Minting an Entra Agent Token From GitHub Actions: No Secret, No Certificate, Nothing Stored

Last Updated on October 6, 2026 by Editorial Team Author(s): suman saha Originally published on Towards AI. Minting an Entra Agent Token From GitHub Actions: No Secret, No Certificate, Nothing Stored Third in a series on Entra Agent ID. The first part covered the two-leg exchange and where the client assertion comes from, using a managed identity. The second covered the three configuration steps that have to be complete before the resulting token carries any authorisation. This part runs the same exchange from outside Azure, from a GitHub Actions workflow, and records what is different — which is less than one might expect in the protocol, and more than one might expect in the tooling. What changes, and what does not The exchange itself does not change. Leg 1 authenticates as the blueprint and names the agent identity in fmi_path; leg 2 authenticates as the agent identity using the token leg 1 returned. That is identical whether the workload runs on an Azure VM, in a GitHub-hosted runner, or anywhere else. What changes is step 0 — where the client assertion comes from. With a managed identity, the assertion is issued by the Azure IMDS endpoint and its iss is https://login.microsof…

≈