Login with updated federated credentials are not working

[JussiSpogen]

Azure portal requires creating federated credentials so that they include owner id and repository id and that results to subject identifiers of following format: repo:<org>@<org-id>/<repo>@<repo-id>:<entity>:<entity-identifier>, for example repo:acme-org@123456789/acme-application@987654321:environment:production. These new type of federated identities are not working currently.

The error that results from trying to run the login is as follows:

Error: AADSTS700213: No matching federated identity record found for presented assertion subject 'repo:acme-org/acme-application:environment:production'. Check your federated identity credential Subject, Audience and Issuer against the presented assertion.

There is a workaround by modifying the federated credential manually so that you remove the org-id and repo-id from the subject but I'd assume the federated credential created through the portal should work as is without this manual hack.

[ViktorDronov]

you just need enable this checkbox on a repository or use federated creds w\o IDs

[JussiSpogen]

Thanks Viktor! That seems to work.
I think this would be good to document somewhere by the Azure/login team as the Azure portal defaults to the immutable subjects when creating the federated credentials and GitHub doesn't seem to default to using them.

[ViktorDronov]

Jussi Kalliomäki (@JussiSpogen) this change not directly related to the azure/login action but to GitHub itself
This was announced some time ago that immutable IDs start to be used for new repos https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/

But this have no impact currently for old repos where you are able enable this feature, but also can stay without it

[MaddyMicrosoft]

This has been added to documentation #620
If this becomes a blocking issue in the future, please open a fresh issue.