Every apply of the azuread-group module detects 2 resources to change

[alambike]

Every apply of the azuread-group module detects 2 resources to change

inputs:

    module: git::https://github.com/prefapp/tfm.git//modules/azuread-group?ref=azuread-group-v1.0.0
    values:
      name: test-powerusers
      description: "Group for test power users"
      directory_roles: []
      owners: []
      assignable_to_role: true
      subscription_roles:
        - role_name: "Key Vault Secrets Officer"
          resources_scopes:
            - "/subscriptions/xxxxx/resourceGroups/yyy/providers/Microsoft.KeyVault/vaults/test-kv"
      members:
        - type: user
          email: [email protected]
          pim:
            type: eligible
            permanent_assignment: true

Terraform will perform the following actions:

# azuread_group_role_management_policy.members will be updated in-place
~ resource "azuread_group_role_management_policy" "members" {
      id           = "Group_xxxxxxxxxxxxxxxxxxxxxxx"
      # (4 unchanged attributes hidden)

    ~ activation_rules {
          # (5 unchanged attributes hidden)

        - approval_stage {
          }
      }

      # (3 unchanged blocks hidden)
  }

# azuread_group_role_management_policy.owners will be updated in-place
~ resource "azuread_group_role_management_policy" "owners" {
      id           = "Group_xxxxxxxxxxxxxxxxxxxxxxx"
      # (4 unchanged attributes hidden)

    ~ activation_rules {
          # (5 unchanged attributes hidden)

        - approval_stage {
          }
      }

      # (3 unchanged blocks hidden)
  }

Plan: 0 to add, 2 to change, 0 to destroy.