chore(deps): bump the terraform-providers group across 2 directories with 5 updates

[dependabot]

Bumps the terraform-providers group with 5 updates in the /infra directory:

Package	From	To
azure/avm-res-storage-storageaccount/azurerm	0.7.3	0.10.0
azure/azapi	2.10.0	2.12.0
hashicorp/azurerm	4.79.0	5.4.0
hashicorp/time	0.14.0	0.14.1
microsoft/power-platform	4.1.0	4.2.0
azure/azapi	2.10.0	2.12.0
hashicorp/azurerm	4.79.0	5.4.0
microsoft/power-platform	4.1.0	4.2.0

Bumps the terraform-providers group with 3 updates in the /infra/modules/copilot_studio directory: azure/azapi, hashicorp/azurerm and microsoft/power-platform.

Updates azure/avm-res-storage-storageaccount/azurerm from 0.7.3 to 0.10.0

Release notes

Sourced from azure/avm-res-storage-storageaccount/azurerm's releases.

v0.10.0

Upgrade notes

Breaking: the fqdn output is now unknown until apply.

Hostnames previously came from string concatenation with a hardcoded core.windows.net, so sovereign clouds got names that do not resolve. An account in Azure US Government reported mysa.blob.core.windows.net while Azure had provisioned mysa.blob.core.usgovcloudapi.net.

The output now reads properties.primaryEndpoints from the account, so it carries the correct DNS suffix for the target cloud. Because the value comes from an API response, it is no longer known at plan time.

Action required only if you use fqdn in a for_each, count, or provider argument. Move that value to a static input or use -target on the first apply. The shape is unchanged: hostnames without scheme or trailing slash, keyed by declared sub-resources.

Also in this release

• private_endpoints now matches the AVM interface. Three optional attributes were added: role_assignments.name, lock.notes, and ip_configurations.member_name. subresource_name is typed optional, with a validation rule that keeps it required.
• Containers and the static website submodule now apply after the blob service. Both wrote blobServices/default concurrently, and the later write dropped the earlier one's fields.
• immutable_storage_with_versioning cannot be combined with blob_properties.restore_policy. This is now documented.

What's Changed

Bug Fixes

• fix: derive fqdn suffix from returned storage endpoints by @​myaschmitz in Azure/terraform-azurerm-avm-res-storage-storageaccount#399

Other Changes

• fix: order containers after blob service (#392) by @​myaschmitz in Azure/terraform-azurerm-avm-res-storage-storageaccount#395
• fix: order static website after blob service by @​myaschmitz in Azure/terraform-azurerm-avm-res-storage-storageaccount#397

Full Changelog: Azure/terraform-azurerm-avm-res-storage-storageaccount@v0.9.0...v0.10.0

v0.9.0

Upgrade notes

AzAPI 2.11.0 is now the minimum. If your root module pins AzAPI below 2.11 — for example ~> 2.9 — raise the constraint and run terraform init -upgrade to refresh your lock file before applying. The AzAPI provider version section of the README has the exact block.

The default storage account API version moved from 2025-06-01 to 2025-08-01. You will see this in your next plan. It is an in-place change — the type attribute on azapi_resource does not force replacement, so your storage account is not recreated. If you pin resource_types.storage_account yourself, your pin still wins and nothing changes.

New: Smart access tier. access_tier = "Smart" hands block blob tiering to Azure instead of you managing Hot/Cool/Cold. It requires a StorageV2 account on Standard_ZRS, Standard_GZRS, or Standard_RAGZRS, plus Storage API 2025-08-01 or newer — the module validates all three at plan time and fails with a clear message rather than erroring mid-apply. Smart only governs block blobs that inherit the account default; page blobs, append blobs, and explicitly tiered blobs are unaffected. Existing accounts are untouched — the default is still Hot. Thanks to @​BurgerCaptain for the contribution. (#361)

What's Changed

• chore: run avm pre-commit [skip ci] by @​azure-verified-modules[bot] in Azure/terraform-azurerm-avm-res-storage-storageaccount#393
• feat: add Smart access tier support by @​BurgerCaptain in Azure/terraform-azurerm-avm-res-storage-storageaccount#361 (merged via #394)

Full Changelog: Azure/terraform-azurerm-avm-res-storage-storageaccount@v0.8.1...v0.9.0

v0.8.1

Upgrade notes

Patch release — no configuration changes required.

