OIDC for Azure

​

Overview

​

Azure AD App + Federated Credential

1. Microsoft Entra ID > App registrations > ”+ New Registration”
   1. Enter Name: e.g., “env zero OIDC app”
   2. Select Supported account types if you’re unsure, choose “Single tenant”
   3. Skip Redirect URI
   4. Register the app.
2. Under the “env zero OIDC app” > “Certificates and Secrets” > “Federated credentials”
   1. “+ Add credential”
   2. Federated Credential Scenario - Other issuer
   3. Issuer - https://login.app.env0.com/
   4. Subject Identifier - auth0|xxxxxx (see the section below on “Retrieving your Subject Identifier”)
   5. Name - enter a name (e.g., “env0 OIDC”)
   6. Audience - api://AzureADTokenExchange
3. For using the Azure Provider in Terraform, we need to specify the following variables:
   1. ARM_TENANT_ID - you can find the value in your app registration summary (“env zero OIDC app”) under “Directory (tenant) ID”
   2. ARM_CLIENT_ID - you can find the value in your app registration summary (“env zero OIDC app”) under “Application (client) ID”
   3. ARM_SUBSCRIPTION_ID - You can retrieve the Subscription ID from the Azure Subscription, or in a Resource Group that you want to use.

​

Azure AD App Permissions

1. In this example, I will give the “env zero OIDC app” the “Contributor” role in my “sales-acme-demo” resource group. This means that env zero will only be able to create and manage resources within this resource group.
2. Go to the Resource Group (”sales-acme-demo”) > Access Control (IAM)
3. Click on “+ Add” > “Add role assignment”\
4. Select a role (the level of privilege to give to Terraform) - in this case, we choose “Contributor” and hit “Next”
5. Assign access to “User, group, or service principal”
6. Select a member by “+ Select Members”
7. Search for “env zero OIDC app” and hit “Select”
8. Hit “Review + assign”\

​

Configure env0 OIDC Credential

• Subscription ID - Azure subscription id
• Tenant ID - Azure tenant id
• Client ID - Azure client id
• Use v2 OIDC token - check this box so env zero mints a token with the api://AzureADTokenExchange audience configured on the federated credential above. The form shows the resulting Audience (aud) value. Leaving it unchecked produces a v1 token (aud: https://prod.env0.com), which the federated credential will reject.

​

Assign your Credential in your Project

​

Deploying to multiple Azure Subscriptions

provider "azurerm" {
  features {}
  use_oidc = true
  //subscription_id = "b48787a1-7145-425f-99af-62cde6c50e31" (optional)
  //env zero will use the subscription ID in defined in the Azure OIDC project credential configuration
}

provider "azurerm" {
  alias = "test"
  features {}
  use_oidc = true
  subscription_id = var.second_subscription
}

variable "second_subscription" {
  type = string
  default = "3ef32f99-33d5-4a4f-bf9c-8a3ebb2b0144"
}

resource "azurerm_resource_group" "example" {
  name     = "env0-example-rg"
  location =  "eastus2"
}

resource "azurerm_resource_group" "second" {
  provider = azurerm.test
  name     = "env0-example-second-rg"
  location =  "eastus2"
}

​

Migrating an existing v1 credential

1. Update the federated credential audience. In Microsoft Entra ID > your app > “Certificates and Secrets” > “Federated credentials”, edit the env zero federated credential and change the Audience from https://prod.env0.com to api://AzureADTokenExchange. If the portal does not let you edit the audience, delete the credential and recreate it with the new audience (keep the same Issuer and Subject Identifier).
2. Enable v2 on the credential. Immediately after, edit the Azure OIDC credential in env zero and check Use v2 OIDC token. The next deployment mints a token with aud: api://AzureADTokenExchange.

​

Next steps

• Retrieve OIDC Subject Identifier - Find the subject identifier for your OIDC token.
• OIDC for AWS - Set up OIDC for AWS as an alternative cloud provider.
• OIDC for GCP - Set up OIDC for Google Cloud Platform.