azurearm

Azurearm

Parity grade: B · SDK hashicorp/terraform-provider-azurerm@v4.81.0 · last audited 2026-09-12 (f973f0c90)

Coverage

Known gaps

• Storage RP account state (StorageProvider.accounts) does not survive a snapshot/restore cycle -- only InMemoryBackend's resource-group/generic-resource/provider-registration state is persisted (see ops.StorageAccountCRUD). Fix is additive: give StorageProvider its own Snapshot/Restore and wire it into Handler.Snapshot/Restore alongside the backend's.
• ServiceBus RP state (ServiceBusProvider's namespaces/queues/topics/subscriptions maps) does not survive a snapshot/restore cycle either, the same known gap as StorageAccountCRUD above and for the same reason -- no ResourceProvider's own state is currently wired into Handler.Snapshot/Restore.
• TestTerraform_Azure_ServiceBus (M9) could not be confirmed against a live tofu apply on this milestone's local macOS development sandbox, due to the same pre-existing host-OS-specific TLS-trust gap documented for M7/M8 (AZURE.md section 10.10) -- apply fails at ARM's own metadata-discovery call, before reaching any ServiceBus-specific code. Compensating verification: test/integration/azurearm_test.go's TestIntegration_AzureARM_ServiceBusLifecycleAndCrossServiceWiring exercises the identical ARM CRUD + cross-service-wiring path over plain HTTP and passed; wire-shape questions were answered by reading the pinned terraform-provider-azurerm/go-azure-sdk source directly. Should be re-confirmed against a green CI run (expected to work on Linux).
• Token endpoint accepts any (or a missing) client_id/grant_type without validation and always issues a token; a malformed client_credentials request should arguably 400 with invalid_request/unsupported_grant_type per RFC 6749, matching AAD's own error shape more closely.
• Direct-data-plane storage resources (azurerm_storage_container/_blob/_queue/_table) are covered as of M8 via the new services/azurestoragevhost virtual-hosted-style listener (AZURE.md section 10.8 finding (9)); azurerm_storage_share (File Share) remains out of scope -- no gopherstack file-share service exists.
• Multi-account namespace isolation: all ARM-created storage accounts alias one shared Blob/Queue/Table container/queue/table namespace (services/azureblob/azurequeue/azuretable discard the account-name path segment entirely). Two ARM storage accounts see each other's containers. Deferred to M10 per AZURE.md section 10.4's original note; StorageAccounts.RegisterAccount/DeleteAccount (interfaces.go) is the forward-compat seam for that fix.
• ARM error codes are a small hand-picked table (errors.go's errorDetails), not audited against ARM's full published error-code catalog the way services/sqs's errorDetails table has been over multiple audit passes.
• management locks, Azure Policy, RBAC/Microsoft.Authorization, ARM template deployments (Microsoft.Resources/deployments), PATCH-merge semantics beyond full-replace, $filter/$expand and nextLink pagination on list operations, cross-subscription/cross-tenant, resource moves, What-If, and LRO polling are all explicitly out of MVP scope per AZURE.md section 10.1/10.3 -- not bugs, deliberate scope boundaries for this milestone.
• Flexible servers: only the listed operations are modelled. PostgreSQL administrators (Entra), backups, migrations, virtual-network subnet usage, and MySQL updateConfigurations (batch), maintenances, logFiles, backupAndExport, advanced threat protection, Entra administrators, failover, detachVNet, resetGtid and private endpoint connections answer from the generic store or 404.
• Flexible servers: replicas and point-in-time/geo restores are state-level (a copy of the source configuration and database list); under the docker engine they are refused with 400 InvalidParameterValue because a new container would start without the source data or the administrator password. Replication is not run.
• Flexible servers: server parameter changes are stored, validated against a documented subset of parameters and flagged pending-restart, but are not applied to the docker engine; max_connections defaults follow the documented per-SKU tables for both engines, but the docker engine itself is not started with that value; the PostgreSQL max_connections range, every other parameter default/range/allowed value, and the MySQL storage IOPS formula (360 minimum, 3 per GiB) are not taken from a published table.