Static website hosting is now actually applied. Before this release the module patched the blob service with an API version whose schema omits properties.staticWebsite, so the request succeeded while the setting was silently discarded — producing a plan diff that could never converge. If you use static_website, expect your next apply to make a real change to the storage account rather than a no-op. (#363)

... (truncated)

Commits

• 5695e5e chore: run avm pre-commit [skip ci]
• bfbf9f1 chore: run avm pre-commit [skip ci]
• a602e18 chore: run avm pre-commit [skip ci]
• 9dae633 fix: derive fqdn suffix from returned storage endpoints (#399)
• e584a8e chore: run avm pre-commit [skip ci]
• 0862d40 fix: order static website after blob service (#397)
• ba0dd25 fix: order containers after blob service (#392) (#395)
• 9cd53ea feat: add Smart access tier support (#361) (#394)
• f3c3ded chore: run avm pre-commit [skip ci]
• 0acd943 docs: note Key Vault RBAC ordering for customer-managed keys (#391)
• Additional commits viewable in compare view

Updates azure/azapi from 2.10.0 to 2.12.0

Release notes

Sourced from azure/azapi's releases.

v2.12.0

ENHANCEMENTS:

• azapi provider: Support preserve_resource_id_casing feature flag (default false). When enabled, if the resource ID the provider would write back to state differs from the existing state value only by casing, the existing casing is preserved. This avoids spurious Unexpected Identity Change errors and diffs when consumers (or upstream modules) rely on a specific casing the Azure API may not preserve. Only the id and resource_id attributes are affected. Can also be sourced from the ARM_PRESERVE_RESOURCE_ID_CASING environment variable (GH-1122).
• azapi provider: Publish official windows_arm64 provider binaries (GH-1148).
• azapi_resource resource: Re-introduce the ignore_body_changes property to ignore changes to specified fields in the request body (GH-1192).
• azapi_data_plane_resource resource: Allow name to be optional based on the URL format (GH-1178).
• azapi_data_plane_resource resource: Support Key Vault certificates (GH-1174).

BUG FIXES:

• Strip UTF-8 BOM prefix from JSON responses (GH-1190).
• Preserve azapi_resource state for an in-flight Create interrupted by SIGINT (GH-1183).
• Fix MoveState target identity for azurerm resource moves (GH-1175).
• Fix OIDC token file path logic (GH-1164).

v2.11.0

ENHANCEMENTS:

• azapi_resource_action resource: Support sensitive body for resource actions (GH-1150).
• azapi_resource: Import now falls back to up to three most recent indexed API versions when a 400 or 404 response is returned without an explicit api-version (GH-1093).
• azapi provider: Support PFX modern encryption for client certificate authentication (GH-1151).
• azapi client: Return the last retryable error instead of context deadline exceeded when retries fail (GH-1079).
• Acquire a policy token when a request is blocked by an invoke policy (GH-1145).
• Update bicep types to Azure/azure-rest-api-specs revision 51d53915b5f31b10e6645c136807b9d95f9f09d1 (GH-1159).
• Improve the bicep types update process (GH-1155).

BUG FIXES:

• Fix Missing Resource Identity After Read after upgrading from v2.7.0 when a resource is deleted outside Terraform (GH-1050).
• Fix azapi_resource_action output handling when updating existing actions (GH-1158).
• Fix azapi_resource_action output being set incorrectly while the action is executing (GH-1168).
• Fix ResourceClient CreateOrUpdate to return the initial PUT body correctly (GH-1160).

Changelog

Sourced from azure/azapi's changelog.

v2.12.0

ENHANCEMENTS:

• azapi provider: Support preserve_resource_id_casing feature flag (default false). When enabled, if the resource ID the provider would write back to state differs from the existing state value only by casing, the existing casing is preserved. This avoids spurious Unexpected Identity Change errors and diffs when consumers (or upstream modules) rely on a specific casing the Azure API may not preserve. Only the id and resource_id attributes are affected. Can also be sourced from the ARM_PRESERVE_RESOURCE_ID_CASING environment variable (GH-1122).
• azapi provider: Publish official windows_arm64 provider binaries (GH-1148).
• azapi_resource resource: Re-introduce the ignore_body_changes property to ignore changes to specified fields in the request body (GH-1192).
• azapi_data_plane_resource resource: Allow name to be optional based on the URL format (GH-1178).
• azapi_data_plane_resource resource: Support Key Vault certificates (GH-1174).

BUG FIXES:

• Strip UTF-8 BOM prefix from JSON responses (GH-1190).
• Preserve azapi_resource state for an in-flight Create interrupted by SIGINT (GH-1183).
• Fix MoveState target identity for azurerm resource moves (GH-1175).
• Fix OIDC token file path logic (GH-1164).

v2.11.0

ENHANCEMENTS:

• azapi_resource_action resource: Support sensitive body for resource actions (GH-1150).
• azapi_resource: Import now falls back to up to three most recent indexed API versions when a 400 or 404 response is returned without an explicit api-version (GH-1093).
• azapi provider: Support PFX modern encryption for client certificate authentication (GH-1151).
• azapi client: Return the last retryable error instead of context deadline exceeded when retries fail (GH-1079).
• Acquire a policy token when a request is blocked by an invoke policy (GH-1145).
• Update bicep types to Azure/azure-rest-api-specs revision 51d53915b5f31b10e6645c136807b9d95f9f09d1 (GH-1159).
• Improve the bicep types update process (GH-1155).

BUG FIXES:

• Fix Missing Resource Identity After Read after upgrading from v2.7.0 when a resource is deleted outside Terraform (GH-1050).
• Fix azapi_resource_action output handling when updating existing actions (GH-1158).
• Fix azapi_resource_action output being set incorrectly while the action is executing (GH-1168).
• Fix ResourceClient CreateOrUpdate to return the initial PUT body correctly (GH-1160).

Commits

• 52241c9 Update bicep types to Azure/azure-rest-api-specs revision 0744f52a86919d243ba...
• c080464 Update changelog for 2.12 release (#1195)
• 7d923f6 Add preserve_resource_id_casing provider feature flag (#1122)
• e774e61 azapi_resource: re-introduce ignore_body_changes property (#1192)
• b057c50 Strip UTF-8 BOM prefix from JSON responses (#1190)
• d8f3a4d Bump github.com/hashicorp/terraform-plugin-log from 0.10.0 to 0.11.0 in the g...
• 9cdbd49 Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 in the gomod-dependenc...
• 5229b84 chore: Cleanup acquire policy token test suppression (#1186)
• 4fae1b3 Preserve azapi_resource state for in-flight Create interrupted by SIGINT (#1183)
• 4201949 Use test data location in preflight child resource acctest (#1181)
• Additional commits viewable in compare view

Updates hashicorp/azurerm from 4.79.0 to 5.4.0

Release notes

Sourced from hashicorp/azurerm's releases.

v5.4.0

5.4.0 (September 03, 2026)

FEATURES:

• New List Resource: azurerm_application_insights_standard_web_test (#33243)
• New List Resource: azurerm_application_insights_workbook_template (#33245)
• New List Resource: azurerm_arc_kubernetes_provisioned_cluster (#33247)
• New List Resource: azurerm_availability_set (#33241)
• New List Resource: azurerm_batch_application (#33254)
• New List Resource: azurerm_dedicated_host_group (#33257)
• New List Resource: azurerm_log_analytics_workspace (#33259)

ENHANCEMENTS:

• dependencies: azurerm_mongo_cluster - update API version to 2026-06-01 (#33195)
• dependencies: azurerm_mongo_cluster_firewall_rule - update API version to 2026-06-01 (#33195)
• dependencies: azurerm_mongo_cluster_user - update API version to 2026-06-01 (#33195)
• dependencies: netapp - update API version to 2026-05-01 (#33215)
• Data Source: azurerm_api_management_workspace - export the description property (#33205)
• Data Source: azurerm_attestation_provider - export the sev_snp_policy_base64, open_enclave_policy_base64, sgx_enclave_policy_base64, and tpm_policy_base64 properties (#33125)
• Data Source: azurerm_automation_account - export the dsc_primary_access_key, dsc_server_endpoint, dsc_secondary_access_key, public_network_access_enabled, sku_name, and tags properties (#33135)
• Data Source: azurerm_automation_account - export the encryption block (#33135)
• Data Source: azurerm_ip_group - export the firewall_ids and firewall_policy_ids properties (#33190)
• Data Source: azurerm_private_link_service - export the fqdns and destination_ip_address properties (#33191)
• azurerm_key_vault_managed_hardware_security_module_key - allow the key_size property to be set when key_type is oct-HSM (#32690)
• azurerm_lb_probe - add support for the no_healthy_backends_behavior property (#32645)
• azurerm_linux_virtual_machine_scale_set - add support for the NvmeDisk value to the os_disk.diff_disk_settings.placement property (#30328)
• azurerm_linux_web_app - add support for the 8.5 value in the site_config.application_stack.php_version property (#33308)
• azurerm_linux_web_app_slot - add support for the 8.5 value in the site_config.application_stack.php_version property (#33308)
• azurerm_netapp_volume - support for the breakthrough_mode_enabled property (#33215)
• azurerm_postgresql_flexible_server - add support for the storage_type, storage_iops, and storage_throughput properties which allows choice of the new "Premium V2 LRS" storage type (#32121)
• azurerm_storage_account - add support for an in-place migration of account_replication_type between matching non-zonal and zonal types instead of resource recreation (#33236)
• azurerm_storage_table - add support for AAD authentication (#32997)
• azurerm_synapse_spark_pool - migrate to go-azure-sdk (#33258)
• azurerm_windows_virtual_machine_scale_set - add support for the NvmeDisk value to the os_disk.diff_disk_settings.placement property (#30328)

BUG FIXES:

• azurerm_synapse_spark_pool - fix lifecycle.ignore_changes support (#33258)

v5.3.0

5.3.0 (August 27, 2026)

FEATURES:

• New Data Source: azurerm_playwright_workspace (#31954)
• New List Resource: azurerm_cognitive_deployment (#33149)
• New List Resource: azurerm_playwright_workspace (#31954)
• New Resource: azurerm_playwright_workspace (#31954)

... (truncated)

Changelog

Sourced from hashicorp/azurerm's changelog.

4.81.0 (July 14, 2026)

FEATURES:

• New Data Source: azurerm_cdn_frontdoor_batch_rule_set (#32733)
• New List Resource: azurerm_backup_policy_vm (#32736)
• New List Resource: azurerm_cdn_frontdoor_batch_rule_set (#32733)
• New List Resource: azurerm_cognitive_account_connection_account_key (#30981)
• New List Resource: azurerm_cognitive_account_connection_account_managed_identity (#30981)
• New List Resource: azurerm_cognitive_account_connection_api_key ((#30981)
• New List Resource: azurerm_cognitive_account_connection_custom_keys (#30981)
• New List Resource: azurerm_cognitive_account_connection_entra_id (#30981)
• New List Resource: azurerm_federated_identity_credential (#32672)
• New List Resource: azurerm_monitor_scheduled_query_rules_alert (#32701)
• New List Resource: azurerm_servicebus_customer_managed_identity (#32315)
• New List Resource: azurerm_web_pubsub_custom_certificate (#32192)
• New Resource: azurerm_cdn_frontdoor_batch_rule_set (#32733)
• New Resource: azurerm_cognitive_account_connection_account_key (#30981)
• New Resource: azurerm_cognitive_account_connection_account_managed_identity (#30981)
• New Resource: azurerm_cognitive_account_connection_api_key ((#30981)
• New Resource: azurerm_cognitive_account_connection_custom_keys (#30981)
• New Resource: azurerm_cognitive_account_connection_entra_id (#30981)
• New Resource: azurerm_log_analytics_workspace_table_microsoft (#31754)
• azurerm_servicebus_subscription - added new provider feature flag that will remove the "$Default" rule immediately on new subscription creation (#32452)
• New Resource: azurerm_storage_account_table_properties (#32282)

ENHANCEMENTS:

• dependencies: go - update to 1.26.5
• dependencies: x/crypto - update to v0.54.0
• dependencies: cdn - update to API version 2025-12-01 (#32719)
• dependencies: compute - update to API version 2025-04-01 (#32592)
• dependencies: go-azure-helpers - update to v0.81.1 (#32732)
• dependencies: go-azure-sdk - update to v0.20260709.1191450 (#32768)
• dependencies: keyvault - update to API version 2026-02-01 (#32320)
• Data Source: azurerm_logic_app_standard - add new return attribute storage_key_vault_secret_id which will be set if the app service "AzureWebJobsStorage" property had a KeyVault reference format (#32571)
• azurerm_cdn_frontdoor_endpoint - migrate to go-azure-sdk (#32741)
• azurerm_container_registry Add support for azuread_authentication_as_arm_policy_enabled, role_assignment_mode and network_rule_bypass_allowed_for_tasks properties (#31667)
• azurerm_logic_app_standard - add attribute storage_key_vault_secret_id which can be used in place of storage_account_name and storage_account_key, allowing the app service property "AzureWebJobsStorage" to reference a key vault secret in the format "@​Microsoft.KeyVault(SecretUri=...)" (#32571)
• azurerm_orchestrated_virtual_machine_scale_set - support for the tags property within the network_interface block (#32592)

BUG FIXES:

• azurerm_cdn_frontdoor_custom_domain - fix a validation regression that prevented previously valid wildcard inputs to the host_name property (#32738)
• azurerm_network_security_perimeter_association - fix create/update methods to poll for async operation completion before returning (#32742)
• azurerm_palo_alto_next_generation_firewall_virtual_hub_strata_cloud_manager - fix an issue that set arguments not present in schema causing an error (#32768)
• azurerm_palo_alto_next_generation_firewall_virtual_network_strata_cloud_manager - fix an issue that set arguments not present in schema causing an error (#32768)
• azurerm_virtual_hub_connection - remote_virtual_network_id value will now be parsed case insensitive (#32734)

4.80.0 (July 02, 2026)

... (truncated)

Commits

• c059718 CHANGELOG.md for 5.4.0 (#33273)
• 94caddd dependencies: golang.org/x/crypto to v0.56.0 (#33314)
• f3dd9e2 batch_application - add List Resource support (#33254)
• 9ca6c76 log_analytics_workspace - add List Resource support (#33259)
• 9ab7e22 azurerm_linux_web_app, linux_web_app_slot - add PHP 8.5 to appstack (#33...
• e555ab3 linters - AZR008 - returning empty slices from flatten functions (#33283)
• 771e133 CI: bump TeamCity DSL to 2026.3-dsl3 & Java to 21 to fix teamcity-test (#33...
• f796eaa fix broken ci by switching resource from old utils (#33297)
• c0c3916 data.attestation - add support for open_enclave_policy_base64 (#33125)
• 61a36c1 Attributes added data.automation - add support for `dsc_primary_access_key ...
• Additional commits viewable in compare view

Updates hashicorp/time from 0.14.0 to 0.14.1

Release notes

Sourced from hashicorp/time's releases.

v0.14.1

0.14.1 (August 14, 2026)

NOTES:

• Dependency updates (#498)

Changelog

Sourced from hashicorp/time's changelog.

0.14.1 (August 14, 2026)

NOTES:

• Dependency updates (#498)

Commits

• 16a7a58 update version and fix changie partial changelog (#507)
• 4b57d2f update Go core dependencies (#506)
• d4e05fc Added changelog for upcoming release (#505)
• 722c4a0 build(deps): Bump github.com/hashicorp/terraform-plugin-log (#504)
• de8e559 build(deps): Bump the github-actions group across 1 directory with 3 updates ...
• 8fd5533 build(deps): Bump google.golang.org/grpc from 1.79.3 to 1.82.1 (#502)
• 16bc819 build(deps): Bump actions/setup-go in the github-actions group (#500)
• e151063 build(deps): Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /tools (#497)
• 075a35f build(deps): Bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#498)
• c606d2a build(deps): Bump the github-actions group across 1 directory with 2 updates ...
• Additional commits viewable in compare view

Updates microsoft/power-platform from 4.1.0 to 4.2.0

Release notes

Sourced from microsoft/power-platform's releases.

