diff --git a/pulsar/resource_pulsar_tenant.go b/pulsar/resource_pulsar_tenant.go
index 7850428..c6b8b0c 100644
--- a/pulsar/resource_pulsar_tenant.go
+++ b/pulsar/resource_pulsar_tenant.go
@@ -57,7 +57,7 @@ func resourcePulsarTenant() *schema.Resource {
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 			"admin_roles": {
-				Type:        schema.TypeList,
+				Type:        schema.TypeSet,
 				Optional:    true,
 				Description: descriptions["admin_roles"],
 				Elem:        &schema.Schema{Type: schema.TypeString},
@@ -70,7 +70,7 @@ func resourcePulsarTenantCreate(ctx context.Context, d *schema.ResourceData, met
 	client := getClientFromMeta(meta).Tenants()
 
 	tenant := d.Get("tenant").(string)
-	adminRoles := handleHCLArray(d, "admin_roles")
+	adminRoles := handleHCLArrayV2(d.Get("admin_roles").(*schema.Set).List())
 	allowedClusters := handleHCLArrayV2(d.Get("allowed_clusters").(*schema.Set).List())
 
 	input := utils.TenantData{
@@ -111,7 +111,7 @@ func resourcePulsarTenantUpdate(ctx context.Context, d *schema.ResourceData, met
 	client := getClientFromMeta(meta).Tenants()
 
 	tenant := d.Get("tenant").(string)
-	adminRoles := handleHCLArray(d, "admin_roles")
+	adminRoles := handleHCLArrayV2(d.Get("admin_roles").(*schema.Set).List())
 	allowedClusters := handleHCLArrayV2(d.Get("allowed_clusters").(*schema.Set).List())
 
 	input := utils.TenantData{
@@ -174,11 +174,6 @@ func deleteExistingNamespacesForTenant(tenant string, meta interface{}) error {
 	return nil
 }
 
-func handleHCLArray(d *schema.ResourceData, key string) []string {
-	hclArray := d.Get(key).([]interface{})
-	return handleHCLArrayV2(hclArray)
-}
-
 func handleHCLArrayV2(hclArray []interface{}) []string {
 	out := make([]string, 0)
 
diff --git a/pulsar/resource_pulsar_tenant_test.go b/pulsar/resource_pulsar_tenant_test.go
index 03fb8cc..59cf358 100644
--- a/pulsar/resource_pulsar_tenant_test.go
+++ b/pulsar/resource_pulsar_tenant_test.go
@@ -20,6 +20,7 @@ package pulsar
 import (
 	"fmt"
 	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/apache/pulsar-client-go/pulsaradmin/pkg/admin"
@@ -189,3 +190,106 @@ resource "pulsar_tenant" "test" {
 }
 `, url, tname)
 }
+
+const (
+	testPulsarTenantWithAdminRoles1 = "pulsar-tenant-admin-role-1"
+	testPulsarTenantWithAdminRoles2 = "pulsar-oauth2-tenant-admin-role@testing.local"
+)
+
+func TestTenantWithAdminRoles(t *testing.T) {
+	tName := acctest.RandString(10)
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+		},
+		ProviderFactories:         testAccProviderFactories,
+		PreventPostDestroyRefresh: false,
+		CheckDestroy:              testPulsarTenantDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: strings.Replace(testPulsarTenantWithAdminRoles, "thanos", tName, 1),
+				Check: resource.ComposeTestCheckFunc(
+					testPulsarTenantExists("pulsar_tenant.test"),
+					resource.TestCheckResourceAttr("pulsar_tenant.test", "admin_roles.#", "2"),
+					resource.TestCheckTypeSetElemAttr("pulsar_tenant.test", "admin_roles.*", testPulsarTenantWithAdminRoles1),
+					resource.TestCheckTypeSetElemAttr("pulsar_tenant.test", "admin_roles.*", testPulsarTenantWithAdminRoles2),
+				),
+			},
+		},
+	})
+}
+
+func TestTenantUpdateAdminRoles(t *testing.T) {
+	tName := acctest.RandString(10)
+	resource.Test(t, resource.TestCase{
+		PreCheck:                  func() { testAccPreCheck(t) },
+		ProviderFactories:         testAccProviderFactories,
+		PreventPostDestroyRefresh: false,
+		CheckDestroy:              testPulsarTenantDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: strings.Replace(testPulsarTenantWithAdminRoles, "thanos", tName, 1),
+				Check: resource.ComposeTestCheckFunc(
+					testPulsarTenantExists("pulsar_tenant.test"),
+				),
+			},
+			{
+				Config: strings.Replace(testPulsarTenantWithAdminRolesUpdated, "thanos", tName, 1),
+				Check: resource.ComposeTestCheckFunc(
+					testPulsarTenantExists("pulsar_tenant.test"),
+					resource.TestCheckResourceAttr("pulsar_tenant.test", "admin_roles.#", "2"),
+					resource.TestCheckTypeSetElemAttr("pulsar_tenant.test", "admin_roles.*", testPulsarTenantWithAdminRoles1),
+					resource.TestCheckTypeSetElemAttr("pulsar_tenant.test", "admin_roles.*", testPulsarTenantWithAdminRoles2),
+				),
+			},
+		},
+	})
+}
+
+func TestTenantAdminRolesDrift(t *testing.T) {
+	tName := acctest.RandString(10)
+	resource.Test(t, resource.TestCase{
+		PreCheck:                  func() { testAccPreCheck(t) },
+		ProviderFactories:         testAccProviderFactories,
+		PreventPostDestroyRefresh: false,
+		CheckDestroy:              testPulsarTenantDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: strings.Replace(testPulsarTenantWithAdminRoles, "thanos", tName, 1),
+				Check: resource.ComposeTestCheckFunc(
+					testPulsarTenantExists("pulsar_tenant.test"),
+					resource.TestCheckResourceAttr("pulsar_tenant.test", "admin_roles.#", "2"),
+					resource.TestCheckTypeSetElemAttr("pulsar_tenant.test", "admin_roles.*", testPulsarTenantWithAdminRoles1),
+					resource.TestCheckTypeSetElemAttr("pulsar_tenant.test", "admin_roles.*", testPulsarTenantWithAdminRoles2),
+				),
+			},
+			{
+				Config:             strings.Replace(testPulsarTenantWithAdminRoles, "thanos", tName, 1),
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: false,
+			},
+		},
+	})
+}
+
+var testPulsarTenantWithAdminRoles = fmt.Sprintf(`
+provider "pulsar" {
+  web_service_url = "%s"
+}
+
+resource "pulsar_tenant" "test" {
+  tenant = "thanos"
+  allowed_clusters = ["standalone"]
+  admin_roles = ["%s", "%s"]
+}`, testWebServiceURL, testPulsarTenantWithAdminRoles1, testPulsarTenantWithAdminRoles2)
+
+var testPulsarTenantWithAdminRolesUpdated = fmt.Sprintf(`
+provider "pulsar" {
+  web_service_url = "%s"
+}
+
+resource "pulsar_tenant" "test" {
+  tenant = "thanos"
+  allowed_clusters = ["standalone"]
+  admin_roles = ["%s", "%s"]
+}`, testWebServiceURL, testPulsarTenantWithAdminRoles2, testPulsarTenantWithAdminRoles1)