Getting 400 Bad Request when creating Eligible role assignment with conditions

[alitenah]

When creating eligible role assignment (Microsoft.Authorization/roleEligibilityScheduleRequests@2022-04-01-preview api version) with conditions, apply fails with 400 Bad Request - ERROR CODE: ScopeDoesNotMatchRoleDefinition.
When conditions are removed, eligible role assignment is created without issues.

Code snippet for creating role with conditions included:

resource "azapi_resource" "pim_assignments" {
  type      = "Microsoft.Authorization/roleEligibilityScheduleRequests@2022-04-01-preview"
  name      = random_uuid.pim_role_assignment_random_guid.id
  parent_id = "/subscriptions/${data.azurerm_subscription.data_sub_corp.subscription_id}"
  body = {
    properties = {
      requestType      = "AdminAssign"
      roleDefinitionId = data.azurerm_role_definition.data_sub_owner_corp.id
      principalId      = data.azuread_user.data_sub_owner_user.object_id
      condition        = "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR  (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAllValues:GuidNotEquals {8e3af657-a8ff-443c-a75c-2fe8c4bcb635}})) AND (( !(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR  (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAllValues:GuidNotEquals {8e3af657-a8ff-443c-a75c-2fe8c4bcb635}}))"
      conditionVersion = "2.0"
      scheduleInfo = {
        expiration = {
          duration = "P365D"
          type     = "AfterDuration"
        }
        startDateTime = time_static.pim_role_assignment_creation_time.rfc3339
      }
    }
  }
}

Error received:

Once conditions are removed, there is no scope error. If the assignable scope was incorrect, I would expect it to fail with or without conditions.

[ms-henglu]

Hi @alitenah ,

Thank you for taking time to report this issue and apologize for late response.

This error message comes from the API, I think it's better to open an Azure support ticket to help improve it.