# GitHub and GitLab federated identity credentials should use immutable subject identifiers

This test identifies application federated identity credentials for GitHub Actions and GitLab whose subjects appear to use mutable identifiers instead of…

Source: https://maester.dev/docs/tests/MT.1226

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nicolonsky" title="Nicola Suter · Original author"><img src="https://github.com/nicolonsky.png" alt="Nicola Suter" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nicolonsky">Nicola Suter</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Applications · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1226 -IncludePreview
```

## Overview

This test identifies application federated identity credentials for GitHub Actions and GitLab whose subjects appear to use mutable identifiers instead of immutable IDs.

Repository names, project paths and organization names can change or be reused. A credential that continues trusting a reused name can grant access to a different workload. Microsoft calls this subject recycling. Dangling credentials are particularly exposed because their trust remains configured after the original workload is gone.

The check examines application federated identity credential subject rules and claims-matching expressions. It identifies GitLab OIDC credentials by common GitLab claims, including `project_id`, `project_path` and `ref_type`. It checks the configured subject rule or the `claimsMatchingExpression` value:

* GitHub Actions: Reports subjects that do not start with `repo:<username>@<userid>/<repo>@<repoid>:`, with numeric owner and repository IDs.
* GitLab: Reports rules that do not include `project_id`, the immutable project ID claim.

The test fails when at least one evaluated credential lacks the corresponding immutable identifier marker.

#### Remediation action

For each reported credential:

1. Confirm that the trusted repository or project still exists and requires access. Delete credentials for workloads that are no longer used.
2. For GitHub Actions, create a credential matching the immutable owner and repository IDs, then enable immutable subjects in the repository or organization OIDC settings.
3. For GitLab, configure `ci_id_token_sub_claim_components` to use `project_id` instead of `project_path`, and update the federated credential to match.
4. Validate pipeline authentication before removing the old name-based credential.

#### Related links

- [Mutable subjects in federated identity credentials](https://learn.microsoft.com/entra/workload-id/workload-identities-federated-credential-mutable-subjects)
- [Migrate GitHub Actions federated credentials to immutable subjects](https://learn.microsoft.com/entra/workload-id/workload-identities-github-immutable-subjects)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1226 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Related products | GitHub |
| Feature | Applications |
| Area | Applications and workload identities |
| Resource type | Application |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1199 Trusted Relationship |
| Supports controls | nist-800-53-r5:IA-4 |
| PowerShell test | [Test-MtImmutableFederatedCredentialSubject](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1226.ps1) |
| Services | Graph |
| Lifecycle | Preview |
| Long running | Yes |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1226.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1226.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1226.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1226.md)