• Flexible servers: firewall rules (including the 0.0.0.0 allow-Azure-services rule) are stored and validated but not enforced - the docker engine listens on loopback only; engines are not relaunched after a gopherstack restart or snapshot restore; the automatic restart of a stopped server (7 days for PostgreSQL, 30 days for MySQL per the Learn how-to pages), maintenance windows, HA failover, data encryption and Entra authentication are stored but not acted on.
• Flexible servers: error codes and HTTP statuses outside stop/restart are unverified (no primary source documents them): name collision (409 Conflict), write during a pending operation, write to a stopped server, validation failures (400 InvalidParameterValue), and failed operations (InternalServerError). The busy-code spelling (SeverBusyWithOtherOperation vs ServerBusyWithOtherOperation) is documented one way and observed another.
• Flexible servers: not modelled although documented - PostgreSQL Premium SSD v2 (storage up to 64 TiB in 1 GiB steps, terraform storage_type PremiumV2_LRS), PostgreSQL confidential-compute SKUs (terraform regex Standard_Cads_v5), PostgreSQL E6ds_v4, the PostgreSQL rule that a private DNS zone name must differ from the server name, MySQL storage IOPS pre-provisioning limits below the SKU maximum, and MySQL B1s IOPS (not published).
• Flexible servers: no Terraform azurerm fixture (azurerm_postgresql_flexible_server, azurerm_mysql_flexible_server) yet; the SDK-driven tests are the only wire proof.
• AKS: snapshots, machines, managedNamespaces, identityBindings, private endpoint connections, rotateServiceAccountSigningKeys and the agent pool abort are not modelled (the generic store keeps what is PUT).
• AKS: node pools are metadata; no VMs back them and the k3s engine runs one server node regardless of pool counts.
• AKS runCommand: with the engine the command runs in the k3s node (not in a pod) through /bin/sh with KUBECONFIG pointed at the node's own admin kubeconfig; kubectl is the k3s one, helm is not in the k3s image so helm commands exit 127; clusterToken is ignored; the context zip travels in an environment variable, so it is limited to 96 KiB of base64; logs are capped at 1 MiB and a command at 10 minutes (both unverified limits). Without the engine no node can schedule the command pod, so the command ends provisioningState failed with the reason Learn documents for that case (troubleshoot/azure/azure-kubernetes/resolve-az-aks-command-invoke-failures, Cause 1: KubernetesPerformanceError, 'Failed to run command due to cluster perf issue, container command- in aks-command namespace did not start within 30s on your cluster...', with the 32-hex command id); how the service places the code relative to the message in the result body, and whether it instead answers 404 Not Found as the same page's symptom table says, is unverified. Command results are kept per cluster (the newest 50) and a restored snapshot fails the ones that were running.
• AKS abort: only operations the emulator runs for a while can be aborted - creating or updating a cluster with the engine on, start, and certificate rotation; the abort answers 202 after the operation has wound down, and 409 OperationNotAllowed when nothing runs (the 409 is documented, the code string is not). A cancelled create leaves the cluster in provisioningState Canceled without a node until the next PUT or start. Agent pool abort is not routed.
• AKS rotateClusterCertificates: with the engine five fresh CAs (server, client, request-header, etcd peer and server) are generated, staged in the node and installed with k3s certificate rotate-ca --force (docs.k3s.io/cli/certificate: a new self-signed root needs --force), then the node is restarted and reissues every certificate under them, so listClusterUserCredential/AdminCredential return the new CA and the old one no longer verifies the API server (Learn azure/aks/certificate-rotation: rotating the cluster CA refreshes API server, kubelet and service account certificates; the real service also recreates nodes, up to 30 minutes of downtime). The static admin token is not rotated and pods are not restarted to trust the new root; without the engine the emulated CA and token are replaced, so kubeconfigs fetched earlier stop matching. The failure code ClusterCertificateRotationFailed is not from a primary source.
