Q: Managing resources with terraform azuread originally stemming from on-premise Active Directory possible? I just want to go sure, if would be possible to manage a resource e.g. a User or a Group coming from a scenario where the resources were created with Active Directory and that are synced to an AzureAd tenant with AD Connect and should forthcoming be managed by Terraform.
Our setting is currently:
Active Directory -> AD Connect -> AzureAD
Now we are introducing terraform to manage some resources, too:
terraform -> AzureAD
When trying to change a previsouly Active Directory-created resource, despite importing into terraform, its impossible for me to alter it (see below error). Can this be mitigated?
I imported an already existing user into my terraform state:
terraform import module.users[\"myuser\"].azuread_user.this <objectId>

which succeded
module.users["myuser"].azuread_user.this: Importing from ID "<objectId>"...
module.users["myuser"].azuread_user.this: Import prepared!
  Prepared azuread_user for import
module.users["myuser"].azuread_user.this: Refreshing state... [id=<objectId>]

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

Then tried to change the successfully imported user, which fails.
│ Error: Could not update user with ID: "<objectId>"
│ 
│ UsersClient.BaseClient.Patch(): unexpected status 400 with OData error:
│ Request_BadRequest: Unable to update the specified properties for
│ on-premises mastered Directory Sync objects or objects currently undergoing
│ migration.

I'm not sure what "currently undergoing migration" means. I gues the problem lies in defining which system manages a resource, as can be seen in Azure Portal "directory-synced" column.
Fortunately, I can make a clean cut and forget about Active Directory resources, when defining new resources with terraform.
But how would you manage e.g. a terraform-manged User that needs to get different groups assigned that are directory-synced AND cloud/terraform managed at the same time? That would be impossible?

A: You can manage Azure AD users with terraform even if they come from on premise Active Directory however you cannot change any value that has been synced from an on premise attribute.
Eg. Out of the box you can update the accountEnabled property but not the displayName property.
