federated_identity_credentials

Creates, updates, deletes, gets or lists a federated_identity_credentials resource.

Overview

Name	federated_identity_credentials
Type	Resource
Id	entra_id.applications.federated_identity_credentials

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
name	string	The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
audiences	array	The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
description	string	The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
issuer	string	The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
subject	string	Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

get_2

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
name	string	The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
audiences	array	The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
description	string	The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
issuer	string	The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
subject	string	Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
name	string	The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
audiences	array	The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
description	string	The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
issuer	string	The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
subject	string	Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	application_id, federated_identity_credential_id		Read the properties and relationships of a federatedIdentityCredential object assigned to an application.
get_2	select	application_id, name		Read the properties and relationships of a federatedIdentityCredential object assigned to an application.
list	select	application_id		Get a list of the federatedIdentityCredential objects and their properties assigned to an application.
insert	insert	application_id		Create a new federatedIdentityCredential object for an application. By configuring a trust relationship between your Microsoft Entra application registration and the identity provider for your compute platform, you can use tokens issued by that platform to authenticate with Microsoft identity platform and call APIs in the Microsoft ecosystem. Maximum of 20 objects can be added to an application.
update	update	application_id, federated_identity_credential_id		Create a new federatedIdentityCredential object for an application if it doesn't exist, or update the properties of an existing federatedIdentityCredential object. By configuring a trust relationship between your Microsoft Entra application registration and the identity provider for your compute platform, you can use tokens issued by that platform to authenticate with Microsoft identity platform and call APIs in the Microsoft ecosystem. Maximum of 20 objects can be added to an application.
update_2	update	application_id, name		Create a new federatedIdentityCredential object for an application if it doesn't exist, or update the properties of an existing federatedIdentityCredential object. By configuring a trust relationship between your Microsoft Entra application registration and the identity provider for your compute platform, you can use tokens issued by that platform to authenticate with Microsoft identity platform and call APIs in the Microsoft ecosystem. Maximum of 20 objects can be added to an application.
delete	delete	application_id, federated_identity_credential_id	If-Match	Delete a federatedIdentityCredential object from an application.
delete_2	delete	application_id, name	If-Match	Delete a federatedIdentityCredential object from an application.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
application_id	string	The unique identifier of application
federated_identity_credential_id	string	The unique identifier of federatedIdentityCredential
name	string	Alternate key of federatedIdentityCredential
If-Match	string	ETag

SELECT examples

get

Read the properties and relationships of a federatedIdentityCredential object assigned to an application.

SELECT
id,
name,
audiences,
description,
issuer,
subject
FROM entra_id.applications.federated_identity_credentials
WHERE application_id = '{{ application_id }}' -- required
AND federated_identity_credential_id = '{{ federated_identity_credential_id }}' -- required
;

get_2

Read the properties and relationships of a federatedIdentityCredential object assigned to an application.

SELECT
id,
name,
audiences,
description,
issuer,
subject
FROM entra_id.applications.federated_identity_credentials
WHERE application_id = '{{ application_id }}' -- required
AND name = '{{ name }}' -- required
;

list

Get a list of the federatedIdentityCredential objects and their properties assigned to an application.

SELECT
id,
name,
audiences,
description,
issuer,
subject
FROM entra_id.applications.federated_identity_credentials
WHERE application_id = '{{ application_id }}' -- required
;

INSERT examples

insert

Create a new federatedIdentityCredential object for an application. By configuring a trust relationship between your Microsoft Entra application registration and the identity provider for your compute platform, you can use tokens issued by that platform to authenticate with Microsoft identity platform and call APIs in the Microsoft ecosystem. Maximum of 20 objects can be added to an application.

INSERT INTO entra_id.applications.federated_identity_credentials (
id,
audiences,
description,
issuer,
name,
subject,
application_id
)
SELECT 
'{{ id }}',
'{{ audiences }}',
'{{ description }}',
'{{ issuer }}',
'{{ name }}',
'{{ subject }}',
'{{ application_id }}'
RETURNING
id,
name,
audiences,
description,
issuer,
subject
;

Manifest

# Description fields are for documentation purposes
- name: federated_identity_credentials
props:
  - name: application_id
    value: "{{ application_id }}"
    description: Required parameter for the federated_identity_credentials resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: audiences
    value:
      - "{{ audiences }}"
    description: |
      The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
  - name: description
    value: "{{ description }}"
    description: |
      The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
  - name: issuer
    value: "{{ issuer }}"
    description: |
      The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
  - name: name
    value: "{{ name }}"
    description: |
      The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
  - name: subject
    value: "{{ subject }}"
    description: |
      Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

UPDATE examples

update

Create a new federatedIdentityCredential object for an application if it doesn't exist, or update the properties of an existing federatedIdentityCredential object. By configuring a trust relationship between your Microsoft Entra application registration and the identity provider for your compute platform, you can use tokens issued by that platform to authenticate with Microsoft identity platform and call APIs in the Microsoft ecosystem. Maximum of 20 objects can be added to an application.

UPDATE entra_id.applications.federated_identity_credentials
SET 
id = '{{ id }}',
audiences = '{{ audiences }}',
description = '{{ description }}',
issuer = '{{ issuer }}',
name = '{{ name }}',
subject = '{{ subject }}'
WHERE 
application_id = '{{ application_id }}' --required
AND federated_identity_credential_id = '{{ federated_identity_credential_id }}' --required
RETURNING
id,
name,
audiences,
description,
issuer,
subject;

update_2

Create a new federatedIdentityCredential object for an application if it doesn't exist, or update the properties of an existing federatedIdentityCredential object. By configuring a trust relationship between your Microsoft Entra application registration and the identity provider for your compute platform, you can use tokens issued by that platform to authenticate with Microsoft identity platform and call APIs in the Microsoft ecosystem. Maximum of 20 objects can be added to an application.

UPDATE entra_id.applications.federated_identity_credentials
SET 
id = '{{ id }}',
audiences = '{{ audiences }}',
description = '{{ description }}',
issuer = '{{ issuer }}',
name = '{{ name }}',
subject = '{{ subject }}'
WHERE 
application_id = '{{ application_id }}' --required
AND name = '{{ name }}' --required
RETURNING
id,
name,
audiences,
description,
issuer,
subject;

DELETE examples

delete

Delete a federatedIdentityCredential object from an application.

DELETE FROM entra_id.applications.federated_identity_credentials
WHERE application_id = '{{ application_id }}' --required
AND federated_identity_credential_id = '{{ federated_identity_credential_id }}' --required
AND If-Match = '{{ If-Match }}'
;

delete_2

Delete a federatedIdentityCredential object from an application.

DELETE FROM entra_id.applications.federated_identity_credentials
WHERE application_id = '{{ application_id }}' --required
AND name = '{{ name }}' --required
AND If-Match = '{{ If-Match }}'
;