From d58862a59f200515fdb22fbeec4e8c4987981d6c Mon Sep 17 00:00:00 2001
From: Kelly Faessen <kfaessen@hanab.nl>
Date: Wed, 24 Jun 2026 11:03:39 +0200
Subject: [PATCH 1/2] feat(function_app_linux_managed_identity): support
 azurerm v4 and dotnet 10.0

Bump the azurerm provider constraint from ~> 3.117 to ~> 4.66 so the module
accepts dotnet_version = "10.0" (requires azurerm >= 4.66). Add
resource_provider_registrations = "none" (the v4 replacement for the removed
ARM_SKIP_PROVIDER_REGISTRATION) and migrate the diagnostic setting's deprecated
metric block to enabled_metric.

AB#7844
---
 CHANGELOG.md                                           |  6 ++++++
 .../azure/function_app_linux_managed_identity/main.tf  | 10 +++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 617fa8a4..3b49e430 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Common Changelog](https://common-changelog.org),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- `azure/function_app_linux_managed_identity`: **Breaking** — require `azurerm ~> 4.66` (was `~> 3.117`) so the module accepts `dotnet_version = "10.0"`. Adds `resource_provider_registrations = "none"` to the `azurerm` provider (the v4 replacement for the removed `ARM_SKIP_PROVIDER_REGISTRATION`) and migrates the diagnostic setting's deprecated `metric` block to `enabled_metric`.
+
 ## [3.14.0] - 2024-08-15
 
 ### Added
diff --git a/modules/azure/function_app_linux_managed_identity/main.tf b/modules/azure/function_app_linux_managed_identity/main.tf
index 2b49e2f8..8318d34f 100644
--- a/modules/azure/function_app_linux_managed_identity/main.tf
+++ b/modules/azure/function_app_linux_managed_identity/main.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 3.117"
+      version = "~> 4.66"
     }
     azuread = {
       source  = "hashicorp/azuread"
@@ -21,6 +21,11 @@ terraform {
 
 provider "azurerm" {
   features {}
+
+  # azurerm v4 removed the ARM_SKIP_PROVIDER_REGISTRATION env var in favour of this argument.
+  # The deploy service principals do not have rights to register resource providers, so keep
+  # registration disabled (matches the pipelines that still export ARM_SKIP_PROVIDER_REGISTRATION).
+  resource_provider_registrations = "none"
 }
 
 provider "azapi" {
@@ -280,8 +285,7 @@ resource "azurerm_monitor_diagnostic_setting" "diagnostic_setting" {
     category_group = "allLogs"
   }
 
-  metric {
+  enabled_metric {
     category = "AllMetrics"
-    enabled  = true
   }
 }

From 2208945ef916bb47e83d6907254ab3b7c6d65283 Mon Sep 17 00:00:00 2001
From: Kelly Faessen <kfaessen@hanab.nl>
Date: Wed, 24 Jun 2026 11:28:04 +0200
Subject: [PATCH 2/2] fix(function_app_linux_managed_identity): drop
 resource_provider_registrations

azurerm v4 still honours the ARM_SKIP_PROVIDER_REGISTRATION env var the pipelines
export, and rejects setting both skip_provider_registration (via that env var) and
resource_provider_registrations at once. Rely on the env var like every other module.

AB#7844
---
 CHANGELOG.md                                              | 2 +-
 modules/azure/function_app_linux_managed_identity/main.tf | 8 +++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b49e430..42963ebf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- `azure/function_app_linux_managed_identity`: **Breaking** — require `azurerm ~> 4.66` (was `~> 3.117`) so the module accepts `dotnet_version = "10.0"`. Adds `resource_provider_registrations = "none"` to the `azurerm` provider (the v4 replacement for the removed `ARM_SKIP_PROVIDER_REGISTRATION`) and migrates the diagnostic setting's deprecated `metric` block to `enabled_metric`.
+- `azure/function_app_linux_managed_identity`: **Breaking** — require `azurerm ~> 4.66` (was `~> 3.117`) so the module accepts `dotnet_version = "10.0"`. Migrates the diagnostic setting's deprecated `metric` block to `enabled_metric` (removed in azurerm v5). Provider registration stays controlled by the `ARM_SKIP_PROVIDER_REGISTRATION` env var, which azurerm v4 still honours.
 
 ## [3.14.0] - 2024-08-15
 
diff --git a/modules/azure/function_app_linux_managed_identity/main.tf b/modules/azure/function_app_linux_managed_identity/main.tf
index 8318d34f..4e3fd931 100644
--- a/modules/azure/function_app_linux_managed_identity/main.tf
+++ b/modules/azure/function_app_linux_managed_identity/main.tf
@@ -21,11 +21,9 @@ terraform {
 
 provider "azurerm" {
   features {}
-
-  # azurerm v4 removed the ARM_SKIP_PROVIDER_REGISTRATION env var in favour of this argument.
-  # The deploy service principals do not have rights to register resource providers, so keep
-  # registration disabled (matches the pipelines that still export ARM_SKIP_PROVIDER_REGISTRATION).
-  resource_provider_registrations = "none"
+  # Provider registration stays disabled via the ARM_SKIP_PROVIDER_REGISTRATION env var the
+  # pipelines export (still honoured by azurerm v4). Do NOT also set resource_provider_registrations
+  # here: v4 rejects having both set at once.
 }
 
 provider "azapi" {