🔷 Microsoft Graph Access Package Terraform Module

Manages the create/read/update/delete lifecycle of Microsoft Graph accessPackage records (identityGovernance/entitlementManagement/accessPackages) plus their resourceRoleScopes child collection, via msgraph_resource.this, targeting microsoft/msgraph 0.3.0.

• 🔗 Provisions an access package — the catalog item end users request through Entra entitlement management — via POST identityGovernance/entitlementManagement/accessPackages, then grants it resource access by rendering zero or more resourceRoleScopes children.
• 🧱 One keystone, one for_each child. msgraph_resource.this is the access package itself; msgraph_resource.resource_role_scopes, keyed by var.resource_role_scopes (a caller-chosen stable string, conventionally a resourceId_roleId composite per SCOPE.md), is the owned child collection.
• 🪚 This is the narrower "catalog item" module from a 3-way split of the original access-package catalog entry: catalog lifecycle belongs to terraform-msgraph-access-package-catalog; request/approval policy belongs to terraform-msgraph-access-package-assignment-policy. This module owns exactly the accessPackage entity and its resourceRoleScopes, nothing more.
• 🔒 catalog_id is required on create and immutable thereafter — Microsoft Learn's Update reference documents only displayName/description/isHidden as updatable; moving a package to a different catalog is not supported in place.
• ⚠️ resourceRoleScopes has no Graph Update method. Same shape of gap as terraform-msgraph-app-role-assignment: this module closes it with a terraform_data + lifecycle.replace_triggered_by pair, so a changed role/scope identifier under an existing map key is a clean plan-time replacement, not an apply-time Graph rejection.
• 🚧 Known gap, documented, not silently swallowed: onboarding a catalog resource (a group, application, or SharePoint site) so it has roles/scopes to reference in the first place — accessPackageResourceRequest — is explicitly out of scope. resource_role_scopes accepts already-known role/scope identifiers as plain strings, looked up out of band via catalogs/{id}/resourceRoles and catalogs/{id}/resources. See 🧠 Architecture Notes.

💡 Why it matters: an access package with no resourceRoleScopes is a real, valid Graph object — it can be created, described, and later referenced by an assignment policy — but it grants no actual resource access until at least one resourceRoleScopes entry exists. Splitting catalog lifecycle, package lifecycle, and policy lifecycle into three modules (per this suite's explicit convention against an oversized composite) means each piece can be planned, reviewed, and applied independently, at the cost of the caller needing to wire all three together deliberately — see the mandatory end-to-end composition in 📚 Example Library.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

terraform-msgraph-access-package-catalog has real, validated .tf files in this repository as of this module's authoring (confirmed by directory listing: main.tf, variables.tf, outputs.tf, providers.tf all present) — the upstream half of the composition shown below is a real, runnable reference, not an illustrative placeholder. terraform-msgraph-access-package-assignment-policy currently has only a providers.tf (confirmed by the same directory listing) — it is not yet authored as a consumable module; the downstream edge below reflects SCOPE.md's documented Emits contract, not a call you can make against a published module today.

flowchart LR
 Graph["Microsoft Graph<br/>Entra ID Governance tenant<br/>(POST/GET/PATCH/DELETE identityGovernance/entitlementManagement/accessPackages)"]:::external
 Catalog["terraform-msgraph-access-package-catalog<br/>(real, authored — upstream keystone)"]:::sibling
 AP["terraform-msgraph-access-package<br/>(this module)"]:::thisModule
 Policy["terraform-msgraph-access-package-assignment-policy<br/>(not yet authored — providers.tf only)"]:::sibling

 Catalog -->|"catalog.id reference"| AP
 AP -->|"manages accessPackage + resourceRoleScopes via"| Graph
 AP -->|"accessPackage.id reference"| Policy

 classDef thisModule fill:#0078D4,color:#ffffff,stroke:#005A9E,stroke-width:2px
 classDef sibling fill:#005A9E,color:#ffffff,stroke:#003D66,stroke-width:1px
 classDef external fill:#EDEDED,color:#333333,stroke:#B0B0B0,stroke-width:1px

(Validated via the Mermaid Chart MCP before embedding — valid: true.)

