skills.rest
PlagueHO
PlagueHOCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

provision-github-azure-federated-identity

Provisions an Azure User Managed Identity with GitHub OIDC federation and RBAC.

4|Updated Mar 18, 2026
Search Tags:#github#azure#rbac#passwordless#oidc#federated-identity#uami
One-click install
npx skills add https://github.com/PlagueHO/plagueho.skills --skill provision-github-azure-federated-identity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: provision-github-azure-federated-identity
Source: https://github.com/PlagueHO/plagueho.skills/tree/main/plugins/azure-infrastructure-deployment/skills/provision-github-azure-federated-identity
Command: npx skills add https://github.com/PlagueHO/plagueho.skills --skill provision-github-azure-federated-identity

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Az.Accounts, Az.Resources, Az.ManagedServiceIdentity, and includes scripts (resource) components.

What problem does it solve?

This Skill provisions a single Azure User Assigned Managed Identity (UAMI) with OpenID Connect federation and RBAC bindings to GitHub, enabling passwordless authentication for GitHub Actions or Copilot without long-lived credentials.

Core Features & Use Cases

  • Create or verify a GitHub integration resource group and a User Assigned Managed Identity (UAMI) for GitHub OIDC.
  • Configure a Federated Identity Credential binding the UAMI to the GitHub repository and environment.
  • Assign idempotent RBAC roles at subscription scope (default: Contributor + User Access Administrator) with a least-privilege condition, plus options to customize roles and remove unlisted ones.
  • Supports both GitHub Actions environments and the Copilot coding agent; outputs credentials for GitHub secrets.

Quick Start

Run the PowerShell script with the required parameters to provision a GitHub identity for your repository.

Frequently Asked Questions about provision-github-azure-federated-identity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure passwordless authentication from GitHub Actions to Azure?▼

Passwordless authentication from GitHub Actions to Azure is configured by provisioning a User Assigned Managed Identity and binding it to your repository using a Federated Identity Credential. This eliminates long-lived secrets by trusting GitHub's OIDC tokens.

What is the best way to set up GitHub OIDC with an Azure Managed Identity?▼

Setting up GitHub OIDC involves creating an Azure User Assigned Managed Identity and a federated credential linking it to your GitHub repository. This approach enables secure, passwordless deployments without storing Azure credentials as GitHub secrets.

Can I use this to provision Azure access for the GitHub Copilot coding agent?▼

Yes, this process supports provisioning Azure identities for both GitHub Actions environments and the Copilot coding agent. It configures the necessary federated identity credential and subscription-scoped RBAC roles for either target.

Do I need specific Azure PowerShell modules to provision federated identity credentials?▼

Yes, provisioning requires the Az.Accounts, Az.Resources, and Az.ManagedServiceIdentity Azure PowerShell modules. You must also have an authenticated Azure session with sufficient permissions to create resources and assign RBAC roles.

How do I assign subscription-scoped RBAC roles to a GitHub Managed Identity?▼

Subscription-scoped RBAC roles are assigned idempotently during identity provisioning, defaulting to Contributor and User Access Administrator with a least-privilege condition. You can customize these roles and optionally remove any unlisted ones during the setup process.

What happens if I run the GitHub OIDC identity provisioning script multiple times?▼

The provisioning process is completely idempotent, meaning running it multiple times will safely create or verify the resource group, User Assigned Managed Identity, federated credential, and RBAC role assignments without causing duplication or errors.

Related Skills

Explore More Software Engineering Skills→
PlagueHOPlagueHO
1

azure-github-managed-identity

Provision Azure User Assigned Managed Identities with OIDC federation and RBAC for GitHub Actions.

Community
Advanced
jaredcroxtonjaredcroxton

github-repo-management

Clone, create, fork, and configure GitHub repositories via CLI.

Community
Intermediate
dodygdodyg

dotnet-gha-deploy

Automate .NET deployments via GitHub Actions to Azure Web Apps, GitHub Pages, and container registries.

Community
Advanced
microsoftmicrosoft
2.9k

azure-keyvault-py

Manage Azure Key Vault secrets, keys, and certificates from Python.

Official
Advanced