docs(memory): record that Entra group member reads hide service principals #106

2026-08-28T11:34:07+01:00

lyrathorpe commented

2026-08-28 11:34:07 +01:00

Adds a reference memory for a Graph read that silently lies.

az ad group member list --group <id> and GET /groups/{id}/members both return an empty collection, with no error, for a group whose members are service principals. Today that produced a Bug against five *-cluster-admins groups across three tenants, claiming they had been emptied. All five held their deployment principals the whole time, and the Terraform plan reporting "No changes" had been correct.

The memory records the reads that do work — the microsoft.graph.servicePrincipal member cast, /members/$count, transitiveMemberOf, checkMemberGroups — and the rule to trust a plan over the az output.

Plus the one-line pointer in MEMORY.md. Needs a rebuild to take effect.

Adds a reference memory for a Graph read that silently lies. `az ad group member list --group <id>` and `GET /groups/{id}/members` both return an empty collection, with no error, for a group whose members are service principals. Today that produced a Bug against five `*-cluster-admins` groups across three tenants, claiming they had been emptied. All five held their deployment principals the whole time, and the Terraform plan reporting "No changes" had been correct. The memory records the reads that do work — the `microsoft.graph.servicePrincipal` member cast, `/members/$count`, `transitiveMemberOf`, `checkMemberGroups` — and the rule to trust a plan over the `az` output. Plus the one-line pointer in `MEMORY.md`. Needs a rebuild to take effect.

lyrathorpe added 1 commit 2026-08-28 11:34:07 +01:00

docs(memory): record that Entra group member reads hide service principals

CI / flake (push) Skipped

CI / flake (pull_request) Successful in 1m3s

Details

99fca0f746

az ad group member list and GET /groups/{id}/members return an empty
collection, without error, for groups whose members are service principals.
Records the reads that do work and the rule to trust a Terraform plan over
that output.

lyrathorpe merged commit 684d3f5a75 into main

2026-08-28 11:35:21 +01:00

lyrathorpe deleted branch docs/memory-entra-group-member-reads

2026-08-28 11:35:22 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lyrathorpe/nixfiles#106