GitHub Actions azure/login Federated Credential "AADSTS70021" / No Token

By Daniel Zoghalchali·Latchkey

azure/login could not complete OIDC federation. The job is missing id-token: write, the app registration has no federated credential matching this workflow subject, or the client/tenant ids are wrong.

What this error means

The azure/login step fails with an AADSTS error stating no matching federated identity was found, or that no assertion was provided. Subsequent az/azure steps fail with no credentials.

Error: AADSTS70021: No matching federated identity record found for
presented assertion subject 'repo:org/repo:ref:refs/heads/main'.

Common causes

Missing id-token permission

OIDC federation requires permissions: id-token: write so the workflow can mint the token Azure validates. Without it, no assertion is presented.

Federated credential subject mismatch

The app registration federated credential subject must match the workflow context exactly (repo, branch/tag, environment, or pull_request). A main-only credential rejects a PR or environment-scoped run.

How to fix it

Grant id-token and pass the ids

permissions:
  id-token: write
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

Match the federated credential subject

1. Add a federated credential whose subject matches the exact trigger (branch, tag, environment, or pull_request).
2. For environment-scoped deploys, use the environment subject form.
3. Double-check client-id and tenant-id point at the right app registration and directory.

How to prevent it

• Set id-token: write on every Azure OIDC job.
• Create a federated credential per trigger type you actually use.
• Store client/tenant/subscription ids as secrets and reference them consistently.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions