pipeline"
+  path       = "\\"
+
+  repository {
+    repo_type   = "TfsGit"
+    repo_name   = azuredevops_git_repository.repository.name
+    branch_name = azuredevops_git_repository.repository.default_branch
+    yml_path    = "azure-pipelines.yml"
+  }
+}
+```
+
+# Contributing
+
+Interested in contributing to the provider? Great, we need your help. Get started by reading the [contributing](./docs/contributing.md) document.
diff --git a/azdosdkmocks/accounts_sdk_mock.go b/azdosdkmocks/accounts_sdk_mock.go
diff --git a/azdosdkmocks/build_sdk_mock.go b/azdosdkmocks/build_sdk_mock.go
diff --git a/azdosdkmocks/core_sdk_mock.go b/azdosdkmocks/core_sdk_mock.go
diff --git a/azdosdkmocks/git_sdk_mock.go b/azdosdkmocks/git_sdk_mock.go
diff --git a/azdosdkmocks/graph_sdk_mock.go b/azdosdkmocks/graph_sdk_mock.go
diff --git a/azdosdkmocks/identity_sdk_mock.go b/azdosdkmocks/identity_sdk_mock.go
diff --git a/azdosdkmocks/memberentitlementmanagement_sdk_mock.go b/azdosdkmocks/memberentitlementmanagement_sdk_mock.go
diff --git a/azdosdkmocks/operations_sdk_mock.go b/azdosdkmocks/operations_sdk_mock.go
diff --git a/azdosdkmocks/policy_sdk_mock.go b/azdosdkmocks/policy_sdk_mock.go
diff --git a/azdosdkmocks/profile_sdk_mock.go b/azdosdkmocks/profile_sdk_mock.go
diff --git a/azdosdkmocks/serviceendpoint_sdk_mock.go b/azdosdkmocks/serviceendpoint_sdk_mock.go
diff --git a/azdosdkmocks/taskagent_sdk_mock.go b/azdosdkmocks/taskagent_sdk_mock.go
diff --git a/azdosdkmocks/test_sdk_mock.go b/azdosdkmocks/test_sdk_mock.go
diff --git a/azuredevops/config.go b/azuredevops/config.go
diff --git a/azuredevops/crud/serviceendpoint/crud_service_endpoint.go b/azuredevops/crud/serviceendpoint/crud_service_endpoint.go
@@ -0,0 +1,270 @@
+package crudserviceendpoint
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/serviceendpoint"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/tfhelper"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/validate"
+)
+
+const errMsgTfConfigRead = "Error reading terraform configuration: %+v"
+
+type flatFunc func(d *schema.ResourceData, serviceEndpoint *serviceendpoint.ServiceEndpoint, projectID *string)
+type expandFunc func(d *schema.ResourceData) (*serviceendpoint.ServiceEndpoint, *string, error)
+type importFunc func(clients *config.AggregatedClient, id string) (string, string, error)
+
+//GenBaseServiceEndpointResource creates a Resource with the common parts
+// that all Service Endpoints require.
+func GenBaseServiceEndpointResource(f flatFunc, e expandFunc, i importFunc) *schema.Resource {
+	return &schema.Resource{
+		Create: genServiceEndpointCreateFunc(f, e),
+		Read:   genServiceEndpointReadFunc(f),
+		Update: genServiceEndpointUpdateFunc(f, e),
+		Delete: genServiceEndpointDeleteFunc(e),
+		Importer: &schema.ResourceImporter{
+			State: func(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				projectID, serviceEndpointID, err := i(meta.(*config.AggregatedClient), d.Id())
+				if err != nil {
+					return nil, fmt.Errorf("Error parsing the variable service endpoint ID from the Terraform resource data:  %v", err)
+				}
+				d.Set("project_id", projectID)
+				d.SetId(serviceEndpointID)
+
+				return []*schema.ResourceData{d}, nil
+			},
+		},
+		Schema: genBaseSchema(),
+	}
+}
+
+func genBaseSchema() map[string]*schema.Schema {
+	return map[string]*schema.Schema{
+		"project_id": {
+			Type:     schema.TypeString,
+			Required: true,
+			ForceNew: true,
+		},
+		"service_endpoint_name": {
+			Type:         schema.TypeString,
+			Required:     true,
+			ValidateFunc: validate.NoEmptyStrings,
+			ForceNew:     true,
+		},
+		"description": {
+			Type:     schema.TypeString,
+			Optional: true,
+			Default:  "Managed by Terraform",
+		},
+		"authorization": {
+			Type:     schema.TypeMap,
+			Optional: true,
+			Computed: true,
+			Elem: &schema.Schema{
+				Type: schema.TypeString,
+			},
+		},
+	}
+}
+
+// DoBaseExpansion performs the expansion for the 'base' attributes that are defined in the schema, above
+func DoBaseExpansion(d *schema.ResourceData) (*serviceendpoint.ServiceEndpoint, *string) {
+	// an "error" is OK here as it is expected in the case that the ID is not set in the resource data
+	var serviceEndpointID *uuid.UUID
+	parsedID, err := uuid.Parse(d.Id())
+	if err == nil {
+		serviceEndpointID = &parsedID
+	}
+	projectID := converter.String(d.Get("project_id").(string))
+	serviceEndpoint := &serviceendpoint.ServiceEndpoint{
+		Id:          serviceEndpointID,
+		Name:        converter.String(d.Get("service_endpoint_name").(string)),
+		Owner:       converter.String("library"),
+		Description: converter.String(d.Get("description").(string)),
+	}
+
+	return serviceEndpoint, projectID
+}
+
+// DoBaseFlattening performs the flattening for the 'base' attributes that are defined in the schema, above
+func DoBaseFlattening(d *schema.ResourceData, serviceEndpoint *serviceendpoint.ServiceEndpoint, projectID *string) {
+	d.SetId(serviceEndpoint.Id.String())
+	d.Set("service_endpoint_name", *serviceEndpoint.Name)
+	d.Set("project_id", projectID)
+	d.Set("description", *serviceEndpoint.Description)
+	d.Set("authorization", &map[string]interface{}{
+		"scheme": *serviceEndpoint.Authorization.Scheme,
+	})
+}
+
+// GetScheme allows you to get the nested scheme value
+func GetScheme(d *schema.ResourceData) (string, error) {
+	authorization := d.Get("authorization").(*schema.Set)
+	if authorization == nil {
+		return "", errors.New("authorization not set")
+	}
+	authorizationList := authorization.List()
+	if len(authorizationList) != 1 {
+		return "", errors.New("authorization is invalid")
+	}
+	scheme := authorizationList[0].(map[string]interface{})["scheme"].(string)
+	return scheme, nil
+}
+
+// MakeProtectedSchema create protected schema
+func MakeProtectedSchema(r *schema.Resource, keyName, envVarName, description string) {
+	r.Schema[keyName] = &schema.Schema{
+		Type:             schema.TypeString,
+		Required:         true,
+		DefaultFunc:      schema.EnvDefaultFunc(envVarName, nil),
+		Description:      description,
+		Sensitive:        true,
+		DiffSuppressFunc: tfhelper.DiffFuncSuppressSecretChanged,
+	}
+
+	secretHashKey, secretHashSchema := tfhelper.GenerateSecreteMemoSchema(keyName)
+	r.Schema[secretHashKey] = secretHashSchema
+}
+
+// MakeUnprotectedSchema create unprotected schema
+func MakeUnprotectedSchema(r *schema.Resource, keyName, envVarName, description string) {
+	r.Schema[keyName] = &schema.Schema{
+		Type:        schema.TypeString,
+		Required:    true,
+		DefaultFunc: schema.EnvDefaultFunc(envVarName, nil),
+		Description: description,
+	}
+}
+
+// Make the Azure DevOps API call to create the endpoint
+func createServiceEndpoint(clients *config.AggregatedClient, endpoint *serviceendpoint.ServiceEndpoint, project *string) (*serviceendpoint.ServiceEndpoint, error) {
+	if strings.EqualFold(*endpoint.Type, "github") && strings.EqualFold(*endpoint.Authorization.Scheme, "InstallationToken") {
+		return nil, fmt.Errorf("Github Apps must be created on Github and then can be imported")
+	}
+	createdServiceEndpoint, err := clients.ServiceEndpointClient.CreateServiceEndpoint(
+		clients.Ctx,
+		serviceendpoint.CreateServiceEndpointArgs{
+			Endpoint: endpoint,
+			Project:  project,
+		})
+
+	return createdServiceEndpoint, err
+}
+
+func deleteServiceEndpoint(clients *config.AggregatedClient, project *string, endPointID *uuid.UUID) error {
+	err := clients.ServiceEndpointClient.DeleteServiceEndpoint(
+		clients.Ctx,
+		serviceendpoint.DeleteServiceEndpointArgs{
+			Project:    project,
+			EndpointId: endPointID,
+		})
+
+	return err
+}
+
+func updateServiceEndpoint(clients *config.AggregatedClient, endpoint *serviceendpoint.ServiceEndpoint, project *string) (*serviceendpoint.ServiceEndpoint, error) {
+	if strings.EqualFold(*endpoint.Type, "github") && strings.EqualFold(*endpoint.Authorization.Scheme, "InstallationToken") {
+		return nil, fmt.Errorf("Github Apps can not be updated must match imported values exactly")
+	}
+	updatedServiceEndpoint, err := clients.ServiceEndpointClient.UpdateServiceEndpoint(
+		clients.Ctx,
+		serviceendpoint.UpdateServiceEndpointArgs{
+			Endpoint:   endpoint,
+			Project:    project,
+			EndpointId: endpoint.Id,
+		})
+
+	return updatedServiceEndpoint, err
+}
+
+func genServiceEndpointCreateFunc(flatFunc flatFunc, expandFunc expandFunc) func(d *schema.ResourceData, m interface{}) error {
+	return func(d *schema.ResourceData, m interface{}) error {
+		clients := m.(*config.AggregatedClient)
+		serviceEndpoint, projectID, err := expandFunc(d)
+		if err != nil {
+			return fmt.Errorf(errMsgTfConfigRead, err)
+		}
+
+		createdServiceEndpoint, err := createServiceEndpoint(clients, serviceEndpoint, projectID)
+		if err != nil {
+			return fmt.Errorf("Error creating service endpoint in Azure DevOps: %+v", err)
+		}
+
+		flatFunc(d, createdServiceEndpoint, projectID)
+		return nil
+	}
+}
+
+func genServiceEndpointReadFunc(flatFunc flatFunc) func(d *schema.ResourceData, m interface{}) error {
+	return func(d *schema.ResourceData, m interface{}) error {
+		clients := m.(*config.AggregatedClient)
+
+		var serviceEndpointID *uuid.UUID
+		parsedServiceEndpointID, err := uuid.Parse(d.Id())
+		if err != nil {
+			return fmt.Errorf("Error parsing the service endpoint ID from the Terraform resource data: %v", err)
+		}
+		serviceEndpointID = &parsedServiceEndpointID
+		projectID := converter.String(d.Get("project_id").(string))
+
+		serviceEndpoint, err := clients.ServiceEndpointClient.GetServiceEndpointDetails(
+			clients.Ctx,
+			serviceendpoint.GetServiceEndpointDetailsArgs{
+				EndpointId: serviceEndpointID,
+				Project:    projectID,
+			},
+		)
+		if err != nil {
+			if utils.ResponseWasNotFound(err) {
+				d.SetId("")
+				return nil
+			}
+			return fmt.Errorf("Error looking up service endpoint given ID (%v) and project ID (%v): %v", serviceEndpointID, projectID, err)
+		}
+
+		if serviceEndpoint.Id == nil {
+			// e.g. service endpoint has been deleted separately without TF
+			d.SetId("")
+		} else {
+			flatFunc(d, serviceEndpoint, projectID)
+		}
+		return nil
+	}
+}
+
+func genServiceEndpointUpdateFunc(flatFunc flatFunc, expandFunc expandFunc) schema.UpdateFunc {
+	return func(d *schema.ResourceData, m interface{}) error {
+		clients := m.(*config.AggregatedClient)
+		serviceEndpoint, projectID, err := expandFunc(d)
+		if err != nil {
+			return fmt.Errorf(errMsgTfConfigRead, err)
+		}
+
+		updatedServiceEndpoint, err := updateServiceEndpoint(clients, serviceEndpoint, projectID)
+		if err != nil {
+			return fmt.Errorf("Error updating service endpoint in Azure DevOps: %+v", err)
+		}
+
+		flatFunc(d, updatedServiceEndpoint, projectID)
+		return nil
+	}
+}
+
+func genServiceEndpointDeleteFunc(expandFunc expandFunc) schema.DeleteFunc {
+	return func(d *schema.ResourceData, m interface{}) error {
+		clients := m.(*config.AggregatedClient)
+		serviceEndpoint, projectID, err := expandFunc(d)
+		if err != nil {
+			return fmt.Errorf(errMsgTfConfigRead, err)
+		}
+
+		return deleteServiceEndpoint(clients, projectID, serviceEndpoint.Id)
+	}
+}
diff --git a/azuredevops/data_client_config.go b/azuredevops/data_client_config.go
@@ -0,0 +1,32 @@
+package azuredevops
+
+import (
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+)
+
+const (
+	organizationURL = "organization_url"
+)
+
+func dataClientConfig() *schema.Resource {
+	return &schema.Resource{
+		Read: clientConfigRead,
+		Schema: map[string]*schema.Schema{
+			organizationURL: {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func clientConfigRead(d *schema.ResourceData, m interface{}) error {
+	// The ID is meaningless for this data source, so ID can act as a
+	// point in time snapshot
+	d.SetId(time.Now().UTC().String())
+	d.Set(organizationURL, m.(*config.AggregatedClient).OrganizationURL)
+	return nil
+}
diff --git a/azuredevops/data_client_config_test.go b/azuredevops/data_client_config_test.go
@@ -0,0 +1,37 @@
+// +build all core
+
+package azuredevops
+
+import (
+	"os"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/testhelper"
+)
+
+/**
+ * Begin acceptance tests
+ */
+
+// Verifies that the client config data source loads the configured AzDO org
+func TestAccClientConfig_LoadsCorrectProperties(t *testing.T) {
+	tfNode := "data.azuredevops_client_config.c"
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testhelper.TestAccPreCheck(t, nil) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: `data "azuredevops_client_config" "c" {}`,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(tfNode, "id"),
+					resource.TestCheckResourceAttr(tfNode, "organization_url", os.Getenv("AZDO_ORG_SERVICE_URL")),
+				),
+			},
+		},
+	})
+}
+
+func init() {
+	InitProvider()
+}
diff --git a/azuredevops/data_git_repositories.go b/azuredevops/data_git_repositories.go
@@ -0,0 +1,225 @@
+package azuredevops
+
+import (
+	"crypto/sha1"
+	"encoding/base64"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/git"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/suppress"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/validate"
+)
+
+func dataGitRepositories() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceGitRepositoriesRead,
+		Schema: map[string]*schema.Schema{
+			"project_id": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateFunc:     validate.UUID,
+				DiffSuppressFunc: suppress.CaseDifference,
+			},
+			"name": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateFunc:     validate.NoEmptyStrings,
+				DiffSuppressFunc: suppress.CaseDifference,
+			},
+			"include_hidden": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+			"repositories": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"url": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"ssh_url": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"web_url": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"remote_url": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"project_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"size": {
+							Type:     schema.TypeInt,
+							Computed: true,
+						},
+						"default_branch": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func dataSourceGitRepositoriesRead(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+
+	projectRepos, err := getGitRepositoriesByNameAndProject(d, clients)
+	if err != nil {
+		if utils.ResponseWasNotFound(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error finding repositories. Error: %v", err)
+	}
+	log.Printf("[TRACE] plugin.terraform-provider-azuredevops: Read [%d] Git repositories", len(*projectRepos))
+
+	results, err := flattenGitRepositories(projectRepos)
+	if err != nil {
+		return fmt.Errorf("Error flattening projects. Error: %v", err)
+	}
+
+	repoNames, err := getAttributeValues(results, "name")
+	if err != nil {
+		return fmt.Errorf("Failed to get list of repository names: %v", err)