v4.2.0

4.2.0 - 2026-09-08

✨ Added

• #1089 Add x-ms-useragent header to all backend requests when telemetry is not opted out
• #1133 Add powerplatform_publisher resource and powerplatform_publishers data source with Dataverse CRUD support and nested address handling. Contributor: @​AdamCoulterOz.
• #1225 Add powerplatform_environment_variable_value resource to manage current environment-scoped values for existing environment variable definitions; the resource manages only the value, definitions ship in solutions. It creates the value record for a definition that has none and updates the existing one otherwise. Contributor: @​AdamCoulterOz.
• #1143 Add powerplatform_managed_solution resource for identity-driven managed solution deployment with apply-time package validation for managed state, connection references, environment variable satisfiability, and dependency versions. Contributor: @​AdamCoulterOz.
• #946 Add powerplatform_environment_disaster_recovery resource to enable/disable disaster recovery for Power Platform environments
• #1210 Add advanced_connector_policies_only, content_security_policy and advanced_connector_policies rules to powerplatform_environment_group_rule_set, along with a computed policy_id attribute. These rules are served by the rule-based policies API rather than the rule sets API used by the remaining rules. An existing policy already assigned to the environment group is adopted rather than replaced, and a policy created by the resource is deleted again when the resource is destroyed. Contributor: @​metjuperry.
• #1209 powerplatform_environment and powerplatform_environments adding allow_microsoft_365_services and allow_flex_routing attributes. Contributor: @​ferronsw.
• #1190 Added powerplatform_rbac_role_assignment resource to assign a Power Platform role to an enterprise application, user or group. The required scope_type names where it applies: tenant, environment with environment_id, or environment_group with environment_group_id. The role is selected by role_definition_id or role_definition_name. Contributors: @​metjuperry, @​AdamCoulterOz.
• #1190 Added powerplatform_role_definitions data source to list the Power Platform roles that can be assigned at tenant, environment group or environment scope. Contributor: @​metjuperry.
• #1190 Added powerplatform_rbac_role_assignments data source to list role assignments. The required scope_type names which assignments to read: tenant, environment with environment_id, or environment_group with environment_group_id. Contributors: @​metjuperry, @​AdamCoulterOz.
• #1223 Add powerplatform_application_user resource for managing non-interactive Dataverse application users (service principals) with business unit selection, live-user adoption on create, and disabled-state reconciliation. Contributor: @​AdamCoulterOz.
• #1224 Add powerplatform_security_role_assignment resource for assigning a Dataverse security role to a user, application user or team, independently of the principal's lifecycle. Set system_user_id or team_id for the principal, and security_role_name or security_role_id for the role. Contributor: @​AdamCoulterOz.
• #1226 Add privacy_and_security.blocked_attachment_extensions support to powerplatform_environment_settings resource and data source. Contributor: @​AdamCoulterOz.
• #1227 Add macro_region to powerplatform_environment and the powerplatform_environments data source, plus a new powerplatform_macro_regions data source. Environment creation previously failed on tenants that provision by macro region, where the service rejects location outright.

⚰️ Deprecated

• #860 docs: announce the v5.0.0 removal of the powerplatform_rest resource. Migrate to purpose-built resources before upgrading. The powerplatform_rest_query data source is not affected. The resource remains supported until v5.0.0.
• #1136 docs: announce the v5.0.0 replacement of powerplatform_solution by powerplatform_managed_solution and powerplatform_unmanaged_solution. Plan migration according to the solution type when upgrading. The existing resource remains supported until v5.0.0.
• #969 docs: announce the v5.0.0 removal of powerplatform_tenant_capacity.tenant_id. Remove configurations and references using this attribute; capacity is fetched for the tenant configured in the provider. The attribute remains supported until v5.0.0.
• #959 docs: announce v5.0.0 deprecations for powerplatform_tenant_settings (resource and data source). disable_survey_feedback, disable_nps_comments_reachout, and power_platform.intelligence.enable_open_ai_bot_publishing will be renamed or moved within tenant settings. Update configurations and references to match the v5.0.0 schema when upgrading. power_platform.power_apps.disable_create_from_image and power_platform.power_apps.disable_create_from_figma will be removed with no replacement. Current attributes remain supported until v5.0.0.

