I’m trying to run the terraform init command, but it’s behaving strangely.

This is the command I’m running:

terraform init `
    -backend-config="resource_group_name=testrg" `
    -backend-config="storage_account_name=testsa" `
    -backend-config="container_name=tests" `
    -backend-config="key=test.tfstate" `
    -backend-config="subscription_id=<subscription_id>" `
    -backend-config="client_id=<client_id>" `
    -backend-config="client_secret=<client_secret>" `
    -backend-config="tenant_id=<tenant_id>" `
    -backend-config="use_oidc=true"

The problem is, when I run this command on the DevOps agent, I get the following error:

Initializing the backend...
╷
│ Error: Failed to get existing workspaces: Error retrieving keys for Storage Account "testsa": storage.AccountsClient#ListKeys: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '<enterprise_application_id>' with object id '<enterprise_application_id>' does not have authorization to perform action 'Microsoft.Storage/storageAccounts/listKeys/action' over scope '/subscriptions/<subscription_id>/resourceGroups/testrg/providers/Microsoft.Storage/storageAccounts/testsa' or the scope is invalid. If access was recently granted, please refresh your credentials."
╵

The client ID is different because, for some reason, Terraform is using the ID from the enterprise application instead of the client ID of the service principal provided in the configuration.

Why is this happening? Do I have the service principal configured incorrectly, or should I add something to the terraform init command to use the client ID from the service principal? When I run this command locally, everything works fine.

I am also fine with assigning role to enterprise application but when i go to IAM i see only app registration in UI.

Thanks for your help!