+	}
+	id, err := createGitRepositoryDataSourceID(d, &repoNames)
+	if err != nil {
+		return err
+	}
+	d.SetId(id)
+	err = d.Set("repositories", results)
+	if err != nil {
+		d.SetId("")
+		return err
+	}
+	return nil
+}
+
+func createGitRepositoryDataSourceID(d *schema.ResourceData, repoNames *[]string) (string, error) {
+	h := sha1.New()
+	var names []string
+	if nil == repoNames {
+		names = []string{}
+	} else {
+		names = *repoNames
+	}
+	if len(names) <= 0 {
+		names = append(names, "empty")
+	}
+	projectID := d.Get("project_id").(string)
+	if projectID != "" {
+		names = append([]string{projectID}, names...)
+	}
+	if _, err := h.Write([]byte(strings.Join(names, "-"))); err != nil {
+		return "", fmt.Errorf("Unable to compute hash for Git repository names: %v", err)
+	}
+	return "gitRepos#" + base64.URLEncoding.EncodeToString(h.Sum(nil)), nil
+}
+
+func flattenGitRepositories(repos *[]git.GitRepository) ([]interface{}, error) {
+	if repos == nil {
+		return []interface{}{}, nil
+	}
+
+	results := make([]interface{}, 0)
+
+	for _, element := range *repos {
+		output := make(map[string]interface{})
+		if element.Name != nil {
+			output["name"] = *element.Name
+		}
+
+		if element.Id != nil {
+			output["id"] = element.Id.String()
+		}
+
+		if element.Url != nil {
+			output["url"] = *element.Url
+		}
+
+		if element.RemoteUrl != nil {
+			output["remote_url"] = *element.RemoteUrl
+		}
+
+		if element.SshUrl != nil {
+			output["ssh_url"] = *element.SshUrl
+		}
+
+		if element.WebUrl != nil {
+			output["web_url"] = *element.WebUrl
+		}
+
+		if element.Project != nil && element.Project.Id != nil {
+			output["project_id"] = element.Project.Id.String()
+		}
+
+		if element.Size != nil {
+			output["size"] = *element.Size
+		}
+
+		if element.DefaultBranch != nil {
+			output["default_branch"] = *element.DefaultBranch
+		}
+
+		results = append(results, output)
+	}
+
+	return results, nil
+}
+
+func getGitRepositoriesByNameAndProject(d *schema.ResourceData, clients *config.AggregatedClient) (*[]git.GitRepository, error) {
+	var repos *[]git.GitRepository
+	var err error
+	name, projectID := d.Get("name").(string), d.Get("project_id").(string)
+	includeHidden := d.Get("include_hidden").(bool)
+
+	if name != "" && projectID != "" {
+		repo, err := gitRepositoryRead(clients, "", name, projectID)
+		if err != nil {
+			return nil, err
+		}
+		repos = &[]git.GitRepository{*repo}
+	} else {
+		repos, err = clients.GitReposClient.GetRepositories(clients.Ctx, git.GetRepositoriesArgs{
+			Project:       converter.String(projectID),
+			IncludeHidden: converter.Bool(includeHidden),
+		})
+		if err != nil {
+			return nil, err
+		}
+		if name != "" {
+			for _, repo := range *repos {
+				if strings.EqualFold(*repo.Name, name) {
+					repos = &[]git.GitRepository{repo}
+					break
+				}
+			}
+		}
+	}
+	return repos, nil
+}
diff --git a/azuredevops/data_git_repositories_test.go b/azuredevops/data_git_repositories_test.go
@@ -0,0 +1,334 @@
+// +build all core data_git_repositories
+
+package azuredevops
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/core"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/git"
+	"github.com/microsoft/terraform-provider-azuredevops/azdosdkmocks"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/testhelper"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	/* add code for test setup here */
+}
+
+var gitRepoListEmpty = []git.GitRepository{}
+
+var azProjectRef = &core.TeamProjectReference{
+	Id:   testhelper.CreateUUID(),
+	Name: converter.String("project-01"),
+}
+
+var gitRepoList = []git.GitRepository{
+	{
+		Links:            nil,
+		DefaultBranch:    nil,
+		Id:               testhelper.CreateUUID(),
+		IsFork:           converter.Bool(false),
+		Name:             converter.String("repo-01"),
+		ParentRepository: nil,
+		Project:          azProjectRef,
+		RemoteUrl:        nil,
+		Size:             nil,
+		SshUrl:           nil,
+		Url:              nil,
+		ValidRemoteUrls:  nil,
+		WebUrl:           nil,
+	},
+	{
+		Links:         nil,
+		DefaultBranch: converter.String("master"),
+		Id:            testhelper.CreateUUID(),
+		IsFork:        converter.Bool(true),
+		Name:          converter.String("repo-02"),
+		ParentRepository: &git.GitRepositoryRef{
+			Id:   testhelper.CreateUUID(),
+			Name: converter.String("repo-parent-02"),
+		},
+		Project:         azProjectRef,
+		RemoteUrl:       nil,
+		Size:            converter.UInt64(0),
+		SshUrl:          nil,
+		Url:             nil,
+		ValidRemoteUrls: nil,
+		WebUrl:          nil,
+	},
+	{
+		Links:            nil,
+		DefaultBranch:    converter.String("dev"),
+		Id:               testhelper.CreateUUID(),
+		IsFork:           nil,
+		Name:             converter.String("repo-03"),
+		ParentRepository: nil,
+		Project: &core.TeamProjectReference{
+			Id:   testhelper.CreateUUID(),
+			Name: converter.String("project-02"),
+		},
+		RemoteUrl:       nil,
+		Size:            converter.UInt64(1234),
+		SshUrl:          nil,
+		Url:             nil,
+		ValidRemoteUrls: nil,
+		WebUrl:          nil,
+	},
+}
+
+func TestGitRepositoriesDataSource_Read_TestHandleError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	repoClient := azdosdkmocks.NewMockGitClient(ctrl)
+
+	clients := &config.AggregatedClient{
+		GitReposClient: repoClient,
+		GraphClient:    graphClient,
+		Ctx:            context.Background(),
+	}
+
+	expectedGetRepositoriesArgs := git.GetRepositoriesArgs{
+		IncludeHidden: converter.Bool(false),
+	}
+
+	repoClient.
+		EXPECT().
+		GetRepositories(clients.Ctx, expectedGetRepositoriesArgs).
+		Return(nil, errors.New("GetRepositories() Failed")).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataGitRepositories().Schema, nil)
+
+	err := dataSourceGitRepositoriesRead(resourceData, clients)
+	require.NotNil(t, err)
+	require.Zero(t, resourceData.Id())
+	repos := resourceData.Get("repositories").([]interface{})
+	require.NotNil(t, repos)
+	require.Zero(t, len(repos))
+}
+
+func TestGitRepositoriesDataSource_Read_TestHandleErrorWithSpecificRepository(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	repoClient := azdosdkmocks.NewMockGitClient(ctrl)
+
+	clients := &config.AggregatedClient{
+		GitReposClient: repoClient,
+		GraphClient:    graphClient,
+		Ctx:            context.Background(),
+	}
+
+	repo := gitRepoList[2]
+	expectedGetRepositoryArgs := git.GetRepositoryArgs{
+		RepositoryId: repo.Name,
+		Project:      converter.String(repo.Project.Id.String()),
+	}
+	repoClient.
+		EXPECT().
+		GetRepository(clients.Ctx, expectedGetRepositoryArgs).
+		Return(nil, errors.New("GetRepository() Failed"))
+
+	resourceData := schema.TestResourceDataRaw(t, dataGitRepositories().Schema, nil)
+	resourceData.Set("name", *repo.Name)
+	resourceData.Set("project_id", repo.Project.Id.String())
+
+	err := dataSourceGitRepositoriesRead(resourceData, clients)
+	require.NotNil(t, err)
+	require.Zero(t, resourceData.Id())
+	repos := resourceData.Get("repositories").([]interface{})
+	require.NotNil(t, repos)
+	require.Zero(t, len(repos))
+}
+
+func TestGitRepositoriesDataSource_Read_NoRepositories(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	repoClient := azdosdkmocks.NewMockGitClient(ctrl)
+
+	clients := &config.AggregatedClient{
+		GitReposClient: repoClient,
+		GraphClient:    graphClient,
+		Ctx:            context.Background(),
+	}
+
+	expectedGetRepositoriesArgs := git.GetRepositoriesArgs{
+		IncludeHidden: converter.Bool(false),
+	}
+
+	repoClient.
+		EXPECT().
+		GetRepositories(clients.Ctx, expectedGetRepositoriesArgs).
+		Return(&[]git.GitRepository{}, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataGitRepositories().Schema, nil)
+
+	err := dataSourceGitRepositoriesRead(resourceData, clients)
+	require.Nil(t, err)
+	repos := resourceData.Get("repositories").([]interface{})
+	require.NotNil(t, repos)
+	require.Zero(t, len(repos))
+}
+
+func TestGitRepositoriesDataSource_Read_AllRepositories(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	repoClient := azdosdkmocks.NewMockGitClient(ctrl)
+
+	clients := &config.AggregatedClient{
+		GitReposClient: repoClient,
+		GraphClient:    graphClient,
+		Ctx:            context.Background(),
+	}
+
+	expectedGetRepositoriesArgs := git.GetRepositoriesArgs{
+		IncludeHidden: converter.Bool(false),
+	}
+
+	repoClient.
+		EXPECT().
+		GetRepositories(clients.Ctx, expectedGetRepositoriesArgs).
+		Return(&gitRepoList, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataGitRepositories().Schema, nil)
+
+	err := dataSourceGitRepositoriesRead(resourceData, clients)
+	require.Nil(t, err)
+	repos := resourceData.Get("repositories").([]interface{})
+	require.NotNil(t, repos)
+	require.Equal(t, len(repos), 3)
+}
+
+func TestGitRepositoriesDataSource_Read_AllRepositoriesByProject(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	repoClient := azdosdkmocks.NewMockGitClient(ctrl)
+
+	clients := &config.AggregatedClient{
+		GitReposClient: repoClient,
+		GraphClient:    graphClient,
+		Ctx:            context.Background(),
+	}
+
+	expectedGetRepositoriesArgs := git.GetRepositoriesArgs{
+		Project:       converter.String(azProjectRef.Id.String()),
+		IncludeHidden: converter.Bool(false),
+	}
+
+	repoClient.
+		EXPECT().
+		GetRepositories(clients.Ctx, expectedGetRepositoriesArgs).
+		Return(&[]git.GitRepository{
+			gitRepoList[0],
+			gitRepoList[1],
+		}, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataGitRepositories().Schema, nil)
+	resourceData.Set("project_id", azProjectRef.Id.String())
+
+	err := dataSourceGitRepositoriesRead(resourceData, clients)
+	require.Nil(t, err)
+	repos := resourceData.Get("repositories").([]interface{})
+	require.NotNil(t, repos)
+	require.Equal(t, len(repos), 2)
+	repoMap := make(map[string]interface{})
+	for _, item := range repos {
+		repoData := item.(map[string]interface{})
+		repoMap[repoData["name"].(string)] = repoData
+	}
+
+	for i := 0; i < 2; i++ {
+		require.Contains(t, repoMap, *gitRepoList[i].Name)
+		repo := repoMap[*gitRepoList[i].Name].(map[string]interface{})
+		require.Equal(t, gitRepoList[i].Project.Id.String(), repo["project_id"])
+		require.Equal(t, gitRepoList[i].Id.String(), repo["id"])
+	}
+}
+
+func TestGitRepositoriesDataSource_Read_SingleRepository(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	repoClient := azdosdkmocks.NewMockGitClient(ctrl)
+
+	clients := &config.AggregatedClient{
+		GitReposClient: repoClient,
+		GraphClient:    graphClient,
+		Ctx:            context.Background(),
+	}
+
+	repo := gitRepoList[1]
+	expectedGetRepositoryArgs := git.GetRepositoryArgs{
+		RepositoryId: repo.Name,
+		Project:      converter.String(repo.Project.Id.String()),
+	}
+	repoClient.
+		EXPECT().
+		GetRepository(clients.Ctx, expectedGetRepositoryArgs).
+		Return(&repo, nil)
+
+	resourceData := schema.TestResourceDataRaw(t, dataGitRepositories().Schema, nil)
+	resourceData.Set("name", *repo.Name)
+	resourceData.Set("project_id", repo.Project.Id.String())
+
+	err := dataSourceGitRepositoriesRead(resourceData, clients)
+	require.Nil(t, err)
+	repos := resourceData.Get("repositories").([]interface{})
+	require.NotNil(t, repos)
+	require.Equal(t, len(repos), 1)
+}
+
+/**
+ * Begin acceptance tests
+ */
+
+// Verifies that the following sequence of events occurrs without error:
+//	(1) TF can create a project
+//	(2) A data source is added to the configuration, and that data source can find the created project
+func TestAccAzureTfsGitRepositories_DataSource(t *testing.T) {
+	projectName := testhelper.TestAccResourcePrefix + acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+	gitRepoName := testhelper.TestAccResourcePrefix + acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+	tfConfigStep1 := testhelper.TestAccAzureGitRepoResource(projectName, gitRepoName, "Clean")
+	tfConfigStep2 := fmt.Sprintf("%s\n%s", tfConfigStep1, testhelper.TestAccProjectGitRepositories(projectName, gitRepoName))
+
+	tfNode := "data.azuredevops_git_repositories.repositories"
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testhelper.TestAccPreCheck(t, nil) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: tfConfigStep1,
+			}, {
+				Config: tfConfigStep2,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tfNode, "name", gitRepoName),
+					resource.TestCheckResourceAttr(tfNode, "repositories.0.name", gitRepoName),
+					resource.TestCheckResourceAttr(tfNode, "repositories.0.default_branch", "refs/heads/master"),
+				),
+			},
+		},
+	})
+}
@@ -0,0 +1,134 @@
+package azuredevops
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/graph"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+)
+
+func dataGroup() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceGroupRead,
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:         schema.TypeString,
+				ForceNew:     true,
+				Required:     true,
+				ValidateFunc: validation.NoZeroValues,
+			},
+			"project_id": {
+				Type:         schema.TypeString,
+				ForceNew:     true,
+				Required:     true,
+				ValidateFunc: validation.NoZeroValues,
+			},
+			"descriptor": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+// Performs a lookup of a project group. This involves the following actions:
+//	(1) Identify AzDO graph descriptor for the project in which the group exists
+//	(2) Query for all AzDO groups that exist within the project. This leverages the AzDO graph descriptor for the project.
+//		This involves querying a paginated API, so multiple API calls may be needed for this step.
+//	(3) Select group that has the name identified by the schema
+func dataSourceGroupRead(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	groupName, projectID := d.Get("name").(string), d.Get("project_id").(string)
+
+	projectDescriptor, err := getProjectDescriptor(clients, projectID)
+	if err != nil {
+		if utils.ResponseWasNotFound(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error finding descriptor for project with ID %s. Error: %v", projectID, err)
+	}
+
+	projectGroups, err := getGroupsForDescriptor(clients, projectDescriptor)
+	if err != nil {
+		return fmt.Errorf("Error finding groups for project with ID %s. Error: %v", projectID, err)
+	}
+
+	targetGroup := selectGroup(projectGroups, groupName)
+	if targetGroup == nil {
+		return fmt.Errorf("Could not find group with name %s in project with ID %s", groupName, projectID)
+	}
+
+	d.SetId(*targetGroup.Descriptor)
+	d.Set("descriptor", *targetGroup.Descriptor)
+	return nil
+}
+
+func getProjectDescriptor(clients *config.AggregatedClient, projectID string) (string, error) {
+	projectUUID, err := uuid.Parse(projectID)
+	if err != nil {
+		return "", err
+	}
+
+	descriptor, err := clients.GraphClient.GetDescriptor(clients.Ctx, graph.GetDescriptorArgs{StorageKey: &projectUUID})
+	if err != nil {
+		return "", err
+	}
+
+	return *descriptor.Value, nil
+}
+
