federatedIdentityCredential resource type

Namespace: microsoft.graph

References an application's federated identity credentials. These federated identity credentials are used in workload identity federation when exchanging a token from a trusted issuer for an access token linked to an application registered on Microsoft Entra ID.

Inherits from entity.

Methods

Method	Return type	Description
List	federatedIdentityCredential collection	Get a list of the federatedIdentityCredential objects and their properties.
Create	federatedIdentityCredential	Create a new federatedIdentityCredential object.
Get	federatedIdentityCredential	Read the properties and relationships of a federatedIdentityCredential object.
Update	None	Update the properties of a federatedIdentityCredential object.
Upsert	federatedIdentityCredential	Create a new federatedIdentityCredential if it doesn't exist, or update the properties of an existing federatedIdentityCredential object.
Delete	None	Deletes a federatedIdentityCredential object.

Properties

Property	Type	Description
audiences	String collection	The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
description	String	The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
id	String	The unique identifier for the federated identity. Required. Read-only.
issuer	String	The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
name	String	The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
subject	String	Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.federatedIdentityCredential",
  "audiences": [
    "String"
  ],
  "description": "String",
  "issuer": "String",
  "name": "String",
  "subject": "String"
}