• AKS resetAADProfile / resetServicePrincipalProfile: both exist in 2026-08-01 (resetAADProfile carries the deprecation warning in its description) and are accepted for every supported api-version. The profile is stored (serverAppSecret and the service principal secret are write-only); the refusals for an AKS-managed AAD cluster and for a cluster without a service principal (the spec says the latter is not allowed) use OperationNotAllowed, which is not from a primary source. No legacy AAD token validation happens.
• AKS maintenanceConfigurations: validated against the 2026-08-01 schema (required durationHours 4-24, startTime, exactly one schedule type with the documented interval ranges, utcOffset and date formats, notAllowedDates/notAllowedTime ordering) and the Learn table of schedule types per name (default weekly only; aksManagedAutoUpgradeSchedule and aksManagedNodeOSUpgradeSchedule all four); the 400 code InvalidParameter, the rule that default needs a window or timeInWeek, that the aksManaged names refuse timeInWeek/notAllowedTime, and the utcOffset hour limit (14) are not from a primary source. Windows are stored and returned but never gate an upgrade; list is not paged.
• AKS trustedAccessRoleBindings / trustedAccessRoles: bindings are stored with the 24-character name rule, at most 8 per cluster (Learn) and the rule that each role is / of the source resource's type; role names are not checked against a catalog and no ClusterRoleBinding is created in the node. The role catalog lists only the roles whose rules the API reference publishes (Microsoft.MachineLearningServices/workspaces reader); writer, mlworkload, backup-operator and the other documented roles are missing because their rules are not published. Error codes are unverified.
• AKS engine state: the k3s data directory lives on a named volume (gopherstack-aks-), the node name is pinned and the join token is derived from the cluster, so stop/start, a snapshot restore and a restart with persistence on all resume the same cluster state; a running node left by a crashed gopherstack is adopted by resource label (the data volume of a cluster that no longer exists is removed at restore). Without persistence a restart forgets the cluster, and creating a cluster of the same name discards the leftover volume. Runtimes that cannot keep stopped containers or create volumes keep state only while the container lives.
• AKS: addon profiles, AAD, auto-upgrade, http proxy, security and storage profiles are stored and returned but not interpreted; the VM catalog and Kubernetes patch versions are representative subsets; the kubeconfig carries a bearer token only (no client certificates).
• Container Apps: init containers, subPath mounts, NfsAzureFile volumes, additional TCP ports, exposedPort/TCP transport routing, session affinity, CORS, ipSecurityRestrictions enforcement, custom domains, Dapr runtime, probes and managed-identity registry pulls are stored but not run or enforced.
• Container Apps: KEDA scale rules other than the http/tcp concurrency settings (queue, custom) are stored but never scale replicas; scale-out is driven by in-flight requests through the ingress.
• Container Apps jobs: Schedule and Event triggers are stored and validated but never fire (only start runs an execution); replicaRetryLimit and replicaTimeout are not enforced.
• Container Apps: restored revisions have no replicas until their first request (or a restart), even with minReplicas above 0.
• Container Apps: getAuthtoken, listCustomHostNameAnalysis, diagnostics, authConfigs, daprComponents, certificates, sourcecontrols, javaComponents and sessionPools are not modelled (the generic store keeps what is PUT); the operation status URL is locations/{loc}/operations/{id} rather than the service's containerappOperationStatuses path.
• Container Instances: interactive exec and attach need a websocket terminal session; both answer 501 NotImplemented.
• Container Instances: not supported and rejected with 400 InvalidRequestContent: Windows containers (no Windows container runtime), GPUs (the ACI GPU preview is retired as of 2025-07-14 per Learn resource-and-quota-limits), confidential/dedicated SKUs, spot priority, encryption, extensions, UDP ports, init container securityContext.
• Container Instances (unverified, no primary source found): the single-zone rule and the 1/2/3 zone values come from the ARM schema and memory of the zones article, which Learn no longer serves at the URL tried; dnsConfig requirements (at most 3 nameservers, no subnet needed) and the 400 text for subnet and probe validation are not confirmed; a group with zones accepts any location; init container restarts under Always/OnFailure retry forever instead of the platform's documented limits; Private addresses are still 127.0.0.1 and a delegated subnet is not reserved or checked for address space; diagnostics are stored but no logs are sent to Log Analytics; readiness gating drops connections rather than leaving them hanging; HTTP probes only reach loopback-published ports.
