GitHub and GitLab federated identity credentials should use immutable subject identifiers

Contributed by Nicola SuterAll contributors →

Part of Maester · Entra ID · Applications · All checks

Run this check

Invoke-Maester -TestId MT.1226 -IncludePreview

Overview

This test identifies application federated identity credentials for GitHub Actions and GitLab whose subjects appear to use mutable identifiers instead of immutable IDs.

Repository names, project paths and organization names can change or be reused. A credential that continues trusting a reused name can grant access to a different workload. Microsoft calls this subject recycling. Dangling credentials are particularly exposed because their trust remains configured after the original workload is gone.

The check examines application federated identity credential subject rules and claims-matching expressions. It identifies GitLab OIDC credentials by common GitLab claims, including project_id, project_path and ref_type. It checks the configured subject rule or the claimsMatchingExpression value:

• GitHub Actions: Reports subjects that do not start with repo:<username>@<userid>/<repo>@<repoid>:, with numeric owner and repository IDs.
• GitLab: Reports rules that do not include project_id, the immutable project ID claim.

The test fails when at least one evaluated credential lacks the corresponding immutable identifier marker.

Remediation action

For each reported credential:

1. Confirm that the trusted repository or project still exists and requires access. Delete credentials for workloads that are no longer used.
2. For GitHub Actions, create a credential matching the immutable owner and repository IDs, then enable immutable subjects in the repository or organization OIDC settings.
3. For GitLab, configure ci_id_token_sub_claim_components to use project_id instead of project_path, and update the federated credential to match.
4. Validate pipeline authentication before removing the old name-based credential.

Related links

• Mutable subjects in federated identity credentials
• Migrate GitHub Actions federated credentials to immutable subjects

Details

Every attribute of this check

Field	Value
Test ID	MT.1226
Severity	Medium
Suite	Maester
Product	Entra ID
Related products	GitHub
Feature	Applications
Area	Applications and workload identities
Resource type	Application
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1199 Trusted Relationship
Supports controls	nist-800-53-r5:IA-4
PowerShell test	Test-MtImmutableFederatedCredentialSubject
Services	Graph
Lifecycle	Preview
Long running	Yes

Source

• Test: tests/maester/entra/Test.MT.1226.ps1
• Documentation: tests/maester/entra/Test.MT.1226.md