GitHub Actions can authenticate to Microsoft Entra without storing a long-lived client secret or certificate in GitHub: the workflow requests a GitHub OIDC token, and Entra exchanges it for an access token after validating a configured trust. But that standard workload-federation flow is not, by itself, a documented recipe for minting a specialized Entra Agent ID token. Microsoft describes Agent ID as a separate blueprint-to-agent identity flow, and the available documentation does not establish the complete GitHub Actions wiring for it.
What GitHub Actions can mint through Entra federation
In the standard workload identity federation flow, GitHub Actions requests an OIDC token that represents the workflow job. Microsoft Entra validates the token against a federated identity credential configured for that GitHub context, then issues an access token for the configured identity. That token can be used to call resources for which the identity has been authorized. Microsoft’s workload identity federation documentation explains the exchange.
As an Amazon Associate I earn from qualifying purchases.
This is commonly described as secretless authentication because the workflow does not need a stored, long-lived client secret or certificate. It is not credential-free in the literal sense: the Entra identity and trust configuration remain in place, workflow settings contain identifiers and permissions, and both the GitHub assertion and Entra access token exist temporarily during execution.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy an Entra Agent ID token is a different claim
A normal Entra access token obtained through workload federation is not automatically an Entra Agent ID token. Microsoft documents Agent ID as a distinct flow: first obtain a token for an agent identity blueprint, then use that token to request a token for an agent identity. That flow requires an agent identity blueprint, the agent identity client ID, and appropriate resource permissions. Microsoft’s Agent ID authentication documentation describes the sequence.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The standard GitHub federation documentation and the Agent ID documentation do not provide a complete, joined-up GitHub Actions procedure for this specialized token. In particular, they do not establish the exact assertion wiring and supported client behavior for that combination. Do not treat a standard Azure workload-federation YAML example as proof that it produces an Agent ID token. Microsoft recommends approved libraries for Agent ID and cautions that manually implementing the protocol is complex and error-prone. Confirm the current supported library and assertion flow before implementing GitHub-to-Agent-ID authentication.
Configure the standard GitHub-to-Entra federation flow
For an ordinary Azure deployment or other Entra-protected resource, the documented setup follows these steps. Choose the identity type that matches the resource and workflow: Microsoft’s standard Azure deployment guidance uses an app registration/service principal or a user-assigned managed identity. Agent ID blueprints and agent identities are separate identity types, not interchangeable substitutes.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Create or select the Entra identity. Use the identity type required by the standard workload you are authenticating. For an Agent ID scenario, follow the distinct blueprint and agent identity model rather than assuming a conventional deployment identity is equivalent.
- Add a federated identity credential. Configure the GitHub issuer as
https://token.actions.githubusercontent.comand bind the credential to the intended repository and workflow context. Depending on the selected context, the subject can represent an environment, branch, pull request, or tag. The issuer, subject, and audience must match the incoming token exactly, including capitalization. Microsoft’s federation guide covers the trust configuration. - Allow the workflow job to request an OIDC token. Set
id-token: writefor only the job that needs federation. This permission allows the job to request a GitHub OIDC token; it does not grant access to Azure resources or Microsoft Graph. Microsoft’s Power Platform GitHub Actions tutorial shows it alongsidecontents: read. - Authorize the Entra identity separately. Assign only the resource roles or application permissions the task requires. For Azure Login, the identity needs an appropriate Azure role; Agent ID autonomous access has its own application-permission and administrator-consent requirements. Authentication proves which identity is acting; authorization determines what it can do.
- Request and use tokens at runtime. Use the supported client or action for the chosen standard flow, then call only the authorized resource. Never print the GitHub assertion or Entra access token to workflow logs. Treat both as short-lived credentials while they are present in the job process.
Make the trust match the workflow you intend to allow
A federated credential is a security boundary. Its issuer, subject, and audience must correspond to the token GitHub presents; a mismatch, including a case difference, prevents the exchange. Standard branch and tag pattern matching is not supported, so do not assume that a wildcard credential covers a family of branches or tags. Select and configure a supported workflow context deliberately.
Consider the consequences of repository or owner changes as well. Microsoft warns that the original name-based GitHub subject can be vulnerable to subject recycling if a repository or owner is renamed, transferred, or reused. Microsoft documents migration to immutable subjects. Flexible federated credentials can match immutable repository and owner IDs, but Microsoft’s documentation identifies that feature as preview. Check its current availability and API behavior before depending on it in production. Microsoft’s federation documentation and subject-pattern guidance describe these considerations.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Bind trust to the narrowest supported repository and workflow context that fits the job.
- Keep
id-token: writescoped to the job that needs it. - Grant the identity only the permissions required for the task.
- Review trust configuration when repository ownership, names, or workflow context changes.
What “nothing stored” should mean
With workload identity federation, you can avoid storing a long-lived client secret or certificate in GitHub Actions. You still store the Entra identity and federation trust, and the workflow retains configuration such as identity identifiers and permission settings. Tokens are created at runtime and should be protected from logs and other unintended exposure. Federation changes how the workflow proves its identity; it does not remove persistent configuration or the temporary credentials required to make authenticated calls.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