• Container Instances: azureFile volumes are copied from the Azure Files share when the containers start and written back when a container exits and when the group stops or is deleted, not synchronized live; the storage account key is accepted without being checked.
• Container Instances: the group address is 127.0.0.1 and ports are published on pool-assigned host ports (reported in a PortPublished event), not on the declared port numbers; Private addresses behave the same.
• Container Instances: restarting a failed container under Never is not done (the platform may restart it); the restart back-off starts at 10s and caps at 5 minutes. Resource requests are validated but only limits are enforced, and per-group CPU/memory maxima are not checked.
• Container Instances: sibling endpoints (locations/{loc}/usages, cachedImages, capabilities, the operations list, outboundNetworkDependenciesEndpoints, container group profiles) are not implemented; a restored snapshot brings groups back Stopped.
• Network: not modelled (they stay in the generic metadata-only store): application gateways, firewalls, VPN/ExpressRoute, private link services, route filters, DDoS plans, service endpoint policies, flow logs, virtual network taps and every other Microsoft.Network type.
• Network: load balancer, NAT gateway, prefix, ASG and private endpoint error codes are unverified recollections, not from a primary source (only the codes that already appear in Learn or the SDK, such as InvalidResourceReference and PublicIPAddressInUse, are known): PublicIPAndLBSkuDoNotMatch, LoadBalancingRuleFrontendPortConflict, InboundNatRuleFrontendPortConflict, InboundNatRuleInUse, InUseLoadBalancerChildCannotBeDeleted, NatGatewayHasTooManyPublicIps, NatGatewayPublicIpSkuMismatch, InUseNatGatewayCannotBeDeleted, InvalidPublicIpPrefixLength, PublicIPPrefixExhausted, PublicIPPrefixInUse, PublicIPPrefixSizeCannotBeChanged, PublicIPPrefixAddressSpaceExhausted, ApplicationSecurityGroupVirtualNetworkMismatch, InUseApplicationSecurityGroupCannotBeDeleted, PrivateEndpointGroupIdsInvalid, PrivateEndpointAndVnetLocationMismatch; PrivateEndpointCreationNotAllowedAsSubnetIsDelegated and LinkedInvalidPropertyId are recalled with more confidence. Default values for probes (interval 15, numberOfProbes 2, probeThreshold 1) and the Basic SKU default when sku is omitted are recalled.
• Network: load balancing is control plane only (no traffic distribution, probe execution, SNAT or health state); Basic SKU availability set / same-virtual-network membership rules, Gateway SKU tunnel interfaces and chaining, cross-region (Global tier) backend rules, frontend zones against public IP zones, NAT gateway zone and StandardV2 SKU (rejected), NAT gateway versus Basic public IP or Basic load balancer conflicts, IPv6 load balancer frontends and the privateEndpointNetworkPolicies NSG/UDR behaviour are not modelled or enforced.
• Network: private endpoints ignore cross-subscription authorization (a target in another subscription yields Pending), support static addresses only through ipConfigurations with groupId/memberName matching the group id, write A records for every customDnsConfig FQDN into every zone of a zone group without matching the zone name, allow more than one zone group per endpoint, do not turn a connection Disconnected when its target is deleted, and omit the Event Grid, Cosmos mongoClusters, Application Gateway, Private Link service and other private-link target types.
• Network: the deletion rule for a backend pool or NAT rule that NICs still use is lenient: the NIC references are dropped rather than refused, while rule references are refused.
• Network: IPv6 private addresses on NICs are rejected; IPv6 public addresses come from 2001:db8::/32. Subnet addressing with ipamPoolPrefixAllocations and NAT/gateway-subnet rules are not enforced (NICs report the virtualMachine and primary back-references of an attached Compute VM but never hostedWorkloads).
• Network: GET operations/{id} is stateless (every id reports Succeeded); there are no failed or in-progress long-running operations. Error codes other than InUse*, PublicIPAddressCannotBeDeleted and InvalidResourceReference are not verified against Microsoft Learn (AddressSpaceOverlap, VnetAddressSpacesOverlap, SecurityRule*, PrivateIPAddress*, SubnetIsFull, InUseSubnetCannotBeUpdated, DnsRecordInUse).