One keystone (msgraph_resource.this) plus one for_each child collection (msgraph_resource.resource_role_scopes). terraform_data.resource_role_scope_replace_trigger is a built-in, non-Graph helper resource that gives each map entry a clean plan-time replacement path (see 🧠 Architecture Notes).

flowchart TD
 subgraph Inputs["Module inputs"]
 V1["display_name, description,<br/>is_hidden"]:::neutral
 V2["catalog_id (GUID,<br/>REQUIRED, force-new)"]:::neutral
 V3["resource_role_scopes map<br/>(default {}), keyed by a stable<br/>resourceId_roleId composite"]:::neutral
 end

 This["msgraph_resource.this<br/>url = identityGovernance/entitlementManagement/accessPackages<br/>keystone"]:::thisModule

 TD["terraform_data.resource_role_scope_replace_trigger[each.key]<br/>input = each.value<br/>(built-in resource — forces replace on any field change)"]:::neutral

 RRS["msgraph_resource.resource_role_scopes[each.key]<br/>for_each = var.resource_role_scopes<br/>url = accessPackages/id/resourceRoleScopes<br/>body = role, scope"]:::child

 subgraph Outputs["Outputs"]
 O1["id (primary)"]:::neutral
 O2["display_name"]:::neutral
 O3["resource_role_scopes map"]:::neutral
 end

 V1 --> This
 V2 --> This
 This -->|"msgraph_resource.this.id"| RRS
 V3 -->|"for_each"| TD
 V3 -->|"for_each"| RRS
 TD -->|"lifecycle.replace_triggered_by"| RRS
 This --> O1
 This --> O2
 RRS --> O3

 classDef thisModule fill:#0078D4,color:#ffffff,stroke:#005A9E,stroke-width:2px
 classDef child fill:#005A9E,color:#ffffff,stroke:#003D66,stroke-width:1px
 classDef neutral fill:#EDEDED,color:#333333,stroke:#B0B0B0,stroke-width:1px

(Validated via the Mermaid Chart MCP before embedding — valid: true.)

Resource inventory

Schema notes that bite

• catalog is required on create and immutable thereafter. Microsoft Learn's "Update accessPackage" reference documents only displayName/description/isHidden as updatable properties — catalog is not in that list. Changing catalog_id after creation requires destroying and recreating the access package (and, transitively, its resourceRoleScopes children and any sibling access-package-assignment-policy referencing this package's id). Not mechanically enforced via a Terraform lifecycle block — the same established convention as terraform-msgraph-group's mailNickname — so an attempted change PATCHes through and fails at apply, not at plan.
• resourceRoleScopes has no Update method at all. Confirmed against a fresh Microsoft Learn pull of the live accessPackageResourceRoleScope resource-type reference (Methods table: List, Create, Delete only). This module forces a plan-time delete+recreate on any field change via terraform_data + lifecycle.replace_triggered_by — see 🧠 Architecture Notes.
• You cannot delete an access package that has any accessPackageAssignment. Confirmed verbatim against Microsoft Learn's "Delete accessPackage" reference: "You cannot delete an access package if it has any accessPackageAssignment." Remove all assignments (via an accessPackageAssignmentRequest, outside this module's scope) before a terraform destroy of this module can succeed. See 🔍 Troubleshooting.
• Graph's own computed id for a created resourceRoleScope record is "{role.id}_{scope.id}" — observed directly in Microsoft Learn's own Create examples (e.g. "cde82ecb-e461-496b-98fb-4f807c7ca640_dbeb8772-9907-4e95-a28e-a8d70dbcda69"). This is a different string from this module's for_each map key (a caller-chosen resourceId_roleId-style convention per SCOPE.md) — do not conflate the two. The Graph-computed id is only known after apply (surfaced via the resource_role_scopes output); the map key must be known at plan time and is therefore always caller-supplied.
• role_origin_system / scope_origin_system are not validated against a closed enum. Microsoft Learn documents common values ("such as" AadGroup, AadApplication, SharePointOnline, AzureResources, CustomDataProvidedResource") — its own wording, not a closed set — so no validation {}` restricts these to a fixed list, unlike this library's usual practice for genuinely closed Graph enums.

All operations require admin consent. Confirmed against the live "Create accessPackage," "Update accessPackage," "Delete accessPackage," and "Create resourceRoleScope" Microsoft Learn permission tables — all four agree exactly on EntitlementManagement.ReadWrite.All as the sole application permission.

• Graph API version: v1.0 — no beta dependency for either the keystone or the resourceRoleScopes child (confirmed the v1.0 nav path is resourceRoleScopes, not the beta-only accessPackageResourceRoleScopes path, which additionally covers more resource kinds).
• License/SKU: Microsoft Entra ID Governance (member users); some entitlement-management capabilities also operate under Entra ID P2 — confirm current SKU naming/bundling against Microsoft Learn before publishing, since bundling changes.
• Admin consent: required for EntitlementManagement.ReadWrite.All.

terraform-msgraph-access-package/
├── providers.tf # required_version >= 1.12.0; microsoft/msgraph pinned exactly at 0.3.0;
│ # no provider {} block; terraform_data needs no provider entry at all
├── variables.tf # display_name, description, is_hidden, catalog_id, resource_role_scopes
├── main.tf # msgraph_resource.this + terraform_data + msgraph_resource.resource_role_scopes
├── outputs.tf # id (primary), display_name, resource_role_scopes
├── README.md # this file
├── SCOPE.md # this module's design record — permissions, prerequisites, provider gotchas
└── examples/
 └── basic/
 └── main.tf # smallest real call — display_name + catalog_id only

terraform {
  required_version = ">= 1.12.0"

  required_providers {
    msgraph = {
      source  = "microsoft/msgraph"
      version = "0.3.0"
    }
  }
}

# Auth, tenant, and API version are configured here, by the caller — never inside this module.
provider "msgraph" {}

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  description  = "Access package for outside sales representatives"
  catalog_id   = module.sales_catalog.id # a terraform-msgraph-access-package-catalog module's id output
}

output "access_package_id" {
  value = module.sales_access_package.id
}

Consumes

Emits

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = "66584aae-98bb-48cc-9458-7bee5d2a6577"
}

module "finance_access_package_staging" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Finance Approvers"
  description  = "Staged — not yet visible to requestors while resourceRoleScopes are wired up"
  catalog_id   = module.finance_catalog.id
  is_hidden    = true
}

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = module.sales_catalog.id

  resource_role_scopes = {
    "9028d19c-26a9-4809-8e3f-20ff73e2d75e_member" = {
      role_origin_id      = "9028d19c-26a9-4809-8e3f-20ff73e2d75e" # the group's own object id
      role_origin_system  = "AadGroup"
      scope_origin_id     = "9028d19c-26a9-4809-8e3f-20ff73e2d75e"
      scope_origin_system = "AadGroup"
      scope_is_root_scope = true
    }
  }
}

module "internal_tools_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Internal Tools Standard User"
  catalog_id   = module.internal_tools_catalog.id

  resource_role_scopes = {
    "5f80c0c7-a180-4521-b585-18200048a0d8_cde82ecb-e461-496b-98fb-4f807c7ca640" = {
      role_id = "cde82ecb-e461-496b-98fb-4f807c7ca640" # accessPackageResourceRole.id, from
      # listing catalogs/{id}/resourceRoles
      role_origin_id      = "a29a7690-b3c4-4ed5-96c6-f640cde06fb8"
      role_origin_system  = "AadApplication"
      role_resource_id    = "5f80c0c7-a180-4521-b585-18200048a0d8" # the onboarded accessPackageResource's id
      scope_id            = "dbeb8772-9907-4e95-a28e-a8d70dbcda69"
      scope_origin_id     = "e81d7f57-0840-45e1-894b-f505c1bdcc1f"
      scope_origin_system = "AadApplication"
    }
  }
}

