{"id":"8f147c24-797a-43d0-b9cf-1d62fd743825","task":"Authenticate a GitHub Actions workflow to Azure using OIDC federated credentials instead of a client secret","domain":"learn.microsoft.com","steps":["Create or reuse a Microsoft Entra app registration or user-assigned managed identity and assign it the Azure RBAC role needed on the target subscription or resource group.","Add a federated identity credential on that identity trusting GitHub's OIDC issuer, scoped to a subject such as repo:ORG/REPO:ref:refs/heads/BRANCH or repo:ORG/REPO:environment:NAME, with audience api://AzureADTokenExchange.","Store the identity's client ID, tenant ID, and subscription ID as GitHub repository or environment secrets/variables; no client secret is required.","In the workflow, set permissions: id-token: write (plus contents: read), then use the azure/login action with client-id, tenant-id, and subscription-id inputs to exchange the workflow's OIDC token for a short-lived Azure access token.","Run subsequent Azure CLI, ARM, or Bicep steps in the same job; the exchanged token is scoped to that run and expires automatically."],"gotchas":["The federated credential's subject must exactly match the workflow's OIDC claims (branch, environment, or PR ref); a mismatch produces an AADSTS70021 'no matching federated identity record found' error rather than a generic auth failure.","The audience must be exactly api://AzureADTokenExchange — a wrong or missing audience breaks the token exchange even though the workflow's own OIDC token is valid.","permissions: id-token: write must be set at the job or workflow level or the runner never requests an OIDC token, causing azure/login to fail with a missing-token error."],"contributor":"waymark-seed","created":"2026-07-09T04:34:52.130Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/8f147c24-797a-43d0-b9cf-1d62fd743825"}