• Network: PUT of a virtual network without a subnets (or securityRules, routes) key keeps the stored children; an explicit empty array removes them. ARM replaces the set on any PUT.
• Private DNS: auto-registration of NIC addresses into linked zones, one-registration-link-per-vnet and overlapping-namespace conflicts, zone deletion rules, $top paging of record sets by recordSetNameSuffix, and Microsoft.Network/dnszones (public DNS) are not implemented.
• Compute: not modelled (they stay in the generic metadata-only store): proximity placement groups, capacity reservations, dedicated hosts, disk encryption sets and disk accesses, restore points, SSH public key resources, usages, the operations list, gallery sharing (share action, shared and community galleries, sharingProfile groups) and gallery applications.
• Compute: virtual machines do not run; unmanaged (vhd) disks, inline networkInterfaceConfigurations, Spot eviction, boot diagnostics, maintenance, capture, reimage, reapply, convertToManagedDisks, attachDetachDataDisks and simulateEviction answer 501 NotImplemented or are rejected. Platform images are not looked up (any publisher/offer/sku with a latest or Major.Minor.Build version is accepted and exactVersion is not reported); the vmSizes catalog is a representative subset available in every location and zone.
• Compute: disks accept Empty, FromImage, Copy and Upload; Import, ImportSecure, Restore and CopyStart are rejected, beginGetAccess/endGetAccess answer 501 (an Upload disk stays ReadyToUpload), and Ultra/Premium v2 IOPS limits, shared disks (maxShares), bursting, encryption sets and zone-versus-VM zone matching are stored but not enforced.
• Compute: Uniform scale set instances are state records, so their network interfaces are not created in Microsoft.Network and subnets referenced by a Uniform scale set can still be deleted. Rolling upgrades, autoscale, scale-in policy (Flexible removes the newest machines first), Uniform per-instance power actions and instance-level PUT/PATCH are not implemented.
• Compute extensions (unverified, recalled only): publisher, type and typeHandlerVersion are required on a VM extension (message text and 400 InvalidParameter are plausible), and a handler version is checked only for the catalog types (major version must exist); extension OS compatibility with the VM is not checked and handlers never execute, so instanceView only reports ProvisioningState/succeeded. protectedSettingsFromKeyVault is dropped like protectedSettings (whether the service echoes it is unverified). The extension image catalog lists only the documented types in rp_compute_ext.go with Major.Minor handler versions, handlerSchema is omitted.
• Compute run commands: virtual machines run no agent, so POST runCommand validates commandId (unknown or wrong OS answers 404 'The entity was not found in this Azure location', the documented text; the code ResourceNotFound is unverified), script, and power state, then answers 409 OperationNotAllowed 'VM agent status is NOT READY' (the condition is documented, the code is unverified). Managed runCommands are stored (protectedParameters and runAsPassword dropped, at most 25 per VM) and report instanceView.executionState Unknown; locations/{l}/runCommands lists the documented command ids with their documented descriptions but labels equal the id, and locations/{l}/runCommands/{commandId} answers 501.
• Compute images and galleries: replica counts have no upper bound (no primary source found), target region names are not checked against a region list and are stored lower-cased without spaces, ZRS availability per region, encryption sets, disk-image sources (blob and storage account sources are stored unchecked), gallery sharing, soft delete and the 100 galleries / 1000 definitions / 10000 versions per subscription and region limits are not enforced. Error codes for gallery messages quoted from learn.microsoft.com/azure/virtual-machines/troubleshooting-shared-images are unverified except PropertyChangeNotAllowed, and CannotDeleteResource, Conflict (duplicate identifier) and InvalidParameter are plausible. A managed image created from a virtual machine records osState from the generalize flag; whether the service refuses a running VM is unverified. VM creation does not check image and VM hyperVGeneration and checks managed image regions not at all.
