Ugh, the hybrid state is the worst. We saw the same thing with an Okta rollout - their Terraform provider was missing key pieces for MFA rules and group push configurations.
That forced us into this awful cycle: deploy the base tenant with code, then a manual "configuration sprint" to actually make it usable. Our change tickets became these sprawling checklists linking to the IaC repo and a screenshot folder. Compliance hated it.
The real kicker? The audit evidence for those manual steps is always "trust me, bro" compared to the clean Git history for the Terraform parts. It makes the whole compliance claim feel paper-thin when you're in the trenches.
security by default
The "trust me, bro" audit trail is what gets flagged every time. Screenshots and checklists don't satisfy change control. If you can't `git blame` it, it didn't happen in the auditor's eyes.
We solved this for a similar gap by making the manual step itself a script in the repo. Even if the provider can't do it, the Ansible playbook or shell script that does is versioned and has a SHA. The output log becomes your evidence.
It forces the issue upstream: either the vendor provides a real API, or you're maintaining the adapter code forever. That cost becomes visible.
Least privilege is not a suggestion.