services / Azure / Federated identity credentials

Federated identity credentials configure OIDC trust bindings (external issuer/subject/audience) on a user-assigned managed identity, allowing an external workload to obtain Azure tokens as that identity without any secret.

These are credential-less trust relationships on an identity that may hold arbitrary RBAC; controlling them enables direct impersonation and persistence, so the asset is identity/credential-tier CRITICAL.

Microsoft.​ManagedIdentity/​userAssignedIdentities/​federatedIdentityCredentials/​delete

Deleting a FIC removes the OIDC trust binding (an access-control policy) that legitimate federated workloads rely on, both destroying the trust policy and denying those workloads their authorized access.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links