MT.1226 - GitHub and GitLab federated identity credentials should use immutable subject identifiers.
Overview
This test identifies application federated identity credentials for GitHub Actions and GitLab whose subjects appear to use mutable identifiers instead of immutable IDs.
Repository names, project paths and organization names can change or be reused. A credential that continues trusting a reused name can grant access to a different workload. Microsoft calls this subject recycling. Dangling credentials are particularly exposed because their trust remains configured after the original workload is gone.
The check examines application federated identity credential subject rules and claims-matching expressions. It identifies GitLab OIDC credentials by common GitLab claims, including project_id, project_path and ref_type. It checks the configured subject rule or the claimsMatchingExpression value:
- GitHub Actions: Reports subjects that do not start with
repo:<username>@<userid>/<repo>@<repoid>:, with numeric owner and repository IDs. - GitLab: Reports rules that do not include
project_id, the immutable project ID claim.
The test fails when at least one evaluated credential lacks the corresponding immutable identifier marker.
Remediation action
For each reported credential:
- Confirm that the trusted repository or project still exists and requires access. Delete credentials for workloads that are no longer used.
- For GitHub Actions, create a credential matching the immutable owner and repository IDs, then enable immutable subjects in the repository or organization OIDC settings.
- For GitLab, configure
ci_id_token_sub_claim_componentsto useproject_idinstead ofproject_path, and update the federated credential to match. - Validate pipeline authentication before removing the old name-based credential.
Related links
- Mutable subjects in federated identity credentials
- Migrate GitHub Actions federated credentials to immutable subjects
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1226 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Related products | GitHub |
| Feature | Applications |
| Area | Applications and workload identities |
| Resource type | Application |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1199 Trusted Relationship |
| Supports controls | nist-800-53-r5:IA-4 |
| PowerShell test | Test-MtImmutableFederatedCredentialSubject |
| Services | Graph |
| Lifecycle | Preview |
| Long running | Yes |
Source
- Test:
tests/maester/entra/Test.MT.1226.ps1 - Documentation:
tests/maester/entra/Test.MT.1226.md