GitHub now uses immutable owner and repository IDs in the OIDC subject claim for new repositories, which means older trust policies can stop matching if they still expect the plain repo/org name format.
In my case, the fix in Azure Entra ID was to choose Other issuer and enter the full subject string manually, instead of using the GitHub preset fields. In the "GitHub Actions deploying Azure resource" scenario, you can't enter the @ symbol, so the preset does not work for the new GitHub OIDC format.
For the Other issuer, the values are:
- Issuer:
https://token.actions.githubusercontent.com(without spaces) - Audience:
api://AzureADTokenExchange - Subject identifier:
repo:OrgName@123456789/RepoName@987654321:environment:dev
If your workflow uses a different environment name, replace 'dev' with that value. If you are not using environments, the subject format will be different. This is a good reminder that identity and trust configuration is part of your deployment surface. Small changes in OIDC claims can have big effects on CI/CD pipelines.
A small change in GitHub, a broken login in Azure, and a useful lesson for anyone using federated identity in production.