+func getGroupsForDescriptor(clients *config.AggregatedClient, projectDescriptor string) (*[]graph.GraphGroup, error) {
+	var groups []graph.GraphGroup
+	var currentToken string
+
+	for hasMore := true; hasMore; {
+		newGroups, latestToken, err := getGroupsWithContinuationToken(clients, projectDescriptor, currentToken)
+		currentToken = latestToken
+		if err != nil {
+			return nil, err
+		}
+
+		groups = append(groups, *newGroups...)
+		hasMore = currentToken != ""
+	}
+
+	return &groups, nil
+}
+
+func getGroupsWithContinuationToken(clients *config.AggregatedClient, projectDescriptor string, continuationToken string) (*[]graph.GraphGroup, string, error) {
+	args := graph.ListGroupsArgs{ScopeDescriptor: &projectDescriptor}
+	if continuationToken != "" {
+		args.ContinuationToken = &continuationToken
+	}
+
+	response, err := clients.GraphClient.ListGroups(clients.Ctx, args)
+	if err != nil {
+		return nil, "", err
+	}
+
+	if response.ContinuationToken != nil && len(*response.ContinuationToken) > 1 {
+		return nil, "", fmt.Errorf("Expected at most 1 continuation token, but found %d", len(*response.ContinuationToken))
+	}
+
+	var newToken string
+	if response.ContinuationToken != nil && len(*response.ContinuationToken) > 0 {
+		newToken = (*response.ContinuationToken)[0]
+	}
+
+	return response.GraphGroups, newToken, nil
+}
+
+func selectGroup(groups *[]graph.GraphGroup, groupName string) *graph.GraphGroup {
+	for _, group := range *groups {
+		if strings.EqualFold(*group.DisplayName, groupName) {
+			return &group
+		}
+	}
+	return nil
+}
@@ -0,0 +1,180 @@
+// +build all core data_group
+
+package azuredevops
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/google/uuid"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/graph"
+	"github.com/microsoft/terraform-provider-azuredevops/azdosdkmocks"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/testhelper"
+	"github.com/stretchr/testify/require"
+)
+
+/**
+ * Begin unit tests
+ */
+
+// A helper type that is used in some of these tests to make initializing
+// graph entities easier
+type groupMeta struct {
+	name       string
+	descriptor string
+}
+
+// verifies that the translation for project_id to project_descriptor has proper error handling
+func TestGroupDataSource_DoesNotSwallowProjectDescriptorLookupError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	projectID := uuid.New()
+	resourceData := createResourceData(t, projectID.String(), "group-name")
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	clients := &config.AggregatedClient{GraphClient: graphClient, Ctx: context.Background()}
+
+	expectedArgs := graph.GetDescriptorArgs{StorageKey: &projectID}
+	graphClient.
+		EXPECT().
+		GetDescriptor(clients.Ctx, expectedArgs).
+		Return(nil, errors.New("GetDescriptor() Failed"))
+
+	err := dataSourceGroupRead(resourceData, clients)
+	require.Contains(t, err.Error(), "GetDescriptor() Failed")
+}
+
+// verifies that the group lookup functionality has proper error handling
+func TestGroupDataSource_DoesNotSwallowListGroupError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	projectID := uuid.New()
+	resourceData := createResourceData(t, projectID.String(), "group-name")
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	clients := &config.AggregatedClient{GraphClient: graphClient, Ctx: context.Background()}
+
+	expectedProjectDescriptorLookupArgs := graph.GetDescriptorArgs{StorageKey: &projectID}
+	projectDescriptor := converter.String("descriptor")
+	projectDescriptorResponse := graph.GraphDescriptorResult{Value: projectDescriptor}
+	graphClient.
+		EXPECT().
+		GetDescriptor(clients.Ctx, expectedProjectDescriptorLookupArgs).
+		Return(&projectDescriptorResponse, nil)
+
+	expectedListGroupArgs := graph.ListGroupsArgs{ScopeDescriptor: projectDescriptor}
+	graphClient.
+		EXPECT().
+		ListGroups(clients.Ctx, expectedListGroupArgs).
+		Return(nil, errors.New("ListGroups() Failed"))
+
+	err := dataSourceGroupRead(resourceData, clients)
+	require.Contains(t, err.Error(), "ListGroups() Failed")
+}
+
+// verifies that the group lookup functionality will make multiple API calls using the continuation token
+// returned from the `ListGroups` api, until the API no longer returns a token
+func TestGroupDataSource_HandlesContinuationToken_And_SelectsCorrectGroup(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	projectID := uuid.New()
+	resourceData := createResourceData(t, projectID.String(), "name1")
+
+	graphClient := azdosdkmocks.NewMockGraphClient(ctrl)
+	clients := &config.AggregatedClient{GraphClient: graphClient, Ctx: context.Background()}
+
+	expectedProjectDescriptorLookupArgs := graph.GetDescriptorArgs{StorageKey: &projectID}
+	projectDescriptor := converter.String("descriptor")
+	projectDescriptorResponse := graph.GraphDescriptorResult{Value: projectDescriptor}
+	graphClient.
+		EXPECT().
+		GetDescriptor(clients.Ctx, expectedProjectDescriptorLookupArgs).
+		Return(&projectDescriptorResponse, nil)
+
+	firstListGroupCallArgs := graph.ListGroupsArgs{ScopeDescriptor: projectDescriptor}
+	continuationToken := "continuation-token"
+	firstListGroupCallResponse := createPaginatedResponse(continuationToken, groupMeta{name: "name1", descriptor: "descriptor1"})
+	firstCall := graphClient.
+		EXPECT().
+		ListGroups(clients.Ctx, firstListGroupCallArgs).
+		Return(firstListGroupCallResponse, nil)
+
+	secondListGroupCallArgs := graph.ListGroupsArgs{ScopeDescriptor: projectDescriptor, ContinuationToken: &continuationToken}
+	secondListGroupCallResponse := createPaginatedResponse("", groupMeta{name: "name2", descriptor: "descriptor2"})
+	secondCall := graphClient.
+		EXPECT().
+		ListGroups(clients.Ctx, secondListGroupCallArgs).
+		Return(secondListGroupCallResponse, nil)
+
+	gomock.InOrder(firstCall, secondCall)
+
+	err := dataSourceGroupRead(resourceData, clients)
+	require.Nil(t, err)
+	require.Equal(t, "descriptor1", resourceData.Id())
+}
+
+func createPaginatedResponse(continuationToken string, groups ...groupMeta) *graph.PagedGraphGroups {
+	continuationTokenList := []string{continuationToken}
+	return &graph.PagedGraphGroups{
+		ContinuationToken: &continuationTokenList,
+		GraphGroups:       createGroupsWithDescriptors(groups...),
+	}
+}
+
+func createGroupsWithDescriptors(groups ...groupMeta) *[]graph.GraphGroup {
+	var graphs []graph.GraphGroup
+	for _, group := range groups {
+		graphs = append(graphs, graph.GraphGroup{Descriptor: &group.descriptor, DisplayName: &group.name})
+	}
+
+	return &graphs
+}
+
+func createResourceData(t *testing.T, projectID string, groupName string) *schema.ResourceData {
+	resourceData := schema.TestResourceDataRaw(t, dataGroup().Schema, nil)
+	resourceData.Set("project_id", projectID)
+	resourceData.Set("name", groupName)
+	return resourceData
+}
+
+/**
+ * Begin acceptance tests
+ */
+
+// Validates that a configuration containing a project group lookup is able to read the resource correctly.
+// Because this is a data source, there are no resources to inspect in AzDO
+func TestAccGroupDataSource_Read_HappyPath(t *testing.T) {
+	projectName := testhelper.TestAccResourcePrefix + acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+	group := "Build Administrators"
+	tfBuildDefNode := "data.azuredevops_group.group"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testhelper.TestAccPreCheck(t, nil) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testhelper.TestAccGroupDataSource(projectName, group),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(tfBuildDefNode, "name"),
+					resource.TestCheckResourceAttrSet(tfBuildDefNode, "project_id"),
+					resource.TestCheckResourceAttrSet(tfBuildDefNode, "id"),
+					resource.TestCheckResourceAttrSet(tfBuildDefNode, "descriptor"),
+				),
+			},
+		},
+	})
+}
+
+func init() {
+	InitProvider()
+}
@@ -0,0 +1,13 @@
+package azuredevops
+
+import (
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+)
+
+func dataProject() *schema.Resource {
+	baseSchema := resourceProject()
+	return &schema.Resource{
+		Read:   baseSchema.Read,
+		Schema: baseSchema.Schema,
+	}
+}
@@ -0,0 +1,52 @@
+// +build all core resource_project
+
+package azuredevops
+
+// The tests in this file use the mock clients in mock_client.go to mock out
+// the Azure DevOps client operations.
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/testhelper"
+)
+
+/**
+ * Begin acceptance tests
+ */
+
+// Verifies that the following sequence of events occurrs without error:
+//	(1) TF can create a project
+//	(2) A data source is added to the configuration, and that data source can find the created project
+func TestAccAzureDevOpsProject_DataSource(t *testing.T) {
+	projectName := testhelper.TestAccResourcePrefix + acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+	tfConfigStep1 := testhelper.TestAccProjectResource(projectName)
+	tfConfigStep2 := fmt.Sprintf("%s\n%s", tfConfigStep1, testhelper.TestAccProjectDataSource(projectName))
+
+	tfNode := "data.azuredevops_project.project"
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testhelper.TestAccPreCheck(t, nil) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: tfConfigStep1,
+			}, {
+				Config: tfConfigStep2,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(tfNode, "process_template_id"),
+					resource.TestCheckResourceAttr(tfNode, "project_name", projectName),
+					resource.TestCheckResourceAttr(tfNode, "version_control", "Git"),
+					resource.TestCheckResourceAttr(tfNode, "visibility", "private"),
+					resource.TestCheckResourceAttr(tfNode, "work_item_template", "Agile"),
+				),
+			},
+		},
+	})
+}
+
+func init() {
+	InitProvider()
+}
@@ -0,0 +1,199 @@
+package azuredevops
+
+import (
+	"crypto/sha1"
+	"encoding/base64"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/core"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/suppress"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/validate"
+)
+
+func dataProjects() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceProjectsRead,
+
+		Schema: map[string]*schema.Schema{
+			"project_name": {
+				Type:             schema.TypeString,
+				ForceNew:         true,
+				Optional:         true,
+				ValidateFunc:     validate.NoEmptyStrings,
+				DiffSuppressFunc: suppress.CaseDifference,
+			},
+			"state": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Optional: true,
+				Default:  core.ProjectStateValues.All,
+				ValidateFunc: validation.StringInSlice([]string{
+					string(core.ProjectStateValues.Deleting),
+					string(core.ProjectStateValues.New),
+					string(core.ProjectStateValues.WellFormed),
+					string(core.ProjectStateValues.CreatePending),
+					string(core.ProjectStateValues.All),
+					string(core.ProjectStateValues.Unchanged),
+					string(core.ProjectStateValues.Deleted),
+				}, true),
+			},
+
+			"projects": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Set:      getProjectHash,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"project_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"project_url": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"state": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func getProjectHash(v interface{}) int {
+	return hashcode.String(v.(map[string]interface{})["project_id"].(string))
+}
+
+func dataSourceProjectsRead(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	state := d.Get("state").(string)
+	name := d.Get("project_name").(string)
+
+	projects, err := getProjectsForStateAndName(clients, state, name)
+	if err != nil {
+		return fmt.Errorf("Error finding projects with state %s. Error: %v", state, err)
+	}
+	log.Printf("[TRACE] plugin.terraform-provider-azuredevops: Read [%d] projects from current organization", len(projects))
+
+	results, err := flattenProjectReferences(&projects)
+	if err != nil {
+		return fmt.Errorf("Error flattening projects. Error: %v", err)
+	}
+
+	h := sha1.New()
+	projectNames, err := getAttributeValues(results, "name")
+	if err != nil {
+		return fmt.Errorf("Failed to get list of project names: %v", err)
+	}
+	if len(projectNames) <= 0 && name != "" {
+		projectNames = append(projectNames, name)
+	}
+	if _, err := h.Write([]byte(state + strings.Join(projectNames, "-"))); err != nil {
+		return fmt.Errorf("Unable to compute hash for project names: %v", err)
+	}
+	d.SetId("projects#" + base64.URLEncoding.EncodeToString(h.Sum(nil)))
+	err = d.Set("projects", results)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func getAttributeValues(items []interface{}, attributeName string) ([]string, error) {
+	var result []string
+	for _, element := range items {
+		result = append(result, element.(map[string]interface{})[attributeName].(string))
+	}
+	return result, nil
+}
+
+func flattenProjectReferences(input *[]core.TeamProjectReference) ([]interface{}, error) {
+	if input == nil {
+		return []interface{}{}, nil
+	}
+
+	results := make([]interface{}, 0)
+
+	for _, element := range *input {
+		output := make(map[string]interface{})
+		if element.Name != nil {
+			output["name"] = *element.Name
+		}
+
+		if element.Id != nil {
+			output["project_id"] = element.Id.String()
+		}
+
+		if element.Url != nil {
+			output["project_url"] = *element.Url
+		}
+
+		if element.State != nil {
+			output["state"] = string(*element.State)
+		}
+
+		results = append(results, output)
+	}
+
+	return results, nil
+}
+
+func getProjectsForStateAndName(clients *config.AggregatedClient, projectState string, projectName string) ([]core.TeamProjectReference, error) {
+	var projects []core.TeamProjectReference
+	var currentToken string
+
+	for hasMore := true; hasMore; {
+		newProjects, latestToken, err := getProjectsWithContinuationToken(clients, projectState, currentToken)
+		currentToken = latestToken
+		if err != nil {
+			return nil, err
+		}
+		log.Printf("[TRACE] plugin.terraform-provider-azuredevops: Received [%d] projects; Continuation token [%s]", len(newProjects), currentToken)
+
+		if projectName != "" {
+			log.Printf("[TRACE] plugin.terraform-provider-azuredevops: Searching for project name [%s]", projectName)
+			for _, project := range newProjects {
+				if strings.EqualFold(*project.Name, projectName) {
+					log.Printf("[TRACE] plugin.terraform-provider-azuredevops: Found project [%s] in current project list", projectName)
+					return []core.TeamProjectReference{project}, nil
+				}
+			}
+		} else {
+			projects = append(projects, newProjects...)
+			log.Printf("[TRACE] plugin.terraform-provider-azuredevops: Appended new projects to current project list (Length: %d)", len(projects))
+		}
+		hasMore = currentToken != ""
+	}
+
+	return projects, nil
+}
+
+func getProjectsWithContinuationToken(clients *config.AggregatedClient, projectState string, continuationToken string) ([]core.TeamProjectReference, string, error) {
+	state := core.ProjectState(projectState)
+	args := core.GetProjectsArgs{
+		StateFilter: &state,
+	}
+	if continuationToken != "" {
+		args.ContinuationToken = &continuationToken