🪲 Fixed

• #1066 Fix managed environment import failing due to missing environment_id attribute in import state
• #1102 Fix powerplatform_environment delete failing when lifecycle operation poll returns 404 after environment is already deleted
• #1112 Fixed crash when importing powerplatform_environment_group_rule_set caused by testify assert calls in production DTO conversion code
• #1122 Fixed managed environment import failing when environment does not have managed environment settings enabled
• #1129 Handle missing parent environments for powerplatform_user resources during refresh and delete. Contributor: @​AdamCoulterOz.
• #1130 Preserve dataverse security group updates when updating existing environments. Contributor: @​AdamCoulterOz.
• #1138 Fix create-time powerplatform_solution.settings_file_checksum plan inconsistency when settings_file is generated during the same apply. Contributor: @​AdamCoulterOz.
• #1139 Fix connection parameter apply state normalization. Contributor: @​AdamCoulterOz.
• #1165 Child resources (environment_settings, enterprise_policy, connection_share, connection, data_record, environment_application_admin, billing_policy_environment, environment_disaster_recovery, environment_wave, user) now remove themselves from state when their parent resource no longer exists, instead of failing indefinitely during refresh
• #1210 Fixed powerplatform_environment_group_rule_set returning "Provider produced inconsistent result after apply" for share_max_limit when share_mode was changed to no limit. Contributor: @​metjuperry.
• #1210 Fixed powerplatform_environment_group_rule_set losing maker_welcome_content after the rule was edited in the Power Platform admin center. Maker welcome content is now written to the rule-based policies API, which is where the admin center stores it, and is still read from the legacy rule set for rule sets created before the move. Contributor: @​metjuperry.
• #1211 Importing an existing powerplatform_data_record failed with ENVIRONMENT_URL_NOT_FOUND because the import id was not parsed into environment_id and table_logical_name
• #1193 powerplatform_environment no longer returns stale allow_bing_search and allow_moving_data_across_regions values after apply, and no longer disables allow_microsoft_365_services and allow_flex_routing when they are not configured
• #1199 powerplatform_environment no longer returns a null dataverse after create when the Power Platform API reports the environment lifecycle operation as succeeded before the Dataverse metadata is readable
• #1237 Environment creation outside the EU data boundary no longer fails when allow_flex_routing is unset; unknown Optional+Computed copilot policy attributes are no longer sent as false. Contributor: @​AdamCoulterOz.
• #1238 Environment creation now saves state as soon as the environment exists, so a failure in a later step no longer leaves an untracked environment that blocks the next apply with DomainNameAlreadyInUse. Contributor: @​AdamCoulterOz.
• #1238 billing_policy_id is confirmed against the licensing service instead of the environment record, fixing "Provider produced inconsistent result after apply". Contributor: @​AdamCoulterOz.
• #1238 An environment_group_id of the empty guid is no longer sent when creating an environment. It previously put the environment in a group, which blocked powerplatform_managed_environment from ever being enabled on it. Contributor: @​AdamCoulterOz.
• #1239 Enabling a managed environment no longer treats a 409 as success, which silently skipped enablement. Whether an environment is already managed is now read from protectionLevel rather than from whether settings are present. Contributor: @​AdamCoulterOz.
• #1236 powerplatform_environment now rejects allow_flex_routing outside of the EU Data Boundary with a clear error instead of an opaque API 400
• #1236 powerplatform_connection now retries while the connectivity endpoint has not yet caught up with a newly created environment

... (truncated)

Changelog

Sourced from microsoft/power-platform's changelog.

4.2.0 - 2026-09-08

✨ Added

• #1089 Add x-ms-useragent header to all backend requests when telemetry is not opted out
• #1133 Add powerplatform_publisher resource and powerplatform_publishers data source with Dataverse CRUD support and nested address handling. Contributor: @​AdamCoulterOz.
• #1225 Add powerplatform_environment_variable_value resource to manage current environment-scoped values for existing environment variable definitions; the resource manages only the value, definitions ship in solutions. It creates the value record for a definition that has ...

  Description has been truncated

[github-actions]

❌ Terraform Validation Failed

The Terraform provider update has failed validation. Please check the workflow logs for details.

This may indicate that the provider update is not compatible with the current configuration.

[Copilot]

🟡 Changes recommended

AzureRM 5.4.0 leaves unsupported subnet arguments and the removed Application Insights instrumentation_key reference.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates Terraform providers and the Azure storage AVM module across infrastructure and Copilot Studio.

Changes:

• Upgrades AzureRM, AzAPI, Power Platform, and Time providers.
• Upgrades the storage account AVM module to 0.10.0.
• Synchronizes provider versions in the Copilot Studio module.

File summaries

File	Summary
infra/provider.tf	Updates root provider versions.
infra/modules/copilot_studio/terraform.tf	Updates module provider versions.
infra/main.storage.tf	Upgrades the storage account module.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.