RELOPS-2513: remove bhearsum from Microsoft Store Partner Center groups

[markcor]

Ben Hearsum requested removal from the Microsoft Store Partner Center groups. Tracked in RELOPS-2513.

Removes bhearsum@mozilla.com from both ms_store_publishers_group and ms_store_finance_group in terraform/azure_ad/terraform.tfvars. Neither group carries Azure RBAC — the access is entirely via the Partner Center portal.

Plan

Plan: 0 to add, 0 to change, 2 to destroy.

  # azuread_group_member.ms_store_finance_membership["bhearsum@mozilla.com"] will be destroyed
  # (because key ["bhearsum@mozilla.com"] is not in for_each map)
  - group_object_id  = "03a6d47d-3f67-4f74-8be9-16a5ba15d833" -> null
  - member_object_id = "f5276515-ffff-4ffd-be4f-c2e63f95574c" -> null

  # azuread_group_member.ms_store_publishers_membership["bhearsum@mozilla.com"] will be destroyed
  # (because key ["bhearsum@mozilla.com"] is not in for_each map)
  - group_object_id  = "7d6ef4bb-6fb0-46cb-b9c6-f42c0ef1675a" -> null
  - member_object_id = "f5276515-ffff-4ffd-be4f-c2e63f95574c" -> null

Same member_object_id in both, confirming a single user leaving two groups. No other resources touched.

Side effect on the MFA work in RELOPS-2513

bhearsum was one of the four SMS-only accounts needing enrolment before SMS is retired for Publishers. With Partner Center access fully removed he drops out of scope entirely, leaving three: ahabibi, pjha, rkelimutu.

🤖 Generated with Claude Code