+	}
+
+	response, err := clients.CoreClient.GetProjects(clients.Ctx, args)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return response.Value, response.ContinuationToken, nil
+}
@@ -0,0 +1,362 @@
+// +build all core data_projects
+
+package azuredevops
+
+// The tests in this file use the mock clients in mock_client.go to mock out
+// the Azure DevOps client operations.
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/google/uuid"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/core"
+	"github.com/microsoft/terraform-provider-azuredevops/azdosdkmocks"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/testhelper"
+	"github.com/stretchr/testify/require"
+)
+
+func init() {
+	/* add code for test setup here */
+}
+
+var prjListEmpty = []core.TeamProjectReference{}
+
+var prjListStateMixed = []core.TeamProjectReference{
+	{
+		Name:  converter.String("vsteam-0177"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0178"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.Deleted,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0179"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.New,
+		Url:   nil,
+	},
+}
+
+var prjListStateWellFormed = []core.TeamProjectReference{
+	{
+		Name:  converter.String("vsteam-0177"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0178"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0179"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+}
+
+var prjListStateWellFormed2 = []core.TeamProjectReference{
+	{
+		Name:  converter.String("vsteam-0277"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0278"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0279"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+}
+
+var duplicatePrjID *uuid.UUID = testhelper.CreateUUID()
+var prjListDoubleID = []core.TeamProjectReference{
+	{
+		Name:  converter.String("vsteam-0177"),
+		Id:    duplicatePrjID,
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0178"),
+		Id:    testhelper.CreateUUID(),
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+	{
+		Name:  converter.String("vsteam-0179"),
+		Id:    duplicatePrjID,
+		State: &core.ProjectStateValues.WellFormed,
+		Url:   nil,
+	},
+}
+
+/**
+ * Begin unit tests
+ */
+
+func TestDataSourceProjects_Read_TestFindProjectByName(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)
+	clients := &config.AggregatedClient{
+		CoreClient: coreClient,
+		Ctx:        context.Background(),
+	}
+
+	expectedGetProjectsArgs := core.GetProjectsArgs{
+		StateFilter: &core.ProjectStateValues.WellFormed,
+	}
+
+	coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, expectedGetProjectsArgs).
+		Return(&core.GetProjectsResponseValue{
+			Value:             prjListStateWellFormed,
+			ContinuationToken: "",
+		}, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataProjects().Schema, nil)
+	resourceData.Set("project_name", "vsteam-0178")
+	resourceData.Set("state", "wellFormed")
+	err := dataSourceProjectsRead(resourceData, clients)
+	require.Nil(t, err)
+	require.Equal(t, "wellFormed", resourceData.Get("state").(string))
+	require.Equal(t, "vsteam-0178", resourceData.Get("project_name").(string))
+	projectSet := resourceData.Get("projects").(*schema.Set)
+	require.NotNil(t, projectSet)
+	require.Equal(t, 1, projectSet.Len())
+	projectReference := projectSet.List()[0].(map[string]interface{})
+	require.NotNil(t, projectReference)
+	require.Equal(t, "vsteam-0178", projectReference["name"])
+	require.Equal(t, prjListStateWellFormed[1].Id.String(), projectReference["project_id"])
+	require.Equal(t, "wellFormed", projectReference["state"])
+}
+
+func TestDataSourceProjects_Read_TestEmptyProjectList(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)
+	clients := &config.AggregatedClient{
+		CoreClient: coreClient,
+		Ctx:        context.Background(),
+	}
+
+	expectedGetProjectsArgs := core.GetProjectsArgs{
+		StateFilter: &core.ProjectStateValues.All,
+	}
+
+	coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, expectedGetProjectsArgs).
+		Return(&core.GetProjectsResponseValue{
+			Value:             prjListEmpty,
+			ContinuationToken: "",
+		}, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataProjects().Schema, nil)
+	err := dataSourceProjectsRead(resourceData, clients)
+	require.Nil(t, err)
+	require.Equal(t, "all", resourceData.Get("state").(string))
+	require.Equal(t, "", resourceData.Get("project_name").(string))
+	projectSet := resourceData.Get("projects").(*schema.Set)
+	require.NotNil(t, projectSet)
+	require.Equal(t, 0, projectSet.Len())
+}
+
+func TestDataSourceProjects_Read_TestFindAllProjects(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)
+	clients := &config.AggregatedClient{
+		CoreClient: coreClient,
+		Ctx:        context.Background(),
+	}
+
+	expectedGetProjectsArgs := core.GetProjectsArgs{
+		StateFilter: &core.ProjectStateValues.All,
+	}
+
+	coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, expectedGetProjectsArgs).
+		Return(&core.GetProjectsResponseValue{
+			Value:             prjListStateWellFormed,
+			ContinuationToken: "",
+		}, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataProjects().Schema, nil)
+	err := dataSourceProjectsRead(resourceData, clients)
+	require.Nil(t, err)
+	require.Equal(t, "all", resourceData.Get("state").(string))
+	require.Equal(t, "", resourceData.Get("project_name").(string))
+	projectSet := resourceData.Get("projects").(*schema.Set)
+	require.NotNil(t, projectSet)
+	require.Equal(t, 3, projectSet.Len())
+}
+
+func TestDataSourceProjects_Read_TestDuplicateProjectId(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)
+	clients := &config.AggregatedClient{
+		CoreClient: coreClient,
+		Ctx:        context.Background(),
+	}
+
+	expectedGetProjectsArgs := core.GetProjectsArgs{
+		StateFilter: &core.ProjectStateValues.All,
+	}
+
+	coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, expectedGetProjectsArgs).
+		Return(&core.GetProjectsResponseValue{
+			Value:             prjListDoubleID,
+			ContinuationToken: "",
+		}, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataProjects().Schema, nil)
+	err := dataSourceProjectsRead(resourceData, clients)
+	require.Nil(t, err)
+	require.Equal(t, "all", resourceData.Get("state").(string))
+	require.Equal(t, "", resourceData.Get("project_name").(string))
+	projectSet := resourceData.Get("projects").(*schema.Set)
+	require.NotNil(t, projectSet)
+	require.Equal(t, 2, projectSet.Len())
+}
+
+func TestDataSourceProjects_Read_TestFindProjectsWithState(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)
+	clients := &config.AggregatedClient{
+		CoreClient: coreClient,
+		Ctx:        context.Background(),
+	}
+
+	expectedGetProjectsArgs := core.GetProjectsArgs{
+		StateFilter: &core.ProjectStateValues.WellFormed,
+	}
+
+	coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, expectedGetProjectsArgs).
+		Return(&core.GetProjectsResponseValue{
+			Value:             prjListStateWellFormed,
+			ContinuationToken: "",
+		}, nil).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataProjects().Schema, nil)
+	resourceData.Set("state", "wellFormed")
+	err := dataSourceProjectsRead(resourceData, clients)
+	require.Nil(t, err)
+	require.Equal(t, "wellFormed", resourceData.Get("state").(string))
+	require.Equal(t, "", resourceData.Get("project_name").(string))
+	projectSet := resourceData.Get("projects").(*schema.Set)
+	require.NotNil(t, projectSet)
+	require.Equal(t, 3, projectSet.Len())
+}
+
+func TestDataSourceProjects_Read_TestHandleError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)
+	clients := &config.AggregatedClient{
+		CoreClient: coreClient,
+		Ctx:        context.Background(),
+	}
+
+	expectedGetProjectsArgs := core.GetProjectsArgs{
+		StateFilter: &core.ProjectStateValues.All,
+	}
+
+	coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, expectedGetProjectsArgs).
+		Return(nil, errors.New("GetProjects() Failed")).
+		Times(1)
+
+	resourceData := schema.TestResourceDataRaw(t, dataProjects().Schema, nil)
+	err := dataSourceProjectsRead(resourceData, clients)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "GetProjects() Failed")
+}
+
+func TestDataSourceProjects_Read_TestContinuationToken(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	coreClient := azdosdkmocks.NewMockCoreClient(ctrl)
+	clients := &config.AggregatedClient{
+		CoreClient: coreClient,
+		Ctx:        context.Background(),
+	}
+
+	var calls []*gomock.Call
+	calls = append(calls, coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, core.GetProjectsArgs{
+			StateFilter: &core.ProjectStateValues.All,
+		}).
+		Return(&core.GetProjectsResponseValue{
+			Value:             prjListStateWellFormed,
+			ContinuationToken: "2",
+		}, nil).
+		Times(1))
+
+	calls = append(calls, coreClient.
+		EXPECT().
+		GetProjects(clients.Ctx, core.GetProjectsArgs{
+			StateFilter:       &core.ProjectStateValues.All,
+			ContinuationToken: converter.String("2"),
+		}).
+		Return(&core.GetProjectsResponseValue{
+			Value:             prjListStateWellFormed2,
+			ContinuationToken: "",
+		}, nil).
+		Times(1))
+
+	gomock.InOrder(calls...)
+
+	resourceData := schema.TestResourceDataRaw(t, dataProjects().Schema, nil)
+	err := dataSourceProjectsRead(resourceData, clients)
+	require.Nil(t, err)
+	require.Equal(t, "all", resourceData.Get("state").(string))
+	require.Equal(t, "", resourceData.Get("project_name").(string))
+	projectSet := resourceData.Get("projects").(*schema.Set)
+	require.NotNil(t, projectSet)
+	require.Equal(t, 6, projectSet.Len())
+}
@@ -0,0 +1,216 @@
+package azuredevops
+
+import (
+	"crypto/sha1"
+	"encoding/base64"
+	"fmt"
+	"strings"
+
+	"github.com/ahmetb/go-linq"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform/helper/hashcode"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/graph"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/validate"
+)
+
+func dataUsers() *schema.Resource {
+	return &schema.Resource{
+		Read: dataUsersRead,
+
+		//https://godoc.org/github.com/hashicorp/terraform/helper/schema#Schema
+		Schema: map[string]*schema.Schema{
+			"principal_name": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				ValidateFunc:  validate.NoEmptyStrings,
+				ConflictsWith: []string{"origin", "origin_id"},
+			},
+			"subject_types": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Set:      schema.HashString,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"origin": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				ValidateFunc:  validate.NoEmptyStrings,
+				ConflictsWith: []string{"principal_name"},
+			},
+			"origin_id": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				ValidateFunc:  validate.NoEmptyStrings,
+				ConflictsWith: []string{"principal_name"},
+			},
+			"users": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Set:      getUserHash,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"descriptor": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"principal_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"origin": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"origin_id": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"display_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"mail_address": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func dataUsersRead(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	users := make([]interface{}, 0)
+	subjectTypes := []string{}
+
+	linq.From(d.Get("subject_types").(*schema.Set).List()).
+		SelectT(func(x interface{}) string {
+			return x.(string)
+		}).
+		ToSlice(&subjectTypes)
+	principalName := d.Get("principal_name").(string)
+	origin := d.Get("origin").(string)
+	originID := d.Get("origin_id").(string)
+
+	var currentToken string
+	for hasMore := true; hasMore; {
+		newUsers, latestToken, err := getUsersWithContinuationToken(clients, &subjectTypes, currentToken)
+		currentToken = latestToken
+		hasMore = currentToken != ""
+		if err != nil {
+			return err
+		}
+
+		linq.From(newUsers).
+			WhereT(func(x interface{}) bool {
+				usr := x.(graph.GraphUser)
+				b := true
+				if principalName != "" {
+					b = usr.PrincipalName != nil && strings.EqualFold(*usr.PrincipalName, principalName)
+				}
+				if b && origin != "" {
+					b = usr.Origin != nil && strings.EqualFold(*usr.Origin, origin)
+				}
+				if b && originID != "" {
+					b = usr.OriginId != nil && strings.EqualFold(*usr.OriginId, originID)
+				}
+				return b
+			}).
+			ToSlice(&newUsers)
+		fusers, err := flattenUsers(&newUsers)
+		if err != nil {
+			return err
+		}
+		users = append(users, fusers...)
+	}
+
+	var descriptors []string
+	linq.From(users).
+		SelectT(
+			func(x interface{}) string {
+				item := x.(map[string]interface{})
+				return item["descriptor"].(string)
+			},
+		).
+		ToSlice(&descriptors)
+
+	h := sha1.New()
+	if _, err := h.Write([]byte(strings.Join(descriptors, "-"))); err != nil {
+		return fmt.Errorf("Unable to compute hash for user descriptors: %v", err)
+	}
+	d.SetId("users#" + base64.URLEncoding.EncodeToString(h.Sum(nil)))
+	if err := d.Set("users", users); err != nil {
+		return fmt.Errorf("Error setting `users`: %+v", err)
+	}
+
+	return nil
+}
+
+func getUserHash(v interface{}) int {
+	return hashcode.String(v.(map[string]interface{})["descriptor"].(string))
+}
+
+func flattenUsers(input *[]graph.GraphUser) ([]interface{}, error) {
+	if input == nil {
+		return []interface{}{}, nil
+	}
+	results := make([]interface{}, len(*input))
+	for i, element := range *input {
+		output, err := flattenUser(&element)
+		if err != nil {
+			return nil, err
+		}
+		results[i] = output
+	}
+	return results, nil
+}
+
+func flattenUser(user *graph.GraphUser) (map[string]interface{}, error) {
+	s := make(map[string]interface{})
+
+	if v := user.Descriptor; v != nil {
+		s["descriptor"] = *v
+	}
+	if v := user.PrincipalName; v != nil {
+		s["principal_name"] = *v
+	}
+	if v := user.Origin; v != nil {
+		s["origin"] = *v
+	}
+	if v := user.OriginId; v != nil {
+		s["origin_id"] = *v
+	}
+	if v := user.DisplayName; v != nil {
+		s["display_name"] = *v
+	}
+	if v := user.MailAddress; v != nil {
+		s["mail_address"] = *v
+	}
+
+	return s, nil
+}
+
+func getUsersWithContinuationToken(clients *config.AggregatedClient, subjectTypes *[]string, continuationToken string) ([]graph.GraphUser, string, error) {
+	args := graph.ListUsersArgs{
+		SubjectTypes: subjectTypes,
+	}
+	if continuationToken != "" {
+		args.ContinuationToken = &continuationToken
+	}
+	response, err := clients.GraphClient.ListUsers(clients.Ctx, args)
+	if err != nil {
+		return nil, "", fmt.Errorf("Error listing users: %q", err)
+	}
+
+	continuationToken = ""
+	if response.ContinuationToken != nil && (*response.ContinuationToken)[0] != "" {
+		continuationToken = (*response.ContinuationToken)[0]
+	}
+
+	return *response.GraphUsers, continuationToken, nil
+}
@@ -1,27 +1,47 @@
 package azuredevops
 
