Microsoft Entra Workload ID
DeveloperWorkload Identity Federation Config App Trust Managed Identity
In brief
The PowerShell example now uses a different Subject value for the managed identity federated credential.
What Entra admins need to know
Use the updated Subject value when following the documented example.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The audience value must be set to one of the following values:
• Entra ID Global Service: api://AzureADTokenExchange
• Entra ID for US Government: api://AzureADTokenExchangeUSGov
• Entra ID China operated by 21Vianet: api://AzureADTokenExchangeChina
New-AzADAppFederatedCredential -ApplicationObjectId $appObjectId -Audience api://AzureADTokenExchange -Issuer 'https://login.microsoftonline.com/{tenantID}/v2.0' -Name 'MyMsiFic' -Subject 'aaaabbbb-aaaaaaaa-0000-cccc-1111-dddd2222eeee2222-bbbbbbbbbbbb'
@@ -116,7 +116,7 @@ Open a PowerShell terminal in your preferred IDE and run the following command t The audience value must be set to one of the following values:<br/> • **Entra ID Global Service**: *api://AzureADTokenExchange* <br/>• **Entra ID for US Government**: *api://AzureADTokenExchangeUSGov* <br/>• **Entra ID China operated by 21Vianet**: *api://AzureADTokenExchangeChina* <br/> ```Powershell-New-AzADAppFederatedCredential -ApplicationObjectId $appObjectId -Audience api://AzureADTokenExchange -Issuer 'https://login.microsoftonline.com/{tenantID}/v2.0' -Name 'MyMsiFic' -Subject 'aaaabbbb-0000-cccc-1111-dddd2222eeee'+New-AzADAppFederatedCredential -ApplicationObjectId $appObjectId -Audience api://AzureADTokenExchange -Issuer 'https://login.microsoftonline.com/{tenantID}/v2.0' -Name 'MyMsiFic' -Subject 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb' ```