• Compute Flexible scale sets: scale-set-created machines are named {scaleset}_{8 hex}, NICs {machine}-{nic config}, and default to deleting NICs and OS disks with the machine (Learn documents auto-removal and the deleteOption choice but not the names); instanceIds for batch actions and the scale set VM list use the machine name; publicIPAddressConfiguration is rejected 501, a changed virtualMachineProfile applies only to machines created afterwards, machines added by hand are not counted in sku.capacity, upgradePolicy, automatic repairs, priority mix, standby pools and rolling upgrades are stored but not enforced, and platformFaultDomain is validated but machines are not spread across fault domains.
• Compute: a virtual machine cannot be added to an availability set after creation (PropertyChangeNotAllowed) and an omitted availabilitySet, osProfile or storageProfile on update keeps the stored value. Network interfaces of a virtual machine in a removed resource group are released but a virtual machine whose NIC group is removed first keeps its dangling NIC reference.
• Identity: container group zones are still rejected; managed-identity role assignments and token endpoints (IMDS) do not exist, so a system-assigned principal has no permissions to evaluate.
• ManagedIdentity: listAssociatedResources, the identities/default scope and isolationScope are not implemented. Identity blocks (Compute, Web, Container Instances) resolve user-assigned identities by resource group and name, ignoring the subscription; deleting an identity that a resource still references is allowed and the reference then reports empty principalId/clientId.
• API Management: not modelled - the built-in all-access (master) subscription and the starter/unlimited products, users, groups, tags, loggers, diagnostics, certificates, caches, identity providers, authorization servers, gateways (self-hosted), portal, schemas, API revisions/releases/version sets, wikis, issues, tenant settings, backup/restore, soft-delete/restore, custom hostnames, virtual networks, multi-region, private endpoints, v2 tiers (BasicV2, StandardV2) and the Isolated sku; they fall to 404 or are rejected. $filter, $top, $skip and nextLink paging are not implemented on the child lists.
• API Management gateway: policies outside the subset (validate-jwt, quota, ip-filter, cache, choose, set-variable, send-request, authentication-, policy expressions, product-scope policies, on-error execution, rate-limit nested api/operation, forward-request http-version/continue-timeout/buffer-/fail-on-error-status-code, cors terminate-unmatched-request) are refused at PUT or not honoured; the backend section runs set-header/set-query-parameter/set-backend-service/forward-request in order and a chain with no forward-request answers an empty 200. The cors policy page gives two defaults for terminate-unmatched-request (false in the attribute table, true in the usage notes), so unmatched simple requests proceed without CORS headers. set-header on Connection, Content-Length, Keep-Alive and Transfer-Encoding is accepted but those headers are never forwarded (Learn: they cannot be changed).
• API Management gateway: WebSocket and GraphQL APIs are served as plain HTTP passthrough (ws/wss serviceUrl answers 500); HTTP (non-TLS) calls are impossible because the ARM listener is HTTPS, so an API whose protocols exclude https answers 404; the gateway has no client-certificate, IP or JWT checks; failed upstream calls answer 502 where the real gateway answers 500 (unverified); the unknown-host 404 body Resource not found and the 503 body of a service that is still activating are gopherstack wording, not documented.
• API Management (still unverified, no primary source found in azure-rest-api-specs 2022-08-01 examples, Learn, terraform-provider-azurerm or Azure/apiops): the error code strings of the 404 for missing children (ResourceNotFound here; the real service may use EntityNotFound), of the 409 for a taken service name, of the 409 for child writes during provisioning (apiops confirms 409 with code Conflict only for an in-progress API operation), of the 409 for a product delete with subscriptions and for exceeding a tier limit, and of the 400 for duplicate api path/operation/named-value; the maximum length of an operation method (20 here, spec gives none); template parameters being required to appear in the urlTemplate; the Activating/Updating durations (1s Consumption, 5s others here; real classic tiers take tens of minutes); the intermediate provisioningState seen by a GET between Created and Succeeded; publicIPAddresses (documented for Basic, Standard, Premium; real addresses cannot be invented, so it is omitted).
• API Management: no SDK-to-Terraform fixture yet (azurerm_api_management*); armapimanagement-driven tests are the only wire proof, and only the 2022-08-01 shapes were checked.
