M365 Archive
Message Center

MC1447671Microsoft Entra: Migrate GitHub Actions federated identity credentials to immutable subjects

Summary

GitHub Actions now supports immutable OIDC subject formats with repository and owner IDs to enhance Microsoft Entra federated identity security. Organizations using GitHub Actions OIDC must migrate to this format by late July 2026 to prevent token mismatches and reduce unauthorized access risks.

More information

What and why

GitHub Actions now supports an immutable OpenID Connect (OIDC) subject format that includes immutable repository and owner IDs. This format reduces subject recycling risks associated with Microsoft Entra federated identity credentials (FICs) that rely on mutable repository and owner names.

Microsoft recommends migrating existing GitHub Actions FICs to the immutable subject format to strengthen workload identity security and reduce the risk of unauthorized access resulting from reused repository or owner names.

Rollout schedule

  • Beginning in late July 2026

Impact on your organization

Who is affected

  • Organizations that use GitHub Actions OIDC authentication with Microsoft Entra federated identity credentials.
  • Administrators who manage app registrations or user-assigned managed identities that trust GitHub Actions OIDC tokens should review existing FICs.

Platforms and services

  • Microsoft Entra
  • GitHub Actions
  • GitHub.com

What will happen

  • Existing FICs that use name-based subjects will continue to work for repositories that retain their current names and subject format.
  • FICs configured to trust only a previous name-based subject will not match tokens from repositories that use the immutable subject format.
  • Affected GitHub Actions workflows might fail to obtain Microsoft Entra tokens until the corresponding FICs are updated.
  • Existing repositories can be opted in to the immutable subject format through GitHub OIDC settings.

The immutable format appends the owner ID and repository ID to their corresponding names by using the @ delimiter.

Previous name-based format:

repo:<owner>/<repo>:ref:refs/heads/main

Immutable format:

repo:<owner>@<owner_id>/<repo>@<repo_id>:ref:refs/heads/main

The owner and repository IDs remain associated with the original resources and are not reused. This keeps the trust relationship bound to the intended repository.

Action required and recommendations

Action may be required if your organization uses GitHub Actions OIDC authentication with Microsoft Entra federated identity credentials.

To migrate an affected credential:

  • Create a new FIC that uses the immutable subject format.
  • Keep the existing name-based FIC in place during migration.
  • Enable the immutable subject format for the repository or workflow if it is not already enabled.
  • Validate that the workflow can successfully obtain a Microsoft Entra token using the new credential.
  • Remove the old name-based FIC after validation is complete.

For additional protection, consider using Flexible Federated Identity Credentials (preview) to validate immutable GitHub claims such as repository_id and repository_owner_id in addition to the sub claim.

Organizations should also periodically review and remove federated identity credentials that are no longer associated with active workloads.

Learn more

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.