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = module.sales_catalog.id

  resource_role_scopes = {
    "sales-group_member" = {
      role_origin_id      = module.sales_group.id
      role_origin_system  = "AadGroup"
      scope_origin_id     = module.sales_group.id
      scope_origin_system = "AadGroup"
      scope_is_root_scope = true
    }
    "crm-app_standard-user" = {
      role_id             = local.crm_standard_user_role_id
      role_origin_id      = local.crm_app_id
      role_origin_system  = "AadApplication"
      role_resource_id    = local.crm_app_resource_id
      scope_id            = local.crm_app_scope_id
      scope_origin_id     = local.crm_app_id
      scope_origin_system = "AadApplication"
    }
  }
}

module "internal_tools_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Internal Tools Standard User"
  catalog_id   = module.internal_tools_catalog.id

  resource_role_scopes = {
    "resource-abc_zero-role" = {
      # role_id deliberately omitted (left null) — Microsoft Learn: "If the role returned from the list
      # of the roles has a zero ID, then don't include an id in the accessPackageResourceRole."
      role_origin_id      = local.resource_origin_id
      role_origin_system  = "SharePointOnline"
      scope_origin_id     = local.resource_origin_id
      scope_origin_system = "SharePointOnline"
      scope_is_root_scope = true
    }
  }
}

# Before:
module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Reps"
  catalog_id   = module.sales_catalog.id
}

# After:
module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"         # changed — clean in-place update
  description  = "Outside sales representatives" # added — clean in-place update
  catalog_id   = module.sales_catalog.id         # unchanged
}

# Before:
module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = module.sales_catalog.id
}

# After — moving the package to a different catalog:
module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = module.regional_sales_catalog.id # changed
}

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = module.sales_catalog.id

  # resource_role_scopes left at its default, {} — creates the access package with no resource access
  # granted yet.
}

module "bad_example" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Broken Package"
  catalog_id   = "66584aae-98bb-48cc-9458-7bee5d2a6577"

  resource_role_scopes = {
    "bad-entry" = {
      role_origin_id      = "" # fails the non-empty-string validation{} block
      role_origin_system  = "AadGroup"
      scope_origin_id     = "9028d19c-26a9-4809-8e3f-20ff73e2d75e"
      scope_origin_system = "AadGroup"
    }
  }
}

# Root module — provider auth configured with exactly what this module needs: EntitlementManagement.ReadWrite.All,
# ideally scoped down further via the Access package manager or Catalog owner Entra role rather than the
# broader Identity Governance Administrator role.
provider "msgraph" {}

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = module.sales_catalog.id
}

# Before:
resource_role_scopes = {
 "contractor-access" = {
 role_origin_id = local.old_group_id
 role_origin_system = "AadGroup"
 scope_origin_id = local.old_group_id
 scope_origin_system = "AadGroup"
 scope_is_root_scope = true
 }
}

# After — repointing the same conceptual grant at a different onboarded group:
resource_role_scopes = {
 "contractor-access" = {
 role_origin_id = local.new_group_id # changed
 role_origin_system = "AadGroup"
 scope_origin_id = local.new_group_id # changed
 scope_origin_system = "AadGroup"
 scope_is_root_scope = true
 }
}

