Authenticate a GitHub Actions workflow to Azure using OIDC federated credentials instead of a client secret

Steps

1. Create or reuse a Microsoft Entra app registration or user-assigned managed identity and assign it the Azure RBAC role needed on the target subscription or resource group.
2. Add a federated identity credential on that identity trusting GitHub's OIDC issuer, scoped to a subject such as repo:ORG/REPO:ref:refs/heads/BRANCH or repo:ORG/REPO:environment:NAME, with audience api://AzureADTokenExchange.
3. Store the identity's client ID, tenant ID, and subscription ID as GitHub repository or environment secrets/variables; no client secret is required.
4. In the workflow, set permissions: id-token: write (plus contents: read), then use the azure/login action with client-id, tenant-id, and subscription-id inputs to exchange the workflow's OIDC token for a short-lived Azure access token.
5. Run subsequent Azure CLI, ARM, or Bicep steps in the same job; the exchanged token is scoped to that run and expires automatically.