Configure Workload Identity Federation for keyless CI/CD
Implementation Effort: Medium – Configuring federated credentials, trust conditions, and scoped RBAC for each pipeline and platform is a multi-step effort with cloud and platform owners.
User Impact: Low – Federation changes how pipelines authenticate to Azure; developers and end users are not affected.
Lifecycle Stage: Build
Overview
Configure Workload Identity Federation so CI/CD pipelines authenticate to Azure without stored secrets. This is the primary defense against OWASP CICD-SEC-6 (Insufficient Credential Hygiene).
Workload Identity Federation allows CI/CD pipelines to authenticate to Azure using OpenID Connect (OIDC) tokens issued by the pipeline platform — GitHub Actions or Azure DevOps — instead of relying on stored client secrets or certificates. No persistent credential is stored in the repository, in GitHub secrets, or in an Azure DevOps service connection secret.
Eliminating stored secrets from CI/CD pipelines materially reduces risk. Long-lived service principal secrets are high-value targets because a single compromised credential can provide direct access to Azure resources, often with broad permissions, and can be used from any network location until it is rotated. Workload Identity Federation removes that class of exposure by issuing short-lived tokens per run that are constrained by time, audience, and the federated identity conditions defined in the trust policy.
GitHub Actions
For GitHub Actions, configure federated credentials on the Microsoft Entra ID app registration and scope access to the repository and, as needed, specific refs or deployment environments. GitHub Actions OIDC tokens include claims such as repository and ref (branch or tag) and, when using environments, the environment name. Restrict the federated credential subject to the specific repository plus ref and/or environment, such as repo:org/repo:ref:refs/heads/main or repo:org/repo:environment:prod.
Azure DevOps
For Azure DevOps, configure a workload identity federation Azure Resource Manager service connection and scope trust to the Azure DevOps organization, project, and specific service connection. Azure DevOps workload identity federation tokens include service connection and project context, but they do not contain repository branch or environment claims in the token itself in the same way GitHub Actions does. Enforce branch and environment restrictions through Azure DevOps Environments approvals and checks, branch policies, and pipeline or service-connection permissions rather than through federated credential subject claims.
Validate the audience claim so tokens are accepted only by the intended Azure application. Workload Identity Federation replaces the credential, but it does not by itself enforce least privilege, so scope the resulting Azure RBAC role assignment to the minimum resources needed.
Federation replaces long-lived secrets with short-lived tokens and ties Azure access to the specific workflow or service connection that requested it. That improves auditability and reduces credential-theft risk, but only when combined with least-privilege RBAC, environment approvals, branch policies, and service-connection controls.