Azure ML automation auth: OIDC federated credential vs service principal secret
Verdict: Prefer OIDC with a federated credential: store client, tenant and subscription IDs, no long-lived secret. Unattended jobs use a service principal, not interactive auth. Trusted services and workspace identities authenticate by managed identity.
| Criterion | OIDC federated credential | Service principal secret |
|---|---|---|
| What GitHub stores | AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID | A client secret (AZURE_CREDENTIALS JSON) |
| Token lifetime | Short-lived federated tokens per run | Long-lived stored secret |
| Security | Recommended; nothing to leak or rotate | Documented as less secure, not recommended |
| Trust anchored by | Federated credential subject = repo and branch/environment | The stored secret itself |
Rules
- Unattended training jobs configure a service principal (tenant ID, client ID, client secret via environment variables); interactive auth blocks on a browser prompt.
- For azure/login with OIDC, supply the application's Client ID, tenant ID and subscription ID; no long-lived secret is stored.
- Store AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_SUBSCRIPTION_ID as separate secrets for azure/login@v2 OIDC; the federated credential supplies trust without a stored secret.
- The federated credential's subject names the GitHub repository and the branch or environment whose tokens Azure will trust.
- Workspaces created after 2024-11-19 assign the system-assigned managed identity the Azure AI Administrator role, more narrowly scoped than Contributor (least privilege).
- A Foundry managed identity reading a bring-your-own blob account needs Storage Blob Data Reader on that storage account, not Storage Account Contributor.
Traps
- A user-assigned managed identity has no client secret; federated credentials exist precisely to avoid validating a stored secret.
- Trusted Azure services (for example Azure AI Search reaching a locked-down Foundry) authenticate by managed identity plus a role assignment, not an API key or SAS token.