A clerk's office forbids long-lived personal access tokens for Azure Machine Learning and GitHub integration and prefers a short-lived federated identity pattern. What should they configure?

Workload identity federation lets GitHub Actions obtain short-lived Azure credentials for Azure Machine Learning and related deployments without standing personal access tokens. The clerk's office preference matches modern secure integration: federation exchanges an OIDC token from the Actions run for Azure AD access scoped to the municipal subscription and workspace roles. Credentials expire with the job, reducing blast radius if logs or forks leak secrets, and eliminate the need to rotate long-lived PATs stored in variable groups.

Using workload identity federation for Azure Pipelines to obtain short-lived credentials for Azure Machine Learning workspaces fails by platform: the stem requires GitHub Actions integration, and an Azure Pipelines federated trust does not accept GitHub OIDC subject claims, so GitHub workflow runs could not exchange tokens for Azure access.

Using workload identity federation patterns so Azure ML jobs obtain short-lived GitHub credentials without standing secrets fails by direction: the requirement is for GitHub Actions to obtain short-lived Azure credentials, not for Azure ML to obtain GitHub credentials, so it reverses issuer and resource and does not give workflows Azure access.

Configuring federated credentials on a user-assigned managed identity so GitHub Actions obtains short-lived Azure credentials fails by placement: the GitHub-to-Azure OIDC trust for workspace deployment belongs on the Entra app registration for the Actions repo and environment, not on a compute-bound managed identity, so it would not provide the required workspace-scoped access.

Exam caveat: AI-300 and related Azure guidance favor federated/short-lived credentials for GitHub–Azure integration over long-lived PATs when the stem forbids standing tokens. Operational check: configure the federated credential on the Azure app registration for the Actions repo and environment, remove PATs from secrets, run a pipeline deploy, and confirm Azure activity logs show token exchange from the workflow identity without PAT usage.