Microsoft Entra Workload ID

Flexible federated identity credentials (preview)

18 August 2026Feature update+22 / −12 lines

In brief

The documentation now states that GitHub flexible federated identity credentials must match `sub` and at least one immutable claim: `repository_id` or `repository_owner_id`. It also updates examples and operator support details.

What Entra admins need to know

When creating or reviewing GitHub flexible FICs, use `eq` for the supported immutable repository claims to bind trust appropriately.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Flexible federated identity credentials (preview)

| Operator | The operator portion must be just the operator name, separated from the claim lookup and comparand by a single space | matches | | Comparand | The comparand contains what you intend to compare the claim specified in the lookup against – it must be contained within single quotes | 'repo:contoso/contoso-repo:ref:refs/heads/*' |

Put together, an example GitHub flexible federated identity ~~credentials~~credential expression ~~would look~~looks like the following JSON ~~object:~~object. GitHub expressions must match sub and at least one immutable claim:

"claims['sub'] matches 'repo:contoso/contoso-repo:ref:refs/heads/*'. and claims['repository_id'] eq '456789'"

Set up federated identity credentials through Microsoft Graph

Operator	Description	Example
`matches`	Enables the use of single-character (denoted by `?`) and multi-character (denoted by `*`) wildcard matching for the specified claim	• `"claims['sub'] matches 'repo:contoso/contoso-repo:ref:refs/heads/' and claims['repository_id'] eq '456789'"` • `"claims['sub'] matches 'repo:contoso/contoso-repo-:ref:refs/heads/????' and claims['repository_owner_id'] eq '123456'"`
`eq`	Used for explicitly matching against a specified claim	• `"claims['sub'] eq 'repo:contoso/contoso-repo:ref:refs/heads/main' and claims['repository_id'] eq '456789'"`
`and`	Boolean operator for combining expressions against multiple claims	• `"claims['sub'] eq 'repo:contoso/contoso-repo:ref:refs/heads/main' and claims['repository_id'] eq '456789' and claims['job_workflow_ref'] matches 'foo-org/bar-repo /.repo/.github/workflows/*@refs/heads/main'"`

Issuer URLs, supported claims, and operators by platform

Supported issuer URLs: https://token.actions.githubusercontent.com

For GitHub, a flexible federated identity credential must match the sub claim and one or both of the following immutable claims:

repository_id identifies the repository where the workflow runs.
repository_owner_id identifies the repository owner.

These claims are required regardless of whether sub uses a name-based, customized, or immutable format. Use repository_id to bind the credential to a repository. Also match repository_owner_id when the repository must remain with a specific owner.

Supported claims and operators per claim:

Claim sub supports operators eq and matches.
Claim job_workflow_ref supports operators eq and matches.
Claim repository_id supports operator eq.
Claim repository_owner_id supports operator eq.

GitLab

az rest --method post \
    --url https://graph.microsoft.com/beta/applications/{objectId}/federatedIdentityCredentials
    --body "{'name': 'FlexFic1', 'issuer': 'https://token.actions.githubusercontent.com', 'audiences': ['api://AzureADTokenExchange'], 'claimsMatchingExpression': {'value': 'claims[\'sub\'] matches \'repo:contoso/contoso-org:repo:ref:refs/heads/*\' and claims[\'repository_id\'] eq \'456789\'', 'languageVersion': 1}}"

Related content

@@ -1,11 +1,12 @@ --- title: Flexible federated identity credentials (preview)-description: Learn about Microsoft Entra Workload ID Flexible federated identity credentials and its capabilities.+description: Learn how Microsoft Entra Workload ID flexible federated identity credentials match token claims and reduce credential management overhead. ms.topic: concept-article-ms.date: 08/28/2024-ms.custom: +ms.date: 08/14/2026+ms.custom: msecd-doc-authoring-1018 ms.reviewer: ludwignick-#Customer intent: I want to know about Microsoft Entra Workload ID Flexible federated identity credentials.+ai-usage: ai-assisted+#customer intent: As an application administrator, I want to understand flexible federated identity credentials so that I can manage trust for external workloads. ---  # Flexible federated identity credentials (preview)@@ -44,10 +45,10 @@ A flexible federated identity credentials expression is made up of three parts, | Operator | The operator portion must be just the operator name, separated from the claim lookup and comparand by a single space | `matches` | | Comparand | The comparand contains what you intend to compare the claim specified in the lookup against – it must be contained within single quotes | `'repo:contoso/contoso-repo:ref:refs/heads/*'` | -Put together, an example flexible federated identity credentials expression would look like the following JSON object:+Put together, an example GitHub flexible federated identity credential expression looks like the following JSON object. GitHub expressions must match `sub` and at least one immutable claim:  ```json-"claims['sub'] matches 'repo:contoso/contoso-repo:ref:refs/heads/*'."+"claims['sub'] matches 'repo:contoso/contoso-repo:ref:refs/heads/*' and claims['repository_id'] eq '456789'" ```  ## Set up federated identity credentials through Microsoft Graph@@ -66,9 +67,9 @@ Flexible federated identity credentials currently support the use of a few opera  | Operator | Description | Example | | --- | --- | --- |-| `matches` | Enables the use of single-character (denoted by `?`) and multi-character (denoted by `*`) wildcard matching for the specified claim  | &#8226; `"claims['sub'] matches 'repo:contoso/contoso-repo:ref:refs/heads/*'"` <br/>&#8226; `"claims['sub'] matches 'repo:contoso/contoso-repo-*:ref:refs/heads/????'"` |-| `eq` | Used for explicitly matching against a specified claim | &#8226; `"claims['sub'] eq 'repo:contoso/contoso-repo:ref:refs/heads/main'"`  |-| `and` | Boolean operator for combining expressions against multiple claims | &#8226; `"claims['sub'] eq 'repo:contoso/contoso-repo:ref:refs/heads/main' and claims['job_workflow_ref'] matches 'foo-org/bar-repo /.github/workflows/*@refs/heads/main'"` |+| `matches` | Enables the use of single-character (denoted by `?`) and multi-character (denoted by `*`) wildcard matching for the specified claim  | &#8226; `"claims['sub'] matches 'repo:contoso/contoso-repo:ref:refs/heads/*' and claims['repository_id'] eq '456789'"` <br/>&#8226; `"claims['sub'] matches 'repo:contoso/contoso-repo-*:ref:refs/heads/????' and claims['repository_owner_id'] eq '123456'"` |+| `eq` | Used for explicitly matching against a specified claim | &#8226; `"claims['sub'] eq 'repo:contoso/contoso-repo:ref:refs/heads/main' and claims['repository_id'] eq '456789'"`  |+| `and` | Boolean operator for combining expressions against multiple claims | &#8226; `"claims['sub'] eq 'repo:contoso/contoso-repo:ref:refs/heads/main' and claims['repository_id'] eq '456789' and claims['job_workflow_ref'] matches 'foo-org/bar-repo/.github/workflows/*@refs/heads/main'"` |   ## Issuer URLs, supported claims, and operators by platform@@ -79,10 +80,19 @@ Depending on the platform you're using, you need to implement different issuer U  Supported issuer URLs: `https://token.actions.githubusercontent.com`  +For GitHub, a flexible federated identity credential must match the `sub` claim and one or both of the following immutable claims:++- `repository_id` identifies the repository where the workflow runs.+- `repository_owner_id` identifies the repository owner.++These claims are required regardless of whether `sub` uses a name-based, customized, or immutable format. Use `repository_id` to bind the credential to a repository. Also match `repository_owner_id` when the repository must remain with a specific owner.+ Supported claims and operators per claim:  -- Claim `sub` supports operators `eq` and `matches` -- Claim `job_workflow_ref` supports operators `eq` and `matches` +- Claim `sub` supports operators `eq` and `matches`.+- Claim `job_workflow_ref` supports operators `eq` and `matches`.+- Claim `repository_id` supports operator `eq`.+- Claim `repository_owner_id` supports operator `eq`.  ### [GitLab](#tab/gitlab) @@ -111,7 +121,7 @@ You can use Azure CLI's `az rest` method to make REST API requests for flexible ```bash az rest --method post \     --url https://graph.microsoft.com/beta/applications/{objectId}/federatedIdentityCredentials-    --body "{'name': 'FlexFic1', 'issuer': 'https://token.actions.githubusercontent.com', 'audiences': ['api://AzureADTokenExchange'], 'claimsMatchingExpression': {'value': 'claims[\'sub\'] matches \'repo:contoso/contoso-org:ref:refs/heads/*\'', 'languageVersion': 1}}"+    --body "{'name': 'FlexFic1', 'issuer': 'https://token.actions.githubusercontent.com', 'audiences': ['api://AzureADTokenExchange'], 'claimsMatchingExpression': {'value': 'claims[\'sub\'] matches \'repo:contoso/contoso-repo:ref:refs/heads/*\' and claims[\'repository_id\'] eq \'456789\'', 'languageVersion': 1}}" ```  ## Related content