# AADSTS70021: No matching federated identity record found for presented assertion (GitHub Actions / workload identity)

**Code:** `AADSTS70021` · **Category:** Azure · **Seen on:** Azure

The OIDC token from GitHub Actions/Kubernetes/another IdP doesn’t match any federated credential on the app — issuer, subject or audience differ.

## Meaning

Federated credentials match exactly on issuer and subject (e.g. repo:org/repo:ref:refs/heads/main or repo:org/repo:environment:prod). Running from another branch, a pull request, or an environment changes the subject.

## Common causes

- Subject doesn’t match (branch vs environment vs pull_request)
- Wrong issuer URL
- Audience not api://AzureADTokenExchange
- Federated credential added to a different app

## Quick fix

1. Read the assertion’s subject from the error and add a matching federated credential
2. Use environment-based subjects for deployment jobs
3. Check the client ID used by azure/login

## Detailed fix by platform

### Azure CLI

1. `az ad app federated-credential create --id <app-id> --parameters '{"name":"main","issuer":"https://token.actions.githubusercontent.com","subject":"repo:myorg/myrepo:ref:refs/heads/main","audiences":["api://AzureADTokenExchange"]}'`

## How to diagnose

1. **Subject** — Value in the error message
2. **Credentials** — az ad app federated-credential list
3. **Client ID** — Same app?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/azure/aadsts70021-no-matching-federated-identity)