OIDC Azure "AADSTS70021: No matching federated identity record found" in CI

By Daniel Zoghalchali·Latchkey

Entra ID received the OIDC assertion but found no federated identity credential whose issuer, subject, and audience all match it. The app registration has no credential for this repo/branch, or its subject string differs.

What this error means

azure/login fails with "AADSTS70021: No matching federated identity record found for presented assertion." The token reached Entra ID but no federated credential matched.

Error: AADSTS70021: No matching federated identity record found for
presented assertion. Assertion Issuer: 'https://token.actions.githubusercontent.com'.
Assertion Subject: 'repo:my-org/my-repo:ref:refs/heads/main'.

Common causes

No federated credential for this subject

The app registration has no federated identity credential whose subject equals the token's sub (for example a branch credential when the job runs on a tag).

Issuer or audience does not match

The credential's issuer must be https://token.actions.githubusercontent.com and audience api://AzureADTokenExchange; a mismatch yields no match.

How to fix it

Add a federated credential matching the subject

1. Read the "Assertion Subject" line in the error.
2. Create a federated identity credential on the app registration with that exact subject.
3. Set issuer to the GitHub OIDC URL and audience to api://AzureADTokenExchange.

{
  "name": "gha-main",
  "issuer": "https://token.actions.githubusercontent.com",
  "subject": "repo:my-org/my-repo:ref:refs/heads/main",
  "audiences": ["api://AzureADTokenExchange"]
}

Add separate credentials per ref type

Tags, environments, and pull_request each produce a different subject; add a credential for each entity you deploy from.

# example subjects to register
repo:my-org/my-repo:ref:refs/heads/main
repo:my-org/my-repo:environment:production
repo:my-org/my-repo:pull_request

How to prevent it

• Create a federated credential for each ref/environment you deploy from.
• Keep issuer and audience exactly as GitHub and Entra ID expect.
• Copy the "Assertion Subject" from the error verbatim.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions