Azure App Service "No credentials found ... AZURE_WEBAPP_PUBLISH_PROFILE" in CI

By Daniel Zoghalchali·Latchkey

The webapps-deploy action needs either an azure/login session or a publish-profile to authenticate to App Service. When the secret holding the publish profile is empty or missing, the action stops before deploying.

What this error means

The Azure webapps-deploy step fails with "Error: No credentials found. Add an Azure login action before this action or provide 'publish-profile' input."

Error: No credentials found. Add an Azure login action before this action.
For more information and usage of action, refer to
https://github.com/Azure/webapps-deploy

Common causes

The publish-profile secret is empty or unset

The secret referenced by publish-profile does not exist, was never populated, or is not exposed to the job, so the action has no credential.

No azure/login ran before the deploy

When using OIDC/service principal auth instead of a publish profile, the login step is required first and was missing.

How to fix it

Provide the publish profile secret

1. Download the publish profile from the web app in the portal.
2. Store it as a repository secret (for example AZURE_WEBAPP_PUBLISH_PROFILE).
3. Pass it to the deploy action.

- uses: azure/webapps-deploy@v3
  with:
    app-name: my-app
    publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
    package: .

Or log in with a service principal first

Use azure/login with OIDC so the deploy action inherits an authenticated session.

- uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

How to prevent it

• Store the publish profile in a secret and reference it exactly.
• For OIDC, place azure/login before the deploy step.
• Regenerate the publish profile after resetting deployment credentials.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation