Federated Identity Credentials now use case-sensitive matching

Effective date: September 2024 Protocol impacted: Workload identity federation Change Previously, when matching the Federated Identity Credential (FIC) issuer, subject, and audience values against the corresponding issuer, subject, and audience values contained in the token sent to Microsoft Entra ID by an external IdP, case-insensitive matching was used. To provide more fine-grained control to customers, we're switching to enforcing case-sensitive matching. Invalid example: Token subject: repo:contoso/contoso-org:ref:refs/heads/main FIC subject: repo:Contoso/Contoso-Org:ref:refs/heads/main These two subject values don't case-sensitively match, so validation fails. The same mechanism is applied to issuer and audience validation. This change will be applied initially to applications or managed identities created after August 14th, 2024. Inactive applications or managed identities, determined by there being zero Workload Identity Federation requests made by said application or managed identity between the period August 1st, 2024 to August 31st, 2024, are required to use case-sensitive matching starting September 27th, 2024. For active applications, case-sensitive matching comes at a later date to be communicated. To better highlight failures due to case-sensitivity, we're revamping the error message for AADSTS700213. It will now state; `AADSTS700213: No matching federated identity record found for presented assertion subject '{subject}'. Please note that matching is done using a case-sensitive comparison. Check your federated identity credential Subject, Audience, and Issuer…

Permanent link to this revision