Workload Identity Federation Preview

[tehcrashxor]

With the release of powerplatform-actions v1.5.0 and its underlying PAC v1.32.5, Service Principals can now authenticate with OpenID Connect (OIDC). This enables the removal of Client Secrets from the Actions Workflows.

To use this new option:

1. Configure the App Registration in the Azure Portal with federated credentials for your GitHub repo
2. Grant your Actions Workflow permissions for OIDC
3. Configure powerplatform-actions steps with app-id and tenant-id, without provide a client-secret

Add Federated Credentials to the App Registration

1. Go to App registrations in the Azure Portal and open the app associated with your Service Principal
2. Select Certificates and Secrets in the Manage panel
   
3. In the Federated credentials tab, select Add credential
   
4. Select the credential scenario Github Actions deploying Azure resources, and configure the credential with your GitHub Organization, Repository, and the target Branch, Tag, Environment, or Pull request that your Action will run against.
   

Note that each federated credential entry can only have a single Branch, Tag, Environment, or Pull Request target, but you may add additional entries for further targets if needed.

Example Actions Workflow

name: federated-workflow-example
on: [workflow_dispatch]
    
jobs: 
  federated-job-example:
    runs-on: ubuntu-latest

    permissions:
      id-token: write # Grant permissions to the OIDC endpoint for federation

    steps:
      - name: Install 
        uses: microsoft/powerplatform-actions/actions-install@v1
      - name: WhoAmI
        uses: microsoft/powerplatform-actions/who-am-i@v1
        with:
          environment-url: http://contoso.crm.dynamics.com
          app-id: 00000000-0000-0000-0000-000000000000
          tenant-id: 00000000-0000-0000-0000-000000000000

Documentation Links

Other than the above, we do not yet have documentation specifically for powerplatform-actions, but these are good references for setting up Federated Credentials for the Azure CLI, and the initial configuration is very similar:

• GitHub Docs: Configuring OpenID Connect in Azure
• Azure Docs: Use GitHub Actions to connect to Azure