Add an azapi_update_resource block into your Terraform config to configure properties that are not yet supported in the azurerm provider.


Date Description
2021-04-29 Azure Web PubSub in Public Preview
2021-08-02 Developers start testing the preview functionality
2021-11-16 Azure Web PubSub goes GA
2021-12-06 Developers ask to include Web PubSub in the Terraform config
2022-01-28 azurerm v2.94: new resource azurerm_web_pubsub
2022-02-07 Switch to native support for the resource
2022-02-14 Asked to add system assigned managed identity

The developers have come back to you as they need to make use of managed identity for their application. They want a system assigned managed identity and they will need to know both the tenant id and the object id.

The only problem is that it is not yet supported in the the azurerm_web_pubsub resource type.

Not a problem. You can use the azapi provider’s azapi_update_resource in the meantime.

Let’s see how the azapi_update_resource is used.

Starting configuration

Your file should be similar to this:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.94"

    azapi = {
      source  = "azure/azapi"
      version = "=0.3.0"

provider "azurerm" {
  features {}

provider "azapi" {}

resource "azurerm_resource_group" "azapi_labs" {
  name     = "azapi_labs"
  location = "West Europe"

resource "azurerm_web_pubsub" "webpubsub" {
  name                = "azapi-labs-richeney"
  resource_group_name =
  location            = azurerm_resource_group.azapi_labs.location
  sku                 = "Free_F1"
  capacity            = 1

⚠️ You should have a different value for your

Sample REST API update

Go back to the Web Pub Sub REST API reference documentation.

There are two ways of updating a Web Pub Sub resource via the REST API. You can use either

  1. Create or Updatewith PUT method, or
  2. Update, with PATCH method

Update aligns with azapi_update_resource. Check out the reference specification and examples.

Here is an example REST API request and body to add a system assigned managed identity to the Web Pub Sub service:




  "identity": {
    "type": "SystemAssigned"
  "location": "westeurope"

az rest

Here is the matching Azure CLI command.

az rest --method patch \
  --uri "" \
  --body '{"identity":{"type":"SystemAssigned"}}'

⚠️ Strictly speaking the issues on the azapi repo suggest that PATCH is not supported as a method, but it appears to merge the body JSON with the existing config so you can use a partial JSON that would not be supported by a PUT method.


Let’s see how that example REST API patch transfers to an azapi_update_resource.

  1. Open the azapi_update_resource documentation

    Open the azapi_update_resource page.

    Pay attention to the note, which is copied out below:

    This resource is used to add or modify properties on an existing resource. When delete azapi_update_resource, no operation will be performed, and these properties will stay unchanged. If you want to restore the modified properties to some values, you must apply the restored properties before deleting.

  2. Add the azapi_update_resource block to the

    resource "azapi_update_resource" "webpubsub_identity" {
      type      = "Microsoft.SignalRService/WebPubSub@2021-10-01"
      name      =
      parent_id =
      body = jsonencode({
        identity = {
          "type" : "SystemAssigned"

    ⚠️ Remember that your should match the resource name for your Web Pub Sub resource. Don’t use azapi-labs-richeney.

    Setting the name to the exported name of the main resource will automatically set up an implicit dependency between azapi_update_resource.webpubsub_identity and azurerm_web_pubsub.webpubsub.

    You may also add an explicit dependency into the block if desired, e.g.:

      depends_on = [
  3. Save

  4. Plan

    terraform plan
        azurerm_resource_group.azapi_labs: Refreshing state... [id=/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/azapi_labs]
        azurerm_web_pubsub.webpubsub: Refreshing state... [id=/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/azapi_labs/providers/Microsoft.SignalRService/WebPubSub/azapi-labs-richeney]
        Terraform used the selected providers to generate the following execution
        plan. Resource actions are indicated with the following symbols:
          + create
        Terraform will perform the following actions:
          # azapi_update_resource.webpubsub_identity will be created
          + resource "azapi_update_resource" "webpubsub_identity" {
              + body                    = jsonencode(
                      + identity = {
                          + type = "SystemAssigned"
              + id                      = (known after apply)
              + ignore_casing           = false
              + ignore_missing_property = false
              + name                    = "azapi-labs-richeney"
              + output                  = (known after apply)
              + parent_id               = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/azapi_labs"
              + resource_id             = (known after apply)
              + type                    = "Microsoft.SignalRService/WebPubSub@2021-10-01"
        Plan: 1 to add, 0 to change, 0 to destroy.
        Note: You didn't use the -out option to save this plan, so Terraform can't
        guarantee to take exactly these actions if you run "terraform apply" now.
  5. Apply

    terraform apply --auto-approve

    Terraform uses the azapi provider to update the Web PubSub resource.


  1. Check the identity blade for the Web Pub Sub resource


    The system assigned identity has been successfully enabled.

  2. List the identifiers in state

    terraform state list

    Example output:

  3. Display the resource attributes from state

    terraform state show azapi_update_resource.webpubsub_identity

    Example output:

    # azapi_update_resource.webpubsub_identity:
    resource "azapi_update_resource" "webpubsub_identity" {
        body                    = jsonencode(
                identity = {
                    type = "SystemAssigned"
        id                      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/azapi_labs/providers/Microsoft.SignalRService/WebPubSub/azapi-labs-richeney"
        ignore_casing           = false
        ignore_missing_property = false
        name                    = "azapi-labs-richeney"
        output                  = jsonencode({})
        parent_id               = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/azapi_labs"
        resource_id             = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/azapi_labs/providers/Microsoft.SignalRService/WebPubSub/azapi-labs-richeney"
        type                    = "Microsoft.SignalRService/WebPubSub@2021-10-01"


You have successfully used the azapi provider to update a resource via the REST API.

The only issue is that the azapi_update_resource does not export all of the attributes, including the object id for the system assigned managed identity.

That would be useful if the config needs to create an azurerm_role_assignment, or at least output the object ID.

Move on to the next lab and we’ll use the azapi’s data source.

Help us improve

Azure Citadel is a community site built on GitHub, please contribute and send a pull request

 Make a change