Question

Your organization runs CI/CD pipelines in GitHub Actions that need to deploy resources to Azure using an Entra ID app registration. Security policy prohibits storing any long-lived secrets or certificates in GitHub. You must allow the GitHub Actions workflow to authenticate to Entra ID and obtain tokens without any stored credentials. What should you configure on the app registration?

Accepted Answer

Add a federated credential (workload identity federation) that trusts GitHub's OIDC issuer and matches the repository and branch subject

Answer

Create a client secret with a 6-month expiration and store it as an encrypted GitHub Actions secret

Answer

Upload a self-signed certificate to the app registration and reference it from the workflow

Answer

Assign a system-assigned managed identity to the app registration for use by GitHub