Federated identity credential
In Microsoft Entra, a federated identity credential configures trust in an external workload identity so a matching external token can be exchanged for a Microsoft access token without a stored application secret.
It is trust configuration, not the token itself
A workload first obtains a token from its external provider. Microsoft Entra checks that token against the trust configured on an application or supported managed identity. If the checks pass, Entra issues its own access token for the workload to use.
The standard configuration identifies the external issuer, subject, and allowed audience. These values describe which workload assertion is acceptable. Microsoft checks those values against the incoming token claims. A mismatch can stop the exchange even when the workload successfully obtained a token from its own provider.
Removing a secret does not remove the approval decision
This approach avoids distributing a long-lived application secret to that external workload. It moves attention to the trusted issuer, permitted workload identity, and who can change the configuration or control that workload.
The app credential article explains why an application’s existing authority matters when its authentication changes. Adding a trust relationship does not itself grant new resource permissions, but it can provide another way to authenticate as an application that already has them.
For build automation, also review what code may run with that workload identity. The workflow approval guide addresses the decision to let contributed code execute with the workflow’s available authority.