Microsoft Entra: Migrating GitHub Actions Federated Credentials to Immutable Subjects
Microsoft recently recommended migrating GitHub Actions federated credentials to an immutable subject format in Microsoft Entra app registrations. This closes a subtle security gap where recycled repo or org names could let someone else’s token match your trust configuration. In this post, I walk through what the migration actually involves. I also tested the newer Flexible Federated Identity Credentials (FFIC), currently in preview.
13. August 2026