Github Entra Federated Credentials

What this skill does

Automates the complete Entra ID federated credentials setup for a GitHub repository:

1. Creates an Entra app registration and service principal
2. Fetches the GitHub owner ID and repository ID (needed for the correct OIDC subject)
3. Creates a federated credential with the right subject format
4. Creates the GitHub Environment if it doesn't exist
5. Registers AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID as secrets

Prerequisites

Before running, verify:

• az CLI installed and logged in (az login)
• gh CLI installed and logged in (gh auth login)
• User has permission to create app registrations in the Entra tenant

Inputs to collect

Ask the user for any missing values before running the script:

Running the setup script

Collect all required inputs from the user first, then run the script for their environment.

Windows (PowerShell):

pwsh "<skill_dir>/scripts/setup.ps1" `
  -AppName "<app name>" `
  -Repo "<owner/repo>" `
  -Environment "<env name>" `
  [-ResourceGroup "<rg name>"]

macOS / Linux (Bash):

bash "<skill_dir>/scripts/setup.sh" \
  --app-name "<app name>" \
  --repo "<owner/repo>" \
  --environment "<env name>" \
  [--resource-group "<rg name>"]

<skill_dir> is the directory containing this SKILL.md file.

OIDC subject format — why IDs matter

GitHub's OIDC tokens use a subject in this format:

repo:{owner}@{owner_id}/{repo}@{repo_id}:environment:{env}

This is not the same as repo:{owner}/{repo}:environment:{env}. The numeric owner and repository IDs must be included. The script fetches them automatically via gh api. Registering the wrong subject causes AADSTS700213 errors at runtime.

After setup

The workflow template printed by the script is ready to use. The three secrets (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID) are scoped to the specified GitHub Environment, so the workflow must declare environment: <env name>.

Troubleshooting