AADSTS700213: No matching federated identity record found for presented assertion subject 'repo:octo-org@123456/my-repo@456789:ref:refs/heads/main'. Check your federated identity credential Subject, Audience and Issuer
What causes it and how to fix it:
- GitHub Actions OIDC login to Azure fails with AADSTS700213 in repositories created after 15 July 2026New GitHub repositories send the OIDC subject as repo:owner@ownerId/repo@repoId:…, so an Azure federated credential written in the classic repo:owner/repo:… form never matches and azure/login fails with AADSTS700213. Read the repository's sub_claim_prefix from the OIDC REST endpoint and build the subject from itCause and fix →