Azure Active Directory - graphrbac.GroupsClient#List: Failure responding to request: StatusCode=403

Question

My service principal attempts to read a certain AD group using the following terraform code:

data "azuread_group" "hosting_ad_group" {
  name = local.hosting_ad_group_name
}

According to the documentation at https://www.terraform.io/docs/providers/azuread/d/group.html:

NOTE: If you're authenticating using a Service Principal then it must have permissions to Read directory data within the Windows Azure Active Directory API.

And indeed my SP has this permission:

Yet when I am running terraform apply as this SP I get the following:

Error: Error finding Azure AD Group with display name "AdminRole-Product-DFDevelopmentOps": Error listing Azure AD Groups for filter "displayName eq 'AdminRole-Product-DFDevelopmentOps'": graphrbac.GroupsClient#List: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2020-02-09T13:59:32","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"b4f52aca-7306-4d12-95c9-cf922ae59483"}}]

What am I missing?

EDIT 1

This is how I set the API permissions from terraform:

resource "azuread_application" "app" {
  name = local.ctx.HostingAppName

  # AAD Graph API   
  required_resource_access {
    resource_app_id = "00000002-0000-0000-c000-000000000000"

    # Sign in and read user profile
    resource_access {
      id   = "311a71cc-e848-46a1-bdf8-97ff7156d8e6"
      type = "Scope"
    }

    # Manage apps that this app creates or owns
    resource_access {
      id   = "824c81eb-e3f8-4ee6-8f6d-de7f50d565b7"
      type = "Role"
    }

    # Read directory data
    resource_access {
      id   = "5778995a-e1bf-45b8-affa-663a9f3f4d04"
      type = "Scope"
    }
  }
}

Answer 1

Please note that Application permissions are different from Delegated permissions. If you are using service principal to call the api, you should grant your application application permission.

Reference:

Types of permissions

Answer 2

Just add Api Permission "Azure Active Directory Graph" from Azure Active Directory-->App Registrations-->(Service Principal)-->Api Permissioins-->Add Permissions.

1. Application.ReadWrite.All

2. Directory.ReadWrite.All