 import (
-	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
 )
 
 // Provider - The top level Azure DevOps Provider definition.
 func Provider() *schema.Provider {
 	p := &schema.Provider{
 		ResourcesMap: map[string]*schema.Resource{
-			"azuredevops_build_definition": resourceBuildDefinition(),
-			"azuredevops_project":          resourceProject(),
-			"azuredevops_serviceendpoint":  resourceServiceEndpoint(),
+			"azuredevops_resource_authorization":     resourceResourceAuthorization(),
+			"azuredevops_build_definition":           resourceBuildDefinition(),
+			"azuredevops_project":                    resourceProject(),
+			"azuredevops_variable_group":             resourceVariableGroup(),
+			"azuredevops_serviceendpoint_azurerm":    resourceServiceEndpointAzureRM(),
+			"azuredevops_serviceendpoint_bitbucket":  resourceServiceEndpointBitBucket(),
+			"azuredevops_serviceendpoint_dockerhub":  resourceServiceEndpointDockerHub(),
+			"azuredevops_serviceendpoint_github":     resourceServiceEndpointGitHub(),
+			"azuredevops_serviceendpoint_kubernetes": resourceServiceEndpointKubernetes(),
+			"azuredevops_git_repository":             resourceGitRepository(),
+			"azuredevops_user_entitlement":           resourceUserEntitlement(),
+			"azuredevops_group_membership":           resourceGroupMembership(),
+			"azuredevops_agent_pool":                 resourceAzureAgentPool(),
+			"azuredevops_group":                      resourceGroup(),
+		},
+		DataSourcesMap: map[string]*schema.Resource{
+			"azuredevops_client_config":    dataClientConfig(),
+			"azuredevops_group":            dataGroup(),
+			"azuredevops_project":          dataProject(),
+			"azuredevops_projects":         dataProjects(),
+			"azuredevops_git_repositories": dataGitRepositories(),
+			"azuredevops_users":            dataUsers(),
 		},
 		Schema: map[string]*schema.Schema{
 			"org_service_url": {
 				Type:        schema.TypeString,
-				Required:    true,
+				Optional:    true,
 				DefaultFunc: schema.EnvDefaultFunc("AZDO_ORG_SERVICE_URL", nil),
 				Description: "The url of the Azure DevOps instance which should be used.",
 			},
 			"personal_access_token": {
 				Type:        schema.TypeString,
-				Required:    true,
+				Optional:    true,
 				DefaultFunc: schema.EnvDefaultFunc("AZDO_PERSONAL_ACCESS_TOKEN", nil),
 				Description: "The personal access token which should be used.",
 				Sensitive:   true,
@@ -36,7 +56,15 @@ func Provider() *schema.Provider {
 
