Microsoft Entra: Protect your federated identity credentials from mutable subject risks

[What and why]

Microsoft is improving guidance for Microsoft Entra federated identity credentials (FICs) to help protect organizations from risks associated with mutable subject identifiers.

Federated identity credentials allow workloads running on external platforms, such as CI/CD systems and other OpenID Connect (OIDC) providers, to obtain Microsoft Entra tokens without managing secrets. Some identity providers build subject claims from names that can be changed, renamed, transferred, deleted, or reused.

When a federated identity credential relies on mutable identifiers, trust that was originally established for one workload could unintentionally apply to a different workload if the identifier is later reused. To help reduce this risk, we recommend reviewing federated identity credentials and using immutable identifiers whenever supported by the identity provider.

This is a security improvement and is not a breaking change. Existing federated identity credentials will continue to function.

[Rollout schedule]

• Worldwide: Available now

[Impact on your organization]

Who is affected

Organizations that use Microsoft Entra federated identity credentials with external OpenID Connect (OIDC) identity providers, including GitLab.

Platforms and services

• Microsoft Entra ID
• Workload identities
• Federated identity credentials
• External OIDC identity providers

What will happen

Federated identity credentials that trust mutable, name-based subject claims may be vulnerable to subject recycling scenarios.

This risk can occur when:

• A federated identity credential trusts a name-based identifier such as a project, repository, group, or namespace name.
• The original resource is deleted, renamed, or transferred.
• The identifier becomes available and is claimed by another party.
• A token issued for the new resource matches the existing federated identity credential and receives access that was originally intended for the previous workload.

Organizations should also review for dangling federated identity credentials that remain configured after the associated workload no longer exists. These credentials present additional risk when they rely on mutable identifiers.

No service disruption is expected as part of this change.

[Action required and recommendations]

Review your federated identity credentials and adopt the following best practices:

• Use immutable claims whenever your identity provider supports them.
• Remove federated identity credentials associated with workloads that no longer exist.
• Regularly audit federated identity credentials to verify that they continue to represent intended trust relationships.
• Follow least-privilege principles and grant workloads only the permissions required to perform their tasks.

GitLab is one example of an affected identity provider because its default OIDC subject can be based on a mutable project path.

If you use GitLab with Microsoft Entra workload identities, Microsoft recommends:

• Configuring trust by using immutable project identifiers when available.
• Evaluating Flexible Federated Identity Credentials (preview) to validate additional immutable claims.
• Reviewing existing GitLab-based federated identity credentials for dependencies on mutable project or namespace names.

Learn more

• Connect to cloud services | GitLab Docs
• Mutable subjects in federated identity credentials | Microsoft Entra Workload ID | Microsoft Entra | Microsoft Learn
• Token payload | GitLab Docs

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.