Question

Your team deploys to Azure from a GitHub Actions workflow. Currently a long-lived Azure service-principal client secret is stored as a repository secret and passed to the azure/login action. Security wants to eliminate the stored secret by using OpenID Connect (OIDC) federation. You configure a federated credential on the Azure AD app registration and update the workflow to log in with the client ID, tenant ID, and subscription ID (no secret). The job now fails at the login step with an error indicating no OIDC token could be requested. Which change to the workflow is required to make OIDC federation work?

Accepted Answer

Add `permissions: id-token: write` (and `contents: read`) to the job so the workflow can request an OIDC token from GitHub.

Answer

Store the Azure client secret in an environment secret instead of a repository secret and reference it in the login step.

Answer

Set `permissions: id-token: read` at the workflow level so the runner can read the federated identity token.

Answer

Pin the azure/login action to a full commit SHA, because unpinned actions are blocked from minting OIDC tokens.