Question

Your team maintains Azure Machine Learning infrastructure using Bicep templates stored in a GitHub repository. You need to configure a GitHub Actions workflow that deploys the workspace and its resources to Azure automatically on every merge to the main branch. Company security policy prohibits storing long-lived service principal secrets in GitHub. What should you configure to allow the workflow to authenticate to Azure?

Accepted Answer

Register an app in Microsoft Entra ID, configure a federated identity credential for the GitHub repository, and use workload identity federation (OIDC) with the azure/login action

Answer

Create a service principal, generate a client secret, and store it as a GitHub Actions repository secret referenced by the azure/login action

Answer

Store the Azure account username and password as encrypted GitHub secrets and pass them to the Azure CLI in the workflow

Answer

Enable a system-assigned managed identity on the GitHub Actions runner and grant it Contributor on the subscription