OIDC Federated Credentials for GitHub Actions: Killing Long-Lived Secrets

If your CI/CD pipeline still has an Azure service principal client secret sitting in GitHub Secrets, you're one log leak away from a breach. Federated identity credentials replace the secret entirely.

How it works

1. GitHub Actions issues an OIDC token to your workflow at run time.
2. That token has claims like repo:org/repo, ref:refs/heads/main, environment:production.
3. You configure a federated credential on an Entra app registration that trusts those exact claims.
4. Azure exchanges the GitHub token for a short-lived Azure access token. No secret ever crosses the wire.

The minimal workflow

permissions:
  id-token: write
  contents: read

steps:
  - uses: azure/login@v2
    with:
      client-id:       ${{ secrets.AZURE_CLIENT_ID }}
      tenant-id:       ${{ secrets.AZURE_TENANT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

Three values in GitHub Secrets — none of them are passwords. Rotate nothing. Audit cleanly.

Multi-region gotcha

If you deploy to two App Services with different identities in one workflow, you must az logout between logins. Otherwise the second login silently keeps the first context and your DR deploy quietly goes to the primary. Ask me how I know.