INSIGHTS / DEVSECOPS
GitHub Actions to Azure without stored secrets.
Workload identity federation lets GitHub Actions authenticate to Azure with short-lived tokens. Here is how to configure it precisely, and the mistakes that quietly widen access.
The problem with stored credentials
A client secret stored in CI is a long-lived, bearer credential. It can be exfiltrated by a compromised dependency or a malicious workflow change, and rotating it is a chore that is often postponed. Federation removes the stored secret entirely.
How federation works
When a job requests it, GitHub issues a signed OpenID Connect token describing the workflow run: repository, branch or environment, and more. Microsoft Entra ID trusts tokens from GitHub's issuer for a specific subject and exchanges them for a short-lived Azure access token.
- Issuer: https://token.actions.githubusercontent.com
- Audience: api://AzureADTokenExchange
- Subject example: repo:ORG/REPO:environment:production
Bind subjects precisely
The subject claim is the security boundary. Binding to an environment means only jobs that declare that environment can obtain the token; binding to refs/heads/main limits it to that branch. Avoid broad patterns, and remember that pull-request subjects can be triggered by contributors.
Use separate identities for separate duties
One identity that can plan, apply infrastructure and deploy code is a single point of compromise. Split them so that each has only what it needs.
- Plan identity: read-only on resources, read-only on Terraform state
- Apply identity: can change the resource group, but cannot grant itself broader access
- Deploy identity: can publish application code, but cannot change infrastructure
Add release controls GitHub can enforce
Environment protection rules such as required reviewers make approvals enforceable, but they depend on your GitHub plan and repository visibility. Check what your plan supports. Manually triggering a workflow is not, by itself, an approval control.
Verify the target, every time
After login, have the workflow compare the actual subscription and tenant IDs with the expected values and stop if they differ. Display names are not identifiers. This guard is cheap and prevents expensive mistakes.
Summary
Federation removes stored secrets, but precision still matters: exact subjects, separate least-privilege identities, enforceable approvals and explicit subscription checks.
Contact: contact@nexaarislabs.com