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  catalog_id   = module.sales_catalog.id

  resource_role_scopes = {
    "sales-group_member" = {
      role_origin_id      = module.sales_group.id
      role_origin_system  = "AadGroup"
      scope_origin_id     = module.sales_group.id
      scope_origin_system = "AadGroup"
      scope_is_root_scope = true
    }
  }
}

output "sales_access_package_report" {
  value = {
    package_id           = module.sales_access_package.id
    display_name         = module.sales_access_package.display_name
    resource_role_scopes = module.sales_access_package.resource_role_scopes
  }
}

module "sales_catalog" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package-catalog.git?ref=v1.0.0"

  display_name = "Sales Resources"
  state        = "published"
}

module "sales_access_package" {
  source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

  display_name = "Sales Representatives"
  description  = "Outside sales representatives"
  catalog_id   = module.sales_catalog.id

  resource_role_scopes = {
    "sales-group_member" = {
      role_origin_id      = module.sales_group.id # a terraform-msgraph-group module's id, onboarded into
      role_origin_system  = "AadGroup"            # the catalog as an accessPackageResource out of band
      scope_origin_id     = module.sales_group.id
      scope_origin_system = "AadGroup"
      scope_is_root_scope = true
    }
  }
}

# Illustrative only — terraform-msgraph-access-package-assignment-policy is a planned catalog entry, not
# yet authored. Chaining a request/approval policy after the access package is MANDATORY in real usage
# — a package with no assignment policy can never actually be requested by an end user.
# module "sales_access_package_default_policy" {
# source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package-assignment-policy.git?ref=v1.0.0"
#
# access_package_id = module.sales_access_package.id
# display_name = "Standard sales rep request policy"
# #... requestor/approval/review settings...
# }

Grouped summary

No output is ever derived from a credential-bearing property — this entity carries none.

• Why terraform_data + lifecycle.replace_triggered_by exists — the one thing to understand before touching main.tf. Graph never implemented an Update method for accessPackageResourceRoleScope (confirmed against the live resource-type reference's Methods table: List, Create, Delete only). Left alone, a drifted field under an unchanged map key would make the provider attempt an apply-time PATCH Graph rejects. terraform_data.resource_role_scope_replace_trigger[each.key].input is the whole map entry, so any change to it replaces that terraform_data instance, and replace_triggered_by propagates the replacement to the corresponding msgraph_resource.resource_role_scopes instance — exactly the same mechanism terraform-msgraph-app-role-assignment uses for the same category of gap.
• catalog_id is force-new but not mechanically enforced. msgraph_resource's generic body has no per-property schema for Terraform to key a forced replacement off of — the same situation as terraform-msgraph-group's mailNickname. An attempted change PATCHes through to Graph and fails there (an apply-time 400), not at plan time. This is documented, not silently swallowed — see Example 8 and 🔍 Troubleshooting.
• THE DOCUMENTED OBJECT-GRAPH GAP: catalog-resource onboarding is not covered by any module in this catalog yet. Populating resource_role_scopes requires the referenced accessPackageResource (a group, application, or SharePoint site) to already be onboarded into the same catalog as this access package — a separate accessPackageResourceRequest, and the specific role/scope pair retrieved from catalogs/{id}/resourceRoles and catalogs/{id}/resources first. This module deliberately does not build any of that — it accepts already-known role/scope identifiers as plain string inputs only. A future access-package-resource module would be the right place to own catalog-resource onboarding; folding it into this module would force an oversized composite per this suite's explicit convention against that. Until that module exists, every caller of this module must look up role_origin_id/role_origin_system/scope_origin_id/scope_origin_system (and, where applicable, role_id/scope_id/role_resource_id) out of band — via Graph Explorer, PowerShell, or a portal lookup — before populating resource_role_scopes.
• You cannot delete an access package that has any accessPackageAssignment. This is a real, documented hard constraint (Microsoft Learn's "Delete accessPackage" reference), not a Terraform or provider limitation — terraform destroy on this module will fail against Graph if any user currently holds an assignment to this package. See 🔍 Troubleshooting for the remediation path.
• for_each key stability. SCOPE.md's Design decisions direct a resourceId_roleId composite naming convention for resource_role_scopes map keys. This is a naming convention only, not enforced by Terraform — note that Graph's own computed id for the created record is actually "{role.id}_{scope.id}" (confirmed from live Microsoft Learn examples), a related but distinct string from the caller-chosen map key, since the map key must be known at plan time and role/scope ids are frequently not (see Example 6's zero-ID role case).