• Authorization: RBAC is not evaluated - role assignments and role definitions are stored, never consulted by ARM or any data plane (a Reader cannot be denied a write); there is no deny-assignment, PIM/eligibility/schedule, classic administrator, permissions-for-resource or provider-operations API, no management-group scope for locks, and management group scopes are accepted but never checked to exist.
• Authorization: principals are not validated against a directory (the emulator has no AAD user/group/service-principal store): any GUID principalId is accepted; only a non-GUID answers PrincipalNotFound (code and text from Learn). Managed identities of this emulator are recognised only to default principalType.
• Authorization (unverified, recalled only - no primary source found): the error codes InvalidRoleAssignmentId (non-GUID name), RoleAssignmentNotFound (GET of a missing assignment), RoleDefinitionDoesNotExist for GET (the text is documented, the 404 status is not), RoleAssignmentScopeNotAssignableToRoleDefinition, RoleDefinitionWithSameNameExists, RoleAssignmentExists and its text, LockNotFound, InvalidLockName, PolicyDefinitionNotFound, PolicySetDefinitionNotFound, PolicyAssignmentNotFound, InvalidPolicyRule, InvalidFilter and InvalidScope; the ScopeLocked text for a POST ('action') and the listing of several locked scopes; DELETE of a missing role assignment/lock/policy answering 204; assignedTo() semantics (modelled as at-or-above); the unfiltered list defaults (at and below).
• Authorization: ScopeLocked enforcement covers the ARM listener only (not data planes, as documented); it does not model the documented exceptions where services act on locked resources, resource moves, or Microsoft.Authorization extension resources other than the lock itself inheriting a lock (role assignments and policy assignments do inherit it).
• Authorization: role assignment conditions (ABAC) and conditionVersion are stored, not validated or evaluated; delegatedManagedIdentityResourceId is stored; assignment count limits are not enforced; the last-owner deletion guard does not exist; role definition assignableScopes are not checked to exist; list calls are not paged (no nextLink/$skipToken).
• Policy: nothing is evaluated - no Deny/Audit/Modify/DeployIfNotExists effect runs, compliance and remediation, exemptions, policy versions, tokens and the allowed-locations deny are not implemented; policy parameters are not checked against the definition (missing required parameter, wrong type); deleting a definition referenced by an assignment or set is allowed; policyDefinitions is limited to a 13-definition and 1-initiative built-in catalog; the Policy Insights, remediation and Guest Configuration providers do not exist.
• Authorization: azurerm_role_definition, subscription/management-group scoped policy assignments and policy set definitions have no Terraform fixture (test/terraform/azure/authorization_test.go covers azurerm_role_assignment by name and by id, azurerm_management_lock, azurerm_policy_definition, azurerm_resource_group_policy_assignment; applied, planned clean and destroyed against the docker harness on 2026-10-31, azurerm ~> 4.0).

Deferred

• M7 initial implementation. No prior audit passes to report.
• M9 added the Microsoft.ServiceBus RP (ServiceBusNamespaceCRUD/ServiceBusQueueTopicSubscriptionCRUD/ServiceBusAuthorizationRuleListKeys). QC pass over the pre-existing implementation found and fixed two real bugs before any Terraform run (List not filtering by resource group for queues/topics/subscriptions; DeleteResourcesInGroup's cascade delete never matching due to a double-pipe key-prefix bug) -- see AZURE.md section 10.10's M9 entry for full detail.
• M9's first real-CI run (PR #2466, terraform-tests (6) job on Linux, past the macOS TLS-trust gap) surfaced a third real bug: classifyServiceBusPath had no case for namespaces/{ns}/networkRuleSets/default, which terraform-provider-azurerm's namespace Read calls unconditionally on every namespace regardless of SKU or config -- see ops.ServiceBusNamespaceNetworkRuleSet above and AZURE.md section 10.10's M9 entry for full detail. Checked queue/topic/subscription/authorizationRule Read functions in the same pinned source for the same class of unconditional sub-resource probe; none exists (each Read function only calls its own client.Get).

More

• Full parity audit
• All services