`azurerm_vpn_server_configuration` radius property is removed in every run when radius is not used

[SC-Tobias]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.15.9

AzureRM Provider Version

v4.81.0

Affected Resource(s)/Data Source(s)

azurerm_vpn_server_configuration

Affected Location(s)

germanywestcentral

Terraform Configuration Files

resource "azurerm_vpn_server_configuration" "uservpnconfig-prod-001" {
  name                     = "uservpnconfig-prod"
  resource_group_name      = "rg1"
  location                 = "germanywestcentral"
  vpn_protocols            = ["OpenVPN"]
  vpn_authentication_types = ["AAD"]
  azure_active_directory_authentication {
    tenant   = "https://login.microsoftonline.com/${var.tenant_id}"
    audience = var.audience
    issuer   = "https://sts.windows.net/${var.tenant_id}/"
  }
}

Debug Output/Panic Output

# azurerm_vpn_server_configuration.uservpnconfig-prod-001 will be updated in-place
  ~ resource "azurerm_vpn_server_configuration" "uservpnconfig-prod-001" {
        id                       = "id-REDACTED"
        name                     = "uservpnconfig-prod"
        tags                     = {}
        # (4 unchanged attributes hidden)

      - radius {
        }

        # (1 unchanged block hidden)
    }

Expected Behaviour

as no radius server is set via terraform there should no need to remove it after every run

Actual Behaviour

After every terraform apply, Terraform wants to remove the radius configuration block, even though that block is not present in the Terraform code.

Steps to Reproduce

terraform apply
terraform plan or terraform apply again

Important Factoids

No response

References

No response

[SC-Tobias]

adding a empty radius property "fixed" it for us

resource "azurerm_vpn_server_configuration" "uservpnconfig-prod-001" {
  name                     = "uservpnconfig-prod"
  resource_group_name      = "rg1"
  location                 = "germanywestcentral"
  vpn_protocols            = ["OpenVPN"]
  vpn_authentication_types = ["AAD"]
  azure_active_directory_authentication {
    tenant   = "https://login.microsoftonline.com/${var.tenant_id}"
    audience = var.audience
    issuer   = "https://sts.windows.net/${var.tenant_id}/"
  }
  radius {}
}

[v-kenntan]

Hi @SC-Tobias! I've just tried to replicate this issue, but I seem to be unable to replicate it with provider v4.81.0. My current suspicion is that your resource contains stale data (an empty string) from a previous version of the API, whereas the current version would store a null value instead. The current provider only checks for null values when determining whether the radius property is empty, and in the case where an empty string is returned, it will show an empty radius block during plan. Would it be possible to know if this resource was created during a previous version? Also, would it be possible to run this command and let me know whether the output returns an empty string or null?

az rest --method get --url "https://management.azure.com<id-of-vpn_server_configuration_resource>?api-version=2025-01-01" --query "to_string(properties.radiusServerAddress)" -o json

Thank you!

[SC-Tobias]

the --query paramter did not worked for me but it is an empty string:

we use the azurerm_vpn_server_configuration to created it but It was about 4–5 months ago.
Unfortunately, I can't say whether anyone might have tried to configure something in the Azure Portal while we were testing everything.

Edit:
but if you cant replicate the issue i am also fine in keeping the empty Radius block and close this issue

[v-kenntan]

Thanks for the reply! I believe that my assumption is correct as this is what my response looks like from my testing (doesn't have radiusServerAddress):

I'll work on a fix on this. Thank you!