Failed to add federated credential for GitHub

Question

Failed to add federated credential for GitHub

Michiel Oda 25

In the past we have added federated credentials like this:

Issuer: https://token.actions.githubusercontent.com

Type: Claims matching expression (Preview)

Value: claims['sub'] matches 'repo:{Organization}/*:ref:refs/heads/*' and claims['job_workflow_ref'] matches '{Organization}/{Repository}/*'

This properly worked. Then on July 15, GitHub changed the behaviour for new repositories so that the subject becomes immutable. On the 22th of July when I came back from holiday, I was able to add other credentials where the value was the following:

Value: claims['sub'] matches 'repo:{Organization}@*/*:ref:refs/heads/*' and claims['job_workflow_ref'] matches '{Organization}/{Repository}/*'

Today, I wanted to add another credential, but neither of the above syntaxes work anymore and I have the following error:

Failed to add federated credential. Error detail: The FederatedIdentityCredential.ClaimsMatchingExpression.Value is invalid. Rule exception: Expression configured for issuer 'https://token.actions.githubusercontent.com' either lacks all required claims or contains unallowed claims. paramName: FederatedIdentityCredential.ClaimsMatchingExpression.Value, paramValue: claims['sub'] matches 'repo:{Organization}/*:ref:refs/heads/*' and claims['job_workflow_ref'] matches '{Organization}/{Repository}/*', objectType: Microsoft.Online.DirectoryServices.Application

According to the documentation this should be correct, and it is correct as it worked before to add them.

This is blocking us as new repositories have immutable subjects by default (and can't be disabled anymore).

Goutam Pratti 6,215 Reputation points Microsoft External Staff Moderator

2026-08-03T16:24:42.89+00:00
Hi @Michiel Oda ,

Greetings of the day !

Based on the error and the current Microsoft Learn documentation, this looks less like a GitHub change and more like a recent** validation change on the Microsoft Entra flexible federated credential **service.

The documentation currently confirms that for GitHub-issued tokens, only the following claims are supported in flexible federated identity credentials:

sub

job_workflow_ref

And the supported operators are:

eq

matches

Your expression:
claims['sub'] matches 'repo:{Organization}/:ref:refs/heads/'

and

claims['job_workflow_ref'] matches '{Organization}/{Repository}/*'

matches the documented syntax format.

The error is:

Expression configured for issuer 'https://token.actions.githubusercontent.com' either lacks all required claims or contains unallowed claims.

This typically occurs when the backend validator rejects the expression before storing it.

Since:

The same pattern worked previously.

The Learn documentation still lists sub and job_workflow_ref as supported claims.

Existing credentials continue to function.

The failure now happens during creation of new credentials only.

This strongly suggests a service-side regression or policy change in Entra's flexible federated credential validation rather than an issue with GitHub itself.

Things to validate

**Try creating a simpler expression
**claims['sub'] matches 'repo:{Organization}/{Repository}:ref:refs/heads/*'

without job_workflow_ref.

**Try exact matching
**claims['sub'] eq 'repo:{Organization}/{Repository}:ref:refs/heads/main'

If even this fails, it further points to a backend validation issue.

a. Check whether the portal is rewriting the expression

There have been preview-feature regressions where the Azure Portal validation layer becomes stricter than the Graph backend.

b. Test via Microsoft Graph

The documentation states that flexible federated credentials are ultimately managed through Microsoft Graph and represented using the claimsMatchingExpression object.

Likely conclusion

Given the information provided:

The syntax appears consistent with the current Microsoft documentation.

The expression uses only supported claims and operators.

Previously created credentials using the same pattern worked.

The failure began recently and affects new credential creation.

The evidence points toward a Microsoft Entra Workload Identity validation regression/change affecting Flexible Federated Identity Credentials (Preview). Because this feature is still in preview, service-side validation changes can occur.

for additional information you can look at: https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-flexible-federated-identity-credentials?tabs=github

Let us know if you have any queries. Happy to assist you further.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

New requirement in this doc here states you need to have one or the other of repository_id or repository_owner_id in the claims matching expression. I validated it works for me now once I added that.

Add required claims to a flexible federated identity credential

For GitHub, a flexible federated identity credential must match the sub claim and one or both of the following additional claims:

repository_id identifies the repository where the workflow runs.
repository_owner_id identifies the repository owner.

These additional claims are required regardless of whether sub uses a name-based, customized, or immutable format. Include the claims that represent the intended trust boundary.