services / Azure / Federated identity credentials

Federated identity credentials configure OIDC trust bindings (external issuer/subject/audience) on a user-assigned managed identity, allowing an external workload to obtain Azure tokens as that identity without any secret.

These are credential-less trust relationships on an identity that may hold arbitrary RBAC; controlling them enables direct impersonation and persistence, so the asset is identity/credential-tier CRITICAL.

Microsoft.​ManagedIdentity/​userAssignedIdentities/​federatedIdentityCredentials/​write

Adding/updating a FIC lets an attacker register an external OIDC issuer/subject they control as trusted, minting tokens as the managed identity for durable secretless persistence and lateral movement into that identity's privileges.

Risks

1. Account persistence (BOOST)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links