Use the Azure Login action with a managed identity

  • Article

On a virtual machine configured with managed identities in Azure, you can sign in Azure Login action using the managed identity. You don't need to manage credentials, as they aren't accessible to you. There are two types of managed identities for you to choose: system-assigned managed identities or user-assigned managed identities.

In this tutorial, you learn how to:

  • Create GitHub secrets for system/user-assigned managed identity
  • Set up Azure Login for system/user-assigned managed identity in GitHub Actions workflows

Note

Login with managed identity is only supported for self-hosted runners on Azure virtual machines. For other users, please refer to Sign in with OpenID Connect or Sign in with a service principal and secret.

Prerequisites

Use the Azure Login action with system-assigned managed identity

Learn how to securely authenticate to Azure services from GitHub Actions workflows using Azure Login action with system-assigned managed identity that configured on a virtual machine.

Create GitHub secrets for system-assigned managed identity

  1. Open your GitHub repository and go to Settings. Select settings tab in GitHub repository.

  2. Select Security > Secrets and variables > Actions > New repository secret. Select Security > Secrets and variables > Actions.

    Note

    To enhance workflow security in public repositories, use environment secrets instead of repository secrets. If the environment requires approval, a job cannot access environment secrets until one of the required reviewers approves it.

  3. Create secrets for AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID. Copy these values from your user-assigned managed identity for your GitHub secrets:

    GitHub secret System-assigned managed identity
    AZURE_SUBSCRIPTION_ID Subscription ID
    AZURE_TENANT_ID Directory (tenant) ID

    Note

    For security reasons, we recommend using GitHub Secrets rather than passing values directly to the workflow.

Set up Azure Login action with system-assigned managed identity in GitHub Actions workflows

In this example, you use the system-assigned managed identity to authenticate with Azure with the Azure login action. The example uses GitHub secrets for the subscription-id, and tenant-id values. The self-hosted runner has been labeled self-hosted on GitHub.

name: Run Azure Login with system-assigned managed identity
on: [push]

jobs:
  test:
    runs-on: [self-hosted] # Specify the label of your self-hosted runner here
    steps:
    - name: Azure login
      uses: azure/login@v2
      with:
        auth-type: IDENTITY
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
        enable-AzPSSession: true

    # Azure CLI action only supports linux self-hosted runners for now.
    # If you want to execute the Azure CLI script on a windows self-hosted runner, you can execute it directly in `run`.
    - name: Azure CLI script
      uses: azure/cli@v2
      with:
        azcliversion: latest
        inlineScript: |
          az account show
          # You can write your Azure CLI inline scripts here.

    - name: Azure PowerShell script
      uses: azure/powershell@v2
      with:
        azPSVersion: latest
        inlineScript: |
          Get-AzContext
          # You can write your Azure PowerShell inline scripts here.

Use the Azure Login action with user-assigned managed identity

Learn how to securely authenticate to Azure services from GitHub Actions workflows using Azure Login action with user-assigned managed identity that configured on a virtual machine.

Create GitHub secrets for user-assigned managed identity

  1. Open your GitHub repository and go to Settings. Select settings tab in GitHub repository.

  2. Select Security > Secrets and variables > Actions > New repository secret. Select Security > Secrets and variables > Actions.

    Note

    To enhance workflow security in public repositories, use environment secrets instead of repository secrets. If the environment requires approval, a job cannot access environment secrets until one of the required reviewers approves it.

  3. Create secrets for AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID. Copy these values from your user-assigned managed identity for your GitHub secrets:

    GitHub secret User-assigned managed identity
    AZURE_CLIENT_ID Client ID
    AZURE_SUBSCRIPTION_ID Subscription ID
    AZURE_TENANT_ID Directory (tenant) ID

    Note

    For security reasons, we recommend using GitHub Secrets rather than passing values directly to the workflow.

Set up Azure Login action with user-assigned managed identity in GitHub Actions workflows

In this example, you use the user-assigned managed identity to authenticate with Azure with the Azure login action. The example uses GitHub secrets for the client-id, subscription-id, and tenant-id values. The self-hosted runner has been labeled self-hosted on GitHub.

name: Run Azure Login with user-assigned managed identity
on: [push]

jobs:
  test:
    runs-on: [self-hosted] # Specify the label of your self-hosted runner here
    steps:
    - name: Azure login
      uses: azure/login@v2
      with:
        auth-type: IDENTITY
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
        enable-AzPSSession: true

    # Azure CLI action only supports linux self-hosted runners for now.
    # If you want to execute the Azure CLI script on a windows self-hosted runner, you can execute it directly in `run`.
    - name: Azure CLI script
      uses: azure/cli@v2
      with:
        azcliversion: latest
        inlineScript: |
          az account show 
          # You can write your Azure CLI inline scripts here.

    - name: Azure PowerShell script
      uses: azure/powershell@v2
      with:
        azPSVersion: latest
        inlineScript: |
          Get-AzContext
          # You can write your Azure PowerShell inline scripts here.