Azure managed identity using to authenticate in github worflow actions

We can federate our managed identity in a more flexible manner especially when we need to use it against github and allows our build against different branch without 20 federated credential limits. 

Here is an example of how we can federate our managed identity

 az identity federated-credential create  --name "github-actions-main"  --identity-name %IDENTITY_NAME%  --resource-group %RG_NAME% --issuer "https://token.actions.githubusercontent.com"   --subject "claims['sub'] matches 'repo:%REPO%:ref:refs/heads/*'"  --audience "api://AzureADTokenExchange"

Validating that against our Azure portal, we can get more information here

However trying to run this in github, I am still not able to get it to run successfully. That's for a good reason. 

The reason I am getting the AADSTS700213 error is because User-Assigned Managed Identities do not yet support wildcard matching for OIDC subjects.

Azure recently introduced "Flexible federated identity credentials" (which is what allows you to use the claims['sub'] matches '...*' expression). However, this feature is currently only available for App Registrations (Service Principals). For Managed Identities, Azure still enforces strict, exact-string matching on the subject claim. Because GitHub is passing the exact branch name (like main), Entra ID rejects it as a mismatch against your wildcard expression.

In Microsoft Entra ID terminology, "application objects" refers specifically to App Registrations. While User-Assigned Managed Identities do use workload identity federation, they are backed by Service Principal objects rather than Application objects. Because of this architectural difference under the hood, Microsoft has not yet rolled out the flexible credentials (wildcard) preview feature to Managed Identities.

You can run the following command just to test out with your service principal (replace it with your service principal). This will work for app registration and won't work for managed identity. 

az rest --method post --url https://graph.microsoft.com/beta/applications/your-service-principal-here/federatedIdentityCredentials --body "{'name': 'FlexFic1', 'issuer': 'https://token.actions.githubusercontent.com', 'audiences': ['api://AzureADTokenExchange'],'claimsMatchingExpression': {'value': 'claims[\'sub\'] matches \'  repo:kepungnzai/dot-net-gw:ref:refs/heads/*\'','languageVersion': 1}}"

Having said that, using managed identity is not possible with flexible federated credentials but it is possible using Azure App Registrations.