terraform init -backend=false
terraform validate
terraform fmt -check

Pin every real consumption of this module to an explicit tag, never a branch:

source = "git::https://github.com/microsoftexpert/terraform-msgraph-access-package.git?ref=v1.0.0"

terraform validate and terraform fmt -check prove the offline contract: display_name is non-empty, catalog_id matches a GUID shape, and every resource_role_scopes entry has non-empty role_origin_id/role_origin_system/scope_origin_id/scope_origin_system before any Graph call is made — a malformed entry fails plan, never silently reaches apply.

What this cannot catch: msgraph_resource.this and msgraph_resource.resource_role_scopes's body arguments are generic maps from the provider's own perspective — the provider does not know what an accessPackage or accessPackageResourceRoleScope is. Concretely, in this module:

• A syntactically valid GUID catalog_id that does not correspond to a real, existing catalog passes validate/plan cleanly and fails only at apply, with a Graph-side 400 or 404.
• A resource_role_scopes entry whose role_origin_id/scope_origin_id do not correspond to an actually-onboarded accessPackageResource in the same catalog cannot be checked at plan time — it requires a live read of catalogs/{id}/resources and catalogs/{id}/resourceRoles, which this module deliberately does not perform (see 🧠 Architecture Notes' documented object-graph gap).
• An attempted change to catalog_id on an existing access package is shown by plan as an in-place update (this module does not force a Terraform-level replacement on it) but fails at apply with a Graph 400, since catalog is not in Graph's documented Update property list (see Example 8).
• terraform destroy against an access package that still has any accessPackageAssignment fails at apply with a Graph error — this cannot be predicted at plan time, since it depends on live assignment state this module does not read.

This module's non-empty-string and GUID-shape validation {} blocks are the only thing standing between the caller and a Graph 4xx error at apply time for anything beyond shape-level mistakes.

$ terraform output
id = "642181f0-bc17-4fc6-9ebb-ff53dbf18c2f"
display_name = "Sales Representatives"
resource_role_scopes = {
 "sales-group_member" = "cde82ecb-e461-496b-98fb-4f807c7ca640_dbeb8772-9907-4e95-a28e-a8d70dbcda69"
}

• Graph API reference — accessPackage resource type: https://learn.microsoft.com/graph/api/resources/accesspackage?view=graph-rest-1.0
• Graph API reference — create accessPackage: https://learn.microsoft.com/graph/api/entitlementmanagement-post-accesspackages?view=graph-rest-1.0
• Graph API reference — update accessPackage: https://learn.microsoft.com/graph/api/accesspackage-update?view=graph-rest-1.0
• Graph API reference — delete accessPackage: https://learn.microsoft.com/graph/api/accesspackage-delete?view=graph-rest-1.0
• Graph API reference — accessPackageResourceRoleScope resource type: https://learn.microsoft.com/graph/api/resources/accesspackageresourcerolescope?view=graph-rest-1.0
• Graph API reference — create resourceRoleScope: https://learn.microsoft.com/graph/api/accesspackage-post-resourcerolescopes?view=graph-rest-1.0
• Provider docs — microsoft/msgraph 0.3.0 msgraph_resource: https://registry.terraform.io/providers/microsoft/msgraph/0.3.0/docs/resources/resource
• Terraform language reference — the lifecycle meta-argument (replace_triggered_by, terraform_data): https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle
• Sibling modules — terraform-msgraph-access-package-catalog (real, authored), terraform-msgraph-access-package-assignment-policy (not yet authored)
• This module's design record — SCOPE.md