Global Administrator role has fewer than 5 members

# Keep Global Administrator assignments below 5 by defining only required principals
data "azuread_directory_role" "global_admin" {
  display_name = "Global Administrator"
}

# Critical: This assignment grants GA to a specific principal; keep total GA assignments < 5
resource "azuread_directory_role_assignment" "ga_primary" {
  role_id             = data.azuread_directory_role.global_admin.id  # Assigns the Global Administrator role
  principal_object_id = "<example_resource_id>"                      # Required account (e.g., break-glass)
}

# Critical: Add only necessary GA assignments; remove extras to ensure count < 5
resource "azuread_directory_role_assignment" "ga_secondary" {
  role_id             = data.azuread_directory_role.global_admin.id  # Assigns the Global Administrator role
  principal_object_id = "<example_resource_id>"                      # Second required account
}