federated_identity_credentials

Creates, updates, deletes, gets or lists a federated_identity_credentials resource.

Overview

Name	federated_identity_credentials
Type	Resource
Id	entra_id.service_principals.federated_identity_credentials

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
name	string	The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
audiences	array	The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
description	string	The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
issuer	string	The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
subject	string	Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

get_2

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
name	string	The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
audiences	array	The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
description	string	The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
issuer	string	The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
subject	string	Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
name	string	The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
audiences	array	The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
description	string	The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
issuer	string	The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
subject	string	Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	service_principal_id, federated_identity_credential_id		Federated identities for a specific type of service principal - managed identity. Supports $expand and $filter (/$count eq 0, /$count ne 0).
get_2	select	service_principal_id, name		Federated identities for a specific type of service principal - managed identity. Supports $expand and $filter (/$count eq 0, /$count ne 0).
list	select	service_principal_id		Federated identities for a specific type of service principal - managed identity. Supports $expand and $filter (/$count eq 0, /$count ne 0).
insert	insert	service_principal_id
update	update	service_principal_id, federated_identity_credential_id
update_2	update	service_principal_id, name
delete	delete	service_principal_id, federated_identity_credential_id	If-Match
delete_2	delete	service_principal_id, name	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
federated_identity_credential_id	string	The unique identifier of federatedIdentityCredential
name	string	Alternate key of federatedIdentityCredential
service_principal_id	string	The unique identifier of servicePrincipal
If-Match	string	ETag

SELECT examples

get

Federated identities for a specific type of service principal - managed identity. Supports $expand and $filter (/$count eq 0, /$count ne 0).

SELECT
id,
name,
audiences,
description,
issuer,
subject
FROM entra_id.service_principals.federated_identity_credentials
WHERE service_principal_id = '{{ service_principal_id }}' -- required
AND federated_identity_credential_id = '{{ federated_identity_credential_id }}' -- required
;

get_2

Federated identities for a specific type of service principal - managed identity. Supports $expand and $filter (/$count eq 0, /$count ne 0).

SELECT
id,
name,
audiences,
description,
issuer,
subject
FROM entra_id.service_principals.federated_identity_credentials
WHERE service_principal_id = '{{ service_principal_id }}' -- required
AND name = '{{ name }}' -- required
;

list

Federated identities for a specific type of service principal - managed identity. Supports $expand and $filter (/$count eq 0, /$count ne 0).

SELECT
id,
name,
audiences,
description,
issuer,
subject
FROM entra_id.service_principals.federated_identity_credentials
WHERE service_principal_id = '{{ service_principal_id }}' -- required
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.service_principals.federated_identity_credentials (
id,
audiences,
description,
issuer,
name,
subject,
service_principal_id
)
SELECT 
'{{ id }}',
'{{ audiences }}',
'{{ description }}',
'{{ issuer }}',
'{{ name }}',
'{{ subject }}',
'{{ service_principal_id }}'
RETURNING
id,
name,
audiences,
description,
issuer,
subject
;

Manifest

# Description fields are for documentation purposes
- name: federated_identity_credentials
props:
  - name: service_principal_id
    value: "{{ service_principal_id }}"
    description: Required parameter for the federated_identity_credentials resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: audiences
    value:
      - "{{ audiences }}"
    description: |
      The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required.
  - name: description
    value: "{{ description }}"
    description: |
      The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional.
  - name: issuer
    value: "{{ issuer }}"
    description: |
      The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required.
  - name: name
    value: "{{ name }}"
    description: |
      The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq).
  - name: subject
    value: "{{ subject }}"
    description: |
      Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq).

UPDATE examples

update

No description available.

UPDATE entra_id.service_principals.federated_identity_credentials
SET 
id = '{{ id }}',
audiences = '{{ audiences }}',
description = '{{ description }}',
issuer = '{{ issuer }}',
name = '{{ name }}',
subject = '{{ subject }}'
WHERE 
service_principal_id = '{{ service_principal_id }}' --required
AND federated_identity_credential_id = '{{ federated_identity_credential_id }}' --required
RETURNING
id,
name,
audiences,
description,
issuer,
subject;

update_2

No description available.

UPDATE entra_id.service_principals.federated_identity_credentials
SET 
id = '{{ id }}',
audiences = '{{ audiences }}',
description = '{{ description }}',
issuer = '{{ issuer }}',
name = '{{ name }}',
subject = '{{ subject }}'
WHERE 
service_principal_id = '{{ service_principal_id }}' --required
AND name = '{{ name }}' --required
RETURNING
id,
name,
audiences,
description,
issuer,
subject;

DELETE examples

delete

No description available.

DELETE FROM entra_id.service_principals.federated_identity_credentials
WHERE service_principal_id = '{{ service_principal_id }}' --required
AND federated_identity_credential_id = '{{ federated_identity_credential_id }}' --required
AND If-Match = '{{ If-Match }}'
;

delete_2

No description available.

DELETE FROM entra_id.service_principals.federated_identity_credentials
WHERE service_principal_id = '{{ service_principal_id }}' --required
AND name = '{{ name }}' --required
AND If-Match = '{{ If-Match }}'
;