 func providerConfigure(p *schema.Provider) schema.ConfigureFunc {
 	return func(d *schema.ResourceData) (interface{}, error) {
-		client, err := getAzdoClient(d.Get("personal_access_token").(string), d.Get("org_service_url").(string))
+		terraformVersion := p.TerraformVersion
+		if terraformVersion == "" {
+			// Terraform 0.12 introduced this field to the protocol
+			// We can therefore assume that if it's missing it's 0.10 or 0.11
+			terraformVersion = "0.11+compatible"
+		}
+
+		client, err := config.GetAzdoClient(d.Get("personal_access_token").(string), d.Get("org_service_url").(string), terraformVersion)
+
 		return client, err
 	}
 }
@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"github.com/hashicorp/terraform/helper/schema"
-	"github.com/hashicorp/terraform/terraform"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/terraform"
 	"github.com/stretchr/testify/require"
 )
 
@@ -15,9 +15,20 @@ var provider = Provider()
 
 func TestAzureDevOpsProvider_HasChildResources(t *testing.T) {
 	expectedResources := []string{
+		"azuredevops_resource_authorization",
 		"azuredevops_build_definition",
 		"azuredevops_project",
-		"azuredevops_serviceendpoint",
+		"azuredevops_serviceendpoint_github",
+		"azuredevops_serviceendpoint_dockerhub",
+		"azuredevops_serviceendpoint_azurerm",
+		"azuredevops_serviceendpoint_bitbucket",
+		"azuredevops_serviceendpoint_kubernetes",
+		"azuredevops_variable_group",
+		"azuredevops_git_repository",
+		"azuredevops_user_entitlement",
+		"azuredevops_group_membership",
+		"azuredevops_group",
+		"azuredevops_agent_pool",
 	}
 
 	resources := provider.ResourcesMap
@@ -29,6 +40,25 @@ func TestAzureDevOpsProvider_HasChildResources(t *testing.T) {
 	}
 }
 
+func TestAzureDevOpsProvider_HasChildDataSources(t *testing.T) {
+	expectedDataSources := []string{
+		"azuredevops_client_config",
+		"azuredevops_group",
+		"azuredevops_project",
+		"azuredevops_projects",
+		"azuredevops_git_repositories",
+		"azuredevops_users",
+	}
+
+	dataSources := provider.DataSourcesMap
+	require.Equal(t, len(expectedDataSources), len(dataSources), "There are an unexpected number of registered data sources")
+
+	for _, resource := range expectedDataSources {
+		require.Contains(t, dataSources, resource, "An expected data source was not registered")
+		require.NotNil(t, dataSources[resource], "A data source cannot have a nil schema")
+	}
+}
+
 func TestAzureDevOpsProvider_SchemaIsValid(t *testing.T) {
 	type testParams struct {
 		name          string
@@ -38,8 +68,8 @@ func TestAzureDevOpsProvider_SchemaIsValid(t *testing.T) {
 	}
 
 	tests := []testParams{
-		{"org_service_url", true, "AZDO_ORG_SERVICE_URL", false},
-		{"personal_access_token", true, "AZDO_PERSONAL_ACCESS_TOKEN", true},
+		{"org_service_url", false, "AZDO_ORG_SERVICE_URL", false},
+		{"personal_access_token", false, "AZDO_PERSONAL_ACCESS_TOKEN", true},
 	}
 
 	schema := provider.Schema
@@ -49,39 +79,30 @@ func TestAzureDevOpsProvider_SchemaIsValid(t *testing.T) {
 		require.Contains(t, schema, test.name, "An expected property was not found in the schema")
 		require.NotNil(t, schema[test.name], "A property in the schema cannot have a nil value")
 		require.Equal(t, test.sensitive, schema[test.name].Sensitive, "A property in the schema has an incorrect sensitivity value")
+		require.Equal(t, test.required, schema[test.name].Required, "A property in the schema has an incorrect required value")
 
 		if test.defaultEnvVar != "" {
-			expectedValue := "foo-env-var"
-			os.Setenv(test.defaultEnvVar, expectedValue)
+			expectedValue := os.Getenv(test.defaultEnvVar)
 
 			actualValue, err := schema[test.name].DefaultFunc()
+			if actualValue == nil {
+				actualValue = ""
+			}
+
 			require.Nil(t, err, "An error occurred when getting the default value from the environment")
 			require.Equal(t, expectedValue, actualValue, "The default value pulled from the environment has the wrong value")
 		}
 	}
 }
 
