azuread_conditional_access_policy - add support for Application Filters

[bubbletroubles]

Community Note

• Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

This PR adds support for filtering applications to be in scope for a Conditional Access policy. The docs for this capability are at

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-filter-for-applications
• https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccessapplications?view=graph-rest-1.0

Changes to existing Resource / Data Source

• I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
• I have written new tests for my resource or datasource changes & updated any relevant documentation.
• I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
• (For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

• My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

Here is the link for the new test results here

Also, all the Conditional Access tests have been run - all are passing except one which I don't have a license for - see all Conditional Access tests

2025-10-05T09:31:43.7565964Z ##[section]Starting: Run Acceptance Tests
2025-10-05T09:31:43.7571153Z ==============================================================================
2025-10-05T09:31:43.7571250Z Task         : Bash
2025-10-05T09:31:43.7571307Z Description  : Run a Bash script on macOS, Linux, or Windows
2025-10-05T09:31:43.7571378Z Version      : 3.259.0
2025-10-05T09:31:43.7571438Z Author       : Microsoft Corporation
2025-10-05T09:31:43.7571507Z Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
2025-10-05T09:31:43.7571592Z ==============================================================================
2025-10-05T09:31:43.8855119Z Generating script.
2025-10-05T09:31:43.8865775Z ========================== Starting Command Output ===========================
2025-10-05T09:31:43.8873459Z [command]/usr/bin/bash /home/vsts/work/_temp/5800ef23-52b1-49b9-8404-fc4496939292.sh
2025-10-05T09:31:43.8924320Z Starting acceptance tests...
2025-10-05T09:31:43.8924658Z Terraform log level: INFO
2025-10-05T09:31:43.8924848Z TF_LOG: INFO
2025-10-05T09:31:43.8925038Z TF_LOG_PATH: /home/vsts/work/_temp/terraform-debug-logs/terraform-debug.log
2025-10-05T09:31:43.9376469Z ==> Checking that code complies with gofmt requirements...
2025-10-05T09:31:44.4958477Z TF_ACC=1 go test -v ./internal/services/conditionalaccess/ -run=TestAccConditionalAccessPolicy_applicationFilter -parallel 6 -timeout 600m -ldflags="-X=github.com/hashicorp/terraform-provider-azuread/version.ProviderVersion=acc"
2025-10-05T09:34:46.1608296Z === RUN   TestAccConditionalAccessPolicy_applicationFilter
2025-10-05T09:34:46.1610597Z === PAUSE TestAccConditionalAccessPolicy_applicationFilter
2025-10-05T09:34:46.1611080Z === CONT  TestAccConditionalAccessPolicy_applicationFilter
2025-10-05T09:36:34.3671019Z --- PASS: TestAccConditionalAccessPolicy_applicationFilter (108.21s)
2025-10-05T09:36:34.3671741Z PASS
2025-10-05T09:36:34.3704051Z ok  	github.com/hashicorp/terraform-provider-azuread/internal/services/conditionalaccess	108.218s
2025-10-05T09:36:34.6621679Z Acceptance tests completed
2025-10-05T09:36:34.6633717Z 
2025-10-05T09:36:34.6693471Z ##[section]Finishing: Run Acceptance Tests

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

• azuread_conditional_access_policy - support for the application_filter property [application_filter param missing from azuread_conditional_access_policy applications condition #1318]

This is a (please select all that apply):

• Bug Fix
• New Feature (ie adding a service, resource, or data source)
• Enhancement
• Breaking Change

Related Issue(s)

Fixes #1318
Supersedes #1357

Note

If this PR changes meaningfully during the course of review please update the title and description as required.