Question

Contoso runs CI/CD pipelines in GitHub Actions that deploy resources to Azure. Currently the pipelines authenticate to Azure using a service principal with a client secret stored as a GitHub repository secret. The security team wants to eliminate the long-lived secret entirely, avoid any manual secret rotation, and still allow the pipeline to authenticate to Microsoft Entra ID. Which solution should you recommend?

Accepted Answer

Configure workload identity federation on the app registration and add a federated credential that trusts GitHub's OIDC issuer

Answer

Store the client secret in Azure Key Vault and have the pipeline retrieve it at runtime using a managed identity

Answer

Replace the client secret with a self-signed certificate uploaded to the app registration and rotate it every 90 days

Answer

Assign a user-assigned managed identity to the GitHub-hosted runner and grant it the required Azure RBAC roles