-// The configuration below can be used for every acceptance test in the project. For that reason,
-// it will be defined once and will live in this file.
-
-// pre-check to validate that the correct environment variables are set prior to running any acceptance test
-func testAccPreCheck(t *testing.T) {
-	requiredEnvVars := []string{
-		"AZDO_ORG_SERVICE_URL",
-		"AZDO_PERSONAL_ACCESS_TOKEN",
-	}
-
-	for _, variable := range requiredEnvVars {
-		if os.Getenv(variable) == "" {
-			t.Fatalf("`%s` must be set for acceptance tests!", variable)
-		}
-	}
+func init() {
+	InitProvider()
 }
 
 var testAccProviders map[string]terraform.ResourceProvider
 var testAccProvider *schema.Provider
 
-func init() {
+func InitProvider() {
 	testAccProvider = provider
 	testAccProviders = map[string]terraform.ResourceProvider{
 		"azuredevops": testAccProvider,

@@ -0,0 +1,168 @@
+package azuredevops
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/taskagent"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/suppress"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/validate"
+)
+
+func resourceAzureAgentPool() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAzureAgentPoolCreate,
+		Read:   resourceAzureAgentPoolRead,
+		Update: resourceAzureAgentPoolUpdate,
+		Delete: resourceAzureAgentPoolDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:         schema.TypeString,
+				ForceNew:     false,
+				Required:     true,
+				ValidateFunc: validate.NoEmptyStrings,
+			},
+			"pool_type": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ForceNew:         true,
+				Default:          taskagent.TaskAgentPoolTypeValues.Automation,
+				DiffSuppressFunc: suppress.CaseDifference,
+				ValidateFunc: validation.StringInSlice([]string{
+					string(taskagent.TaskAgentPoolTypeValues.Automation),
+					string(taskagent.TaskAgentPoolTypeValues.Deployment),
+				}, false),
+			},
+			"auto_provision": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+		},
+	}
+}
+
+func resourceAzureAgentPoolCreate(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	agentPool, err := expandAgentPool(d, true)
+	if err != nil {
+		return fmt.Errorf("Error converting terraform data model to AzDO agentPool reference: %+v", err)
+	}
+
+	createdAgentPool, err := createAzureAgentPool(clients, agentPool)
+	if err != nil {
+		return fmt.Errorf("Error creating agent pool in Azure DevOps: %+v", err)
+	}
+
+	flattenAzureAgentPool(d, createdAgentPool)
+
+	return resourceAzureAgentPoolRead(d, m)
+}
+
+func resourceAzureAgentPoolRead(d *schema.ResourceData, m interface{}) error {
+	poolID, err := strconv.Atoi(d.Id())
+	if err != nil {
+		return fmt.Errorf("Error getting agent pool Id: %+v", err)
+	}
+
+	clients := m.(*config.AggregatedClient)
+	agentPool, err := azureAgentPoolRead(clients, poolID)
+	if err != nil {
+		if utils.ResponseWasNotFound(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error looking up agent pool with ID %d. Error: %v", poolID, err)
+	}
+
+	flattenAzureAgentPool(d, agentPool)
+	return nil
+}
+
+func resourceAzureAgentPoolUpdate(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	agentPool, err := expandAgentPool(d, false)
+	if err != nil {
+		return fmt.Errorf("Error converting terraform data model to AzDO agent pool reference: %+v", err)
+	}
+
+	_, err = azureAgentPoolUpdate(clients, agentPool)
+	if err != nil {
+		return fmt.Errorf("Error updating agent pool in Azure DevOps: %+v", err)
+	}
+
+	return resourceAzureAgentPoolRead(d, m)
+}
+
+func resourceAzureAgentPoolDelete(d *schema.ResourceData, m interface{}) error {
+	poolID, err := strconv.Atoi(d.Id())
+	if err != nil {
+		return fmt.Errorf("Error getting agent pool Id: %+v", err)
+	}
+
+	clients := m.(*config.AggregatedClient)
+	return clients.TaskAgentClient.DeleteAgentPool(clients.Ctx, taskagent.DeleteAgentPoolArgs{
+		PoolId: &poolID,
+	})
+}
+
+func createAzureAgentPool(clients *config.AggregatedClient, agentPool *taskagent.TaskAgentPool) (*taskagent.TaskAgentPool, error) {
+	args := taskagent.AddAgentPoolArgs{
+		Pool: agentPool,
+	}
+
+	newTaskAgent, err := clients.TaskAgentClient.AddAgentPool(clients.Ctx, args)
+	return newTaskAgent, err
+}
+
+func azureAgentPoolRead(clients *config.AggregatedClient, poolID int) (*taskagent.TaskAgentPool, error) {
+	return clients.TaskAgentClient.GetAgentPool(clients.Ctx, taskagent.GetAgentPoolArgs{
+		PoolId: &poolID,
+	})
+}
+
+func azureAgentPoolUpdate(clients *config.AggregatedClient, agentPool *taskagent.TaskAgentPool) (*taskagent.TaskAgentPool, error) {
+	return clients.TaskAgentClient.UpdateAgentPool(
+		clients.Ctx,
+		taskagent.UpdateAgentPoolArgs{
+			PoolId: agentPool.Id,
+			Pool: &taskagent.TaskAgentPool{
+				Name:          agentPool.Name,
+				PoolType:      agentPool.PoolType,
+				AutoProvision: agentPool.AutoProvision,
+			},
+		})
+}
+
+func flattenAzureAgentPool(d *schema.ResourceData, agentPool *taskagent.TaskAgentPool) {
+	d.SetId(strconv.Itoa(*agentPool.Id))
+	d.Set("name", converter.ToString(agentPool.Name, ""))
+	d.Set("pool_type", *agentPool.PoolType)
+	d.Set("auto_provision", *agentPool.AutoProvision)
+}
+
+func expandAgentPool(d *schema.ResourceData, forCreate bool) (*taskagent.TaskAgentPool, error) {
+	poolID, err := strconv.Atoi(d.Id())
+	if !forCreate && err != nil {
+		return nil, fmt.Errorf("Error getting agent pool Id: %+v", err)
+	}
+
+	poolType := taskagent.TaskAgentPoolType(d.Get("pool_type").(string))
+
+	pool := &taskagent.TaskAgentPool{
+		Id:            &poolID,
+		Name:          converter.String(d.Get("name").(string)),
+		PoolType:      &poolType,
+		AutoProvision: converter.Bool(d.Get("auto_provision").(bool)),
+	}
+
+	return pool, nil
+}
@@ -0,0 +1,284 @@
+// +build all resource_agentpool
+
+package azuredevops
+
+// The tests in this file use the mock clients in mock_client.go to mock out
+// the Azure DevOps client operations.
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand"
+	"strconv"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/terraform"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/taskagent"
+	"github.com/microsoft/terraform-provider-azuredevops/azdosdkmocks"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/testhelper"
+	"github.com/stretchr/testify/require"
+)
+
+var testAgentPoolID = rand.Intn(100)
+
+var testAgentPool = taskagent.TaskAgentPool{
+	Id:            &testAgentPoolID,
+	Name:          converter.String("Name"),
+	PoolType:      &taskagent.TaskAgentPoolTypeValues.Automation,
+	AutoProvision: converter.Bool(false),
+}
+
+/**
+ * Begin unit tests
+ */
+
+// verifies that the flatten/expand round trip yields the same agent pool definition
+func TestAzureDevOpsAgentPool_ExpandFlatten_Roundtrip(t *testing.T) {
+	resourceData := schema.TestResourceDataRaw(t, resourceAzureAgentPool().Schema, nil)
+	flattenAzureAgentPool(resourceData, &testAgentPool)
+
+	agentPoolAfterRoundTrip, err := expandAgentPool(resourceData, true)
+	require.Nil(t, err)
+	require.Equal(t, testAgentPool, *agentPoolAfterRoundTrip)
+}
+
+// verifies that the create operation is considered failed if the API call fails.
+func TestAzureDevOpsAgentPool_CreateAgentPool_DoesNotSwallowErrorFromFailedAddAgentCall(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	taskAgentClient := azdosdkmocks.NewMockTaskagentClient(ctrl)
+	clients := &config.AggregatedClient{
+		TaskAgentClient: taskAgentClient,
+		Ctx:             context.Background(),
+	}
+
+	expectedProjectCreateArgs := taskagent.AddAgentPoolArgs{
+		Pool: &testAgentPool,
+	}
+
+	taskAgentClient.
+		EXPECT().
+		AddAgentPool(clients.Ctx, expectedProjectCreateArgs).
+		Return(nil, errors.New("AddAgentPool() Failed")).
+		Times(1)
+
+	newTaskAgentPool, err := createAzureAgentPool(clients, &testAgentPool)
+	require.Nil(t, newTaskAgentPool)
+	require.Equal(t, "AddAgentPool() Failed", err.Error())
+}
+
+func TestAzureDevOpsAgentPool_DeleteAgentPool_ReturnsErrorIfIdReadFails(t *testing.T) {
+	client := &config.AggregatedClient{}
+
+	resourceData := schema.TestResourceDataRaw(t, resourceAzureAgentPool().Schema, nil)
+	flattenAzureAgentPool(resourceData, &testAgentPool)
+	resourceData.SetId("")
+
+	err := resourceAzureAgentPoolDelete(resourceData, client)
+	require.Equal(t, "Error getting agent pool Id: strconv.Atoi: parsing \"\": invalid syntax", err.Error())
+}
+
+func TestAzureDevOpsAgentPool_UpdateAgentPool_ReturnsErrorIfIdReadFails(t *testing.T) {
+	client := &config.AggregatedClient{}
+
+	resourceData := schema.TestResourceDataRaw(t, resourceAzureAgentPool().Schema, nil)
+	flattenAzureAgentPool(resourceData, &testAgentPool)
+	resourceData.SetId("")
+
+	err := resourceAzureAgentPoolUpdate(resourceData, client)
+	require.Equal(t, "Error converting terraform data model to AzDO agent pool reference: Error getting agent pool Id: strconv.Atoi: parsing \"\": invalid syntax", err.Error())
+}
+
+func TestAzureDevOpsAgentPool_UpdateAgentPool_UpdateAndRead(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	taskAgentClient := azdosdkmocks.NewMockTaskagentClient(ctrl)
+	clients := &config.AggregatedClient{
+		TaskAgentClient: taskAgentClient,
+		Ctx:             context.Background(),
+	}
+
+	agentToUpdate := taskagent.TaskAgentPool{
+		Id:            &testAgentPoolID,
+		Name:          converter.String("Foo"),
+		PoolType:      &taskagent.TaskAgentPoolTypeValues.Deployment,
+		AutoProvision: converter.Bool(true),
+	}
+
+	resourceData := schema.TestResourceDataRaw(t, resourceAzureAgentPool().Schema, nil)
+	flattenAzureAgentPool(resourceData, &agentToUpdate)
+
+	taskAgentClient.
+		EXPECT().
+		UpdateAgentPool(clients.Ctx, taskagent.UpdateAgentPoolArgs{
+			PoolId: &testAgentPoolID,
+			Pool: &taskagent.TaskAgentPool{
+				Name:          agentToUpdate.Name,
+				PoolType:      agentToUpdate.PoolType,
+				AutoProvision: agentToUpdate.AutoProvision,
+			},
+		}).
+		Return(&agentToUpdate, nil).
+		Times(1)
+
+	taskAgentClient.
+		EXPECT().
+		GetAgentPool(clients.Ctx, taskagent.GetAgentPoolArgs{
+			PoolId: &testAgentPoolID,
+		}).
+		Return(&agentToUpdate, nil).
+		Times(1)
+
+	err := resourceAzureAgentPoolUpdate(resourceData, clients)
+	require.Nil(t, err)
+
+	updatedTaskAgent, _ := expandAgentPool(resourceData, false)
+	require.Equal(t, agentToUpdate.Id, updatedTaskAgent.Id)
+	require.Equal(t, agentToUpdate.Name, updatedTaskAgent.Name)
+	require.Equal(t, agentToUpdate.PoolType, updatedTaskAgent.PoolType)
+	require.Equal(t, agentToUpdate.AutoProvision, updatedTaskAgent.AutoProvision)
+}
+
+// validates supported pool types are allowed by the schema
+func TestAzureDevOpsAgentPoolDefinition_PoolTypeIsCorrect(t *testing.T) {
+	validPoolTypes := []string{
+		string(taskagent.TaskAgentPoolTypeValues.Automation),
+		string(taskagent.TaskAgentPoolTypeValues.Deployment),
+	}
+	poolTypeSchema := resourceAzureAgentPool().Schema["pool_type"]
+
+	for _, repoType := range validPoolTypes {
+		_, errors := poolTypeSchema.ValidateFunc(repoType, "")
+		require.Equal(t, 0, len(errors), "Agent pool type unexpectedly did not pass validation")
+	}
+}
+
+// validates invalid pool types are rejected by the schema
+func TestAzureDevOpsAgentPoolDefinition_WhenPoolTypeIsNotCorrect_ReturnsError(t *testing.T) {
+	invalidPoolTypes := []string{"", "unknown"}
+	poolTypeSchema := resourceAzureAgentPool().Schema["pool_type"]
+
+	for _, poolType := range invalidPoolTypes {
+		_, errors := poolTypeSchema.ValidateFunc(poolType, "pool_type")
+		expectedError := fmt.Sprintf("expected pool_type to be one of [automation deployment], got %s", poolType)
+		require.Equal(t, 1, len(errors), "Agent pool type %v unexpectedly passed validation", poolType)
+		require.Equal(t, expectedError, errors[0].Error())
+	}
+}
+
+/**
+ * Begin acceptance tests
+ */
+
+// Verifies that the following sequence of events occurrs without error:
+//	(1) TF apply creates agent pool
+//	(2) TF state values are set
+//	(3) Agent pool can be queried by ID and has expected name
+//  (4) TF apply updates agent pool with new name
+//  (5) Agent pool can be queried by ID and has expected name
+// 	(6) TF destroy deletes agent pool
+//	(7) Agent pool can no longer be queried by ID
+func TestAccAzureDevOpsAgentPool_CreateAndUpdate(t *testing.T) {
+	poolNameFirst := testhelper.TestAccResourcePrefix + acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+	poolNameSecond := testhelper.TestAccResourcePrefix + acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+	tfNode := "azuredevops_agent_pool.pool"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testhelper.TestAccPreCheck(t, nil) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccAgentPoolCheckDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testhelper.TestAccAgentPoolResource(poolNameFirst),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tfNode, "name", poolNameFirst),
+					resource.TestCheckResourceAttr(tfNode, "auto_provision", "false"),
+					resource.TestCheckResourceAttr(tfNode, "pool_type", "automation"),
+					testAccCheckAgentPoolResourceExists(poolNameFirst),
+				),
+			},
+			{
+				Config: testhelper.TestAccAgentPoolResource(poolNameSecond),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(tfNode, "name", poolNameSecond),
+					resource.TestCheckResourceAttr(tfNode, "auto_provision", "false"),
+					resource.TestCheckResourceAttr(tfNode, "pool_type", "automation"),
+					testAccCheckAgentPoolResourceExists(poolNameSecond),
+				),
+			},
+			{
+				// Resource Acceptance Testing https://www.terraform.io/docs/extend/resources/import.html#resource-acceptance-testing-implementation
+				ResourceName:      tfNode,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+// Given the name of an AzDO project, this will return a function that will check whether
+// or not the project (1) exists in the state and (2) exist in AzDO and (3) has the correct name
+func testAccCheckAgentPoolResourceExists(expectedName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resource, ok := s.RootModule().Resources["azuredevops_agent_pool.pool"]
+		if !ok {
+			return fmt.Errorf("Did not find a agent pool in the TF state")
+		}
+
+		clients := testAccProvider.Meta().(*config.AggregatedClient)
+		id, err := strconv.Atoi(resource.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("Parse ID error, ID:  %v !. Error= %v", resource.Primary.ID, err)
+		}
+
+		project, agentPoolErr := azureAgentPoolRead(clients, id)
+
+		if agentPoolErr != nil {
+			return fmt.Errorf("Agent Pool with ID=%d cannot be found!. Error=%v", id, err)
+		}
+
+		if *project.Name != expectedName {
+			return fmt.Errorf("Agent Pool with ID=%d has Name=%s, but expected Name=%s", id, *project.Name, expectedName)
+		}
+
+		return nil
+	}
+}
+
+// verifies that agent pool referenced in the state is destroyed. This will be invoked
+// *after* terrafform destroys the resource but *before* the state is wiped clean.
+func testAccAgentPoolCheckDestroy(s *terraform.State) error {
+	clients := testAccProvider.Meta().(*config.AggregatedClient)
+
+	// verify that every agent pool referenced in the state does not exist in AzDO
+	for _, resource := range s.RootModule().Resources {
+		if resource.Type != "azuredevops_agent_pool" {
+			continue
+		}
+
+		id, err := strconv.Atoi(resource.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("Agent Pool ID=%d cannot be parsed!. Error=%v", id, err)
+		}
+
+		// indicates the agent pool still exists - this should fail the test
+		if _, err := azureAgentPoolRead(clients, id); err == nil {
+			return fmt.Errorf("Agent Pool ID %d should not exist", id)
+		}
+	}
+
+	return nil
+}
+
+func init() {
+	InitProvider()
+}
@@ -0,0 +1,389 @@
+package azuredevops
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/google/uuid"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
+	"github.com/microsoft/azure-devops-go-api/azuredevops"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/graph"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/webapi"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+)
+
+func resourceGroup() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceGroupCreate,
+		Read:   resourceGroupRead,
+		Update: resourceGroupUpdate,
+		Delete: resourceGroupDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+		Schema: map[string]*schema.Schema{
+			"scope": {
+				Type:         schema.TypeString,
+				ValidateFunc: validation.NoZeroValues,
+				Optional:     true,
+				ForceNew:     true,
+			},
+
+			// ***
+			// One of
+			//     origin_id => GraphGroupOriginIdCreationContext
+			//     mail => GraphGroupMailAddressCreationContext
+			//     display_name => GraphGroupVstsCreationContext
+			// must be specified
+			// ***
+
+			"origin_id": {
+				Type:          schema.TypeString,
+				ValidateFunc:  validation.NoZeroValues,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"mail", "display_name", "scope"},
+			},
+
+			"mail": {
+				Type:          schema.TypeString,
+				ValidateFunc:  validation.NoZeroValues,
+				Optional:      true,
+				ForceNew:      true,
+				Computed:      true,
+				ConflictsWith: []string{"origin_id", "display_name", "scope"},
+			},
+
+			"display_name": {
+				Type:          schema.TypeString,
+				ValidateFunc:  validation.NoZeroValues,
+				Optional:      true,
+				ForceNew:      true,
+				Computed:      true,
+				ConflictsWith: []string{"origin_id", "mail"},
+			},
+
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+
+			"url": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"origin": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"subject_kind": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"domain": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"principal_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"descriptor": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
+			"members": {
+				Type: schema.TypeSet,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: validation.NoZeroValues,
+				},
+				Computed:   true,
+				Optional:   true,
+				ConfigMode: schema.SchemaConfigModeAttr,
+				Set:        schema.HashString,
+			},
+		},
+	}
+}
+
+type azDOGraphCreateGroupArgs struct {
+	// (required) The subset of the full graph group used to uniquely find the graph subject in an external provider.
+	CreationContext interface{}
+	// (optional) A descriptor referencing the scope (collection, project) in which the group should be created.
+	// If omitted, will be created in the scope of the enclosing account or organization. Valid only for VSTS groups.
+	ScopeDescriptor *string
+	// (optional) A comma separated list of descriptors referencing groups you want the graph group to join
+	GroupDescriptors *[]string
+}
+
+func azDOGraphCreateGroup(ctx context.Context, client graph.Client, args azDOGraphCreateGroupArgs) (*graph.GraphGroup, error) {
+	if args.CreationContext == nil {
+		return nil, &azuredevops.ArgumentNilError{ArgumentName: "args.CreationContext"}
+	}
+	queryParams := url.Values{}
+	if args.ScopeDescriptor != nil {
+		queryParams.Add("scopeDescriptor", *args.ScopeDescriptor)
+	}
+	if args.GroupDescriptors != nil {
+		listAsString := strings.Join((*args.GroupDescriptors)[:], ",")
+		queryParams.Add("groupDescriptors", listAsString)
+	}
+
+	if _, ok := args.CreationContext.(*graph.GraphGroupMailAddressCreationContext); !ok {
+		if _, ok := args.CreationContext.(*graph.GraphGroupOriginIdCreationContext); !ok {
+			if _, ok := args.CreationContext.(*graph.GraphGroupVstsCreationContext); !ok {
+				return nil, fmt.Errorf("Unsupported group creation context")
+			}
+		}
+	}
+
+	body, marshalErr := json.Marshal(args.CreationContext)
+	if marshalErr != nil {
+		return nil, marshalErr
+	}
+	locationID, _ := uuid.Parse("ebbe6af8-0b91-4c13-8cf1-777c14858188")
+	if clientImpl, ok := client.(*graph.ClientImpl); ok {
+		resp, err := clientImpl.Client.Send(ctx, http.MethodPost, locationID, "5.1-preview.1", nil, queryParams, bytes.NewReader(body), "application/json", "application/json", nil)
+		if err != nil {
+			return nil, err
+		}
+		var responseValue graph.GraphGroup
+		err = clientImpl.Client.UnmarshalBody(resp, &responseValue)
+		return &responseValue, err
+	}
+
+	panic("Invalid Azure DevOps Graph client implementation")
+}
+
+func resourceGroupCreate(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+
+	// using: POST https://vssps.dev.azure.com/{organization}/_apis/graph/groups?api-version=5.1-preview.1
+	cga := azDOGraphCreateGroupArgs{}
+	val, b := d.GetOk("scope")
+	if b {
+		uuid, _ := uuid.Parse(val.(string))
+		desc, err := clients.GraphClient.GetDescriptor(clients.Ctx, graph.GetDescriptorArgs{
+			StorageKey: &uuid,
+		})
+		if err != nil {
+			return err
+		}
+		cga.ScopeDescriptor = desc.Value
+	}
+	val, b = d.GetOk("origin_id")
+	if b {
+		if _, b = d.GetOk("mail"); b {
+			return fmt.Errorf("Unable to create group with invalid parameters: mail")
+		}
+		if _, b = d.GetOk("display_name"); b {
+			return fmt.Errorf("Unable to create group with invalid parameters: display_name")
+		}
+		cga.CreationContext = &graph.GraphGroupOriginIdCreationContext{
+			OriginId: converter.String(val.(string)),
+		}
+	} else {
+		val, b = d.GetOk("mail")
+		if b {
+			if _, b = d.GetOk("display_name"); b {
+				return fmt.Errorf("Unable to create group with invalid parameters: display_name")
+			}
+			cga.CreationContext = &graph.GraphGroupMailAddressCreationContext{
+				MailAddress: converter.String(val.(string)),
+			}
+		} else {
+			val, b = d.GetOk("display_name")
+			if b {
+				cga.CreationContext = &graph.GraphGroupVstsCreationContext{
+					DisplayName: converter.String(val.(string)),
+					Description: converter.String(d.Get("description").(string)),
+				}
+			} else {
+				return fmt.Errorf("INTERNAL ERROR: Unable to determine strategy to create group")
+			}
+		}
+	}
+	group, err := azDOGraphCreateGroup(clients.Ctx, clients.GraphClient, cga)
+	if err != nil {
+		return err
+	}
+	if group.Descriptor == nil {
+		return fmt.Errorf("DevOps REST API returned group object without descriptor")
+	}
+
+	stateMembers, exists := d.GetOk("members")
+	if exists {
+		members := expandGroupMembers(*group.Descriptor, stateMembers.(*schema.Set))
+		if err := addMembers(clients, members); err != nil {
+			return fmt.Errorf("Error adding group memberships during create: %+v", err)
+		}
+	}
+
+	d.SetId(*group.Descriptor)
+
+	return resourceGroupRead(d, m)
+}
+
+func resourceGroupRead(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+
+	// using: GET https://vssps.dev.azure.com/{organization}/_apis/graph/groups/{groupDescriptor}?api-version=5.1-preview.1
+	// d.Get("descriptor").(string) => {groupDescriptor}
+	getGroupArgs := graph.GetGroupArgs{
+		GroupDescriptor: converter.String(d.Id()),
+	}
+	group, err := clients.GraphClient.GetGroup(clients.Ctx, getGroupArgs)
+	if err != nil {
+		if utils.ResponseWasNotFound(err) {
+			d.SetId("")
+			return nil
+		}
+		return err
+	}
+	if group.Descriptor == nil {
+		return fmt.Errorf("DevOps REST API returned group object without descriptor; group %s", d.Id())
+	}
+
+	members, err := groupReadMembers(*group.Descriptor, clients)
+	if err != nil {
+		return err
+	}
+	return flattenGroup(d, group, members)
+}
+
+func resourceGroupUpdate(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+
+	// using: PATCH https://vssps.dev.azure.com/{organization}/_apis/graph/groups/{groupDescriptor}?api-version=5.1-preview.1
+	// d.Get("descriptor").(string) => {groupDescriptor}
+
+	if d.HasChange("description") {
+		description := d.Get("description")
+		uptGroupArgs := graph.UpdateGroupArgs{
+			GroupDescriptor: converter.String(d.Id()),
+			PatchDocument: &[]webapi.JsonPatchOperation{
+				{
+					Op:    &webapi.OperationValues.Replace,
+					From:  nil,
+					Path:  converter.String("/description"),
+					Value: description.(string),
+				},
+			},
+		}
+
+		_, err := clients.GraphClient.UpdateGroup(clients.Ctx, uptGroupArgs)
+		if err != nil {
+			return err
+		}
+	}
+
+	if d.HasChange("members") {
+		group := d.Id()
+		oldData, newData := d.GetChange("members")
+		// members that need to be added will be missing from the old data, but present in the new data
+		membersToAdd := newData.(*schema.Set).Difference(oldData.(*schema.Set))
+		// members that need to be removed will be missing from the new data, but present in the old data
+		membersToRemove := oldData.(*schema.Set).Difference(newData.(*schema.Set))
+		if err := applyMembershipUpdate(m.(*config.AggregatedClient),
+			expandGroupMembers(group, membersToAdd),
+			expandGroupMembers(group, membersToRemove)); err != nil {
+			return err
+		}
+	}
+
+	return resourceGroupRead(d, m)
+}
+
+func resourceGroupDelete(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+
+	// using: DELETE https://vssps.dev.azure.com/{organization}/_apis/graph/groups/{groupDescriptor}?api-version=5.1-preview.1
+	// d.Get("descriptor").(string) => {groupDescriptor}
+	delGroupArgs := graph.DeleteGroupArgs{
+		GroupDescriptor: converter.String(d.Id()),
+	}
+	err := clients.GraphClient.DeleteGroup(clients.Ctx, delGroupArgs)
+	if err != nil {
+		return err
+	}
+	d.SetId("")
+	return nil
+}
+
+func flattenGroup(d *schema.ResourceData, group *graph.GraphGroup, members *[]graph.GraphMembership) error {
+	if group.Descriptor != nil {
+		d.Set("descriptor", *group.Descriptor)
+		d.SetId(*group.Descriptor)
+	} else {
+		return fmt.Errorf("Group Object does not contain a descriptor")
+	}
+	if group.DisplayName != nil {
+		d.Set("display_name", *group.DisplayName)
+	}
+	if group.Url != nil {
+		d.Set("url", *group.Url)
+	}
+	if group.Origin != nil {
+		d.Set("origin", *group.Origin)
+	}
+	if group.OriginId != nil {
+		d.Set("origin_id", *group.OriginId)
+	}
+	if group.SubjectKind != nil {
+		d.Set("subject_kind", *group.SubjectKind)
+	}
+	if group.Domain != nil {
+		d.Set("domain", *group.Domain)
+	}
+	if group.MailAddress != nil {
+		d.Set("mail", *group.MailAddress)
+	}
+	if group.PrincipalName != nil {
+		d.Set("principal_name", *group.PrincipalName)
+	}
+	if group.Description != nil {
+		d.Set("description", *group.Description)
+	}
+	if members != nil {
+		dMembers := make([]string, len(*members))
+		for i, e := range *members {
+			dMembers[i] = *e.MemberDescriptor
+		}
+		d.Set("members", dMembers)
+	}
+	return nil
+}
+
+func groupReadMembers(groupDescriptor string, clients *config.AggregatedClient) (*[]graph.GraphMembership, error) {
+	actualMembers, err := clients.GraphClient.ListMemberships(clients.Ctx, graph.ListMembershipsArgs{
+		SubjectDescriptor: &groupDescriptor,
+		Direction:         &graph.GraphTraversalDirectionValues.Down,
+		Depth:             converter.Int(1),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("Error reading group memberships during read: %+v", err)
+	}
+
+	members := make([]graph.GraphMembership, len(*actualMembers))
+	for i, membership := range *actualMembers {
+		members[i] = *buildMembership(groupDescriptor, *membership.MemberDescriptor)
+	}
+
+	return &members, nil
+}
@@ -0,0 +1,301 @@
+package azuredevops
+
+import (
+	"fmt"
+	"math/rand"
+	"strings"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/graph"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/config"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/converter"
+	"github.com/microsoft/terraform-provider-azuredevops/azuredevops/utils/suppress"
+)
+
+func resourceGroupMembership() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceGroupMembershipCreate,
+		Read:   resourceGroupMembershipRead,
+		Update: resourceGroupMembershipUpdate,
+		Delete: resourceGroupMembershipDelete,
+
+		Schema: map[string]*schema.Schema{
+			"group": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.NoZeroValues,
+			},
+			"mode": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          "add",
+				DiffSuppressFunc: suppress.CaseDifference,
+				ValidateFunc: validation.StringInSlice([]string{
+					"add", "overwrite",
+				}, true),
+			},
+			"members": {
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: validation.NoZeroValues,
+				},
+			},
+		},
+	}
+}
+
+func resourceGroupMembershipCreate(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	group := d.Get("group").(string)
+	mode := d.Get("mode").(string)
+	membersToAdd := d.Get("members").(*schema.Set)
+	var membersToRemove *schema.Set = nil
+
+	if strings.EqualFold("overwrite", mode) {
+		actualMemberships, err := getGroupMemberships(clients, group)
+		if err != nil {
+			return fmt.Errorf("Error reading group memberships during read: %+v", err)
+		}
+		actualMembershipsSet, err := getGroupMembershipSet(actualMemberships)
+		if err != nil {
+			return fmt.Errorf("Error converting membership list to set: %+v", err)
+		}
+		membersToRemove = membersToAdd.Difference(actualMembershipsSet)
+	} else {
+		membersToRemove, _ = getGroupMembershipSet(nil)
+	}
+
+	err := applyMembershipUpdate(m.(*config.AggregatedClient),
+		expandGroupMembers(group, membersToAdd),
+		expandGroupMembers(group, membersToRemove))
+	if err != nil {
+		return fmt.Errorf("Error adding group memberships during create: %+v", err)
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending: []string{"Waiting"},
+		Target:  []string{"Synched"},
+		Refresh: func() (interface{}, string, error) {
+			clients := m.(*config.AggregatedClient)
+			state := "Waiting"
+			actualMemberships, err := getGroupMemberships(clients, group)
+			if err != nil {
+				return nil, "", fmt.Errorf("Error reading group memberships: %+v", err)
+			}
+			actualMembershipsSet, err := getGroupMembershipSet(actualMemberships)
+			if err != nil {
+				return nil, "", fmt.Errorf("Error converting membership list to set: %+v", err)
+			}
+			if (membersToAdd == nil || actualMembershipsSet.Intersection(membersToAdd).Len() <= 0) &&
+				(membersToRemove == nil || actualMembershipsSet.Intersection(membersToRemove).Len() <= 0) {
+				state = "Synched"
+			}
+
+			return state, state, nil
+		},
+		Timeout:                   60 * time.Minute,
+		MinTimeout:                5 * time.Second,
+		Delay:                     5 * time.Second,
+		ContinuousTargetOccurence: 3,
+	}
+	if _, err := stateConf.WaitForState(); err != nil {
+		return fmt.Errorf("Error waiting for DevOps synching memberships for group  [%s]: %+v", group, err)
+	}
+
+	// The ID for this resource is meaningless so we can just assign a random ID
+	d.SetId(fmt.Sprintf("%d", rand.Int()))
+
+	return resourceGroupMembershipRead(d, m)
+}
+
+func resourceGroupMembershipUpdate(d *schema.ResourceData, m interface{}) error {
+	if !d.HasChange("members") {
+		return nil
+	}
+
+	group := d.Get("group").(string)
+	oldData, newData := d.GetChange("members")
+	// members that need to be added will be missing from the old data, but present in the new data
+	membersToAdd := newData.(*schema.Set).Difference(oldData.(*schema.Set))
+	// members that need to be removed will be missing from the new data, but present in the old data
+	membersToRemove := oldData.(*schema.Set).Difference(newData.(*schema.Set))
+
+	err := applyMembershipUpdate(m.(*config.AggregatedClient),
+		expandGroupMembers(group, membersToAdd),
+		expandGroupMembers(group, membersToRemove))
+	if err != nil {
+		return err
+	}
+
+	stateConf := &resource.StateChangeConf{
+		Pending: []string{"Waiting"},
+		Target:  []string{"Synched"},
+		Refresh: func() (interface{}, string, error) {
+			clients := m.(*config.AggregatedClient)
+			state := "Waiting"
+			actualMemberships, err := getGroupMemberships(clients, group)
+			if err != nil {
+				return nil, "", fmt.Errorf("Error reading group memberships: %+v", err)
+			}
+			actualMembershipsSet, err := getGroupMembershipSet(actualMemberships)
+			if err != nil {
+				return nil, "", fmt.Errorf("Error converting membership list to set: %+v", err)
+			}
+			if actualMembershipsSet.Intersection(membersToAdd).Len() <= 0 &&
+				actualMembershipsSet.Intersection(membersToRemove).Len() <= 0 {
+				state = "Synched"
+			}
+
+			return state, state, nil
+		},
+		Timeout:                   60 * time.Minute,
+		MinTimeout:                5 * time.Second,
+		Delay:                     5 * time.Second,
+		ContinuousTargetOccurence: 3,
+	}
+	if _, err := stateConf.WaitForState(); err != nil {
+		return fmt.Errorf("Error waiting for DevOps synching memberships for group  [%s]: %+v", group, err)
+	}
+
+	return resourceGroupMembershipRead(d, m)
+}
+
+func applyMembershipUpdate(clients *config.AggregatedClient, toAdd *[]graph.GraphMembership, toRemove *[]graph.GraphMembership) error {
+	if toRemove != nil && len(*toRemove) > 0 {
+		err := removeMembers(clients, toRemove)
+		if err != nil {
+			return fmt.Errorf("Error removing group memberships during update: %+v", err)
+		}
+	}
+
+	if toAdd != nil && len(*toAdd) > 0 {
+		err := addMembers(clients, toAdd)
+		if err != nil {
+			return fmt.Errorf("Error adding group memberships during update: %+v", err)
+		}
+	}
+	return nil
+}
+
+func resourceGroupMembershipDelete(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	memberships := expandGroupMembers(d.Get("group").(string), d.Get("members").(*schema.Set))
+
+	err := removeMembers(clients, memberships)
+	if err != nil {
+		return fmt.Errorf("Error removing group memberships during delete: %+v", err)
+	}
+
+	// this marks the resource as deleted
+	d.SetId("")
+	return nil
+}
+
+// Add members to a group using the AzDO REST API. If any error is encountered, the function immediately returns.
+func addMembers(clients *config.AggregatedClient, memberships *[]graph.GraphMembership) error {
+	if memberships != nil {
+		for _, membership := range *memberships {
+			_, err := clients.GraphClient.AddMembership(clients.Ctx, graph.AddMembershipArgs{
+				SubjectDescriptor:   membership.MemberDescriptor,
+				ContainerDescriptor: membership.ContainerDescriptor,
+			})
+
+			if err != nil {
+				return fmt.Errorf("Error adding member %s to group %s: %+v",
+					converter.ToString(membership.MemberDescriptor, "nil"),
+					converter.ToString(membership.ContainerDescriptor, "nil"),
+					err)
+			}
+		}
+	}
+	return nil
+}
+
+// Remove members from a group using the AzDO REST API. If any error is encountered, the function immediately returns.
+func removeMembers(clients *config.AggregatedClient, memberships *[]graph.GraphMembership) error {
+	if memberships != nil {
+		for _, membership := range *memberships {
+			err := clients.GraphClient.RemoveMembership(clients.Ctx, graph.RemoveMembershipArgs{
+				SubjectDescriptor:   membership.MemberDescriptor,
+				ContainerDescriptor: membership.ContainerDescriptor,
+			})
+
+			if err != nil {
+				return fmt.Errorf("Error removing member from group: %+v", err)
+			}
+		}
+	}
+	return nil
+}
+
+func expandGroupMembers(group string, memberSet *schema.Set) *[]graph.GraphMembership {
+	if memberSet == nil || memberSet.Len() <= 0 {
+		return &[]graph.GraphMembership{}
+	}
+	members := memberSet.List()
+	memberships := make([]graph.GraphMembership, len(members))
+
+	for i, member := range members {
+		memberships[i] = *buildMembership(group, member.(string))
+	}
+
+	return &memberships
+}
+
+func buildMembership(group string, member string) *graph.GraphMembership {
+	return &graph.GraphMembership{
+		ContainerDescriptor: &group,
+		MemberDescriptor:    &member,
+	}
+}
+
+func resourceGroupMembershipRead(d *schema.ResourceData, m interface{}) error {
+	clients := m.(*config.AggregatedClient)
+	group := d.Get("group").(string)
+
+	actualMemberships, err := getGroupMemberships(clients, group)
+	if err != nil {
+		if utils.ResponseWasNotFound(err) {
+			d.SetId("")
+			return nil
+		}
+		return fmt.Errorf("Error reading group memberships during read: %+v", err)
+	}
+
+	mode := d.Get("mode").(string)
+	stateMembers := d.Get("members").(*schema.Set)
+	members := make([]string, 0)
+	for _, membership := range *actualMemberships {
+		if strings.EqualFold("overwrite", mode) || stateMembers.Contains(*membership.MemberDescriptor) {
+			members = append(members, *membership.MemberDescriptor)
+		}
+	}
+
+	d.Set("members", members)
+	return nil
+}
+
+func getGroupMemberships(clients *config.AggregatedClient, groupDescriptor string) (*[]graph.GraphMembership, error) {
+	return clients.GraphClient.ListMemberships(clients.Ctx, graph.ListMembershipsArgs{
+		SubjectDescriptor: &groupDescriptor,
+		Direction:         &graph.GraphTraversalDirectionValues.Down,
+		Depth:             converter.Int(1),
+	})
+}
+
+func getGroupMembershipSet(members *[]graph.GraphMembership) (*schema.Set, error) {
+	set := schema.NewSet(schema.HashString, nil)
+	if nil != members {
+		for _, member := range *members {
+			set.Add(*member.MemberDescriptor)
+		}
+